Valuation by Sub-Segment

Cyber is not one valuation market — it is a dozen, and the spread between the most- and least-prized niches is wider than the spread between stages or even regimes. A cloud-security platform and a threat-intel vendor with identical ARR, growth and margins will not clear at the same multiple, and the gap is structural, not a mispricing. One split shows how far niche pricing diverges: in Finro's Q2 2026 dataset, threat intelligence trades at public ~1.2x ↔ private ~16.6x ↔ M&A ~11.4x (Finro, Jun 3 2026) — three "comps" for the same niche, an order of magnitude apart. Anchoring a threat-intel seller to their last private round over-prices by 30%+; anchoring to the public tape under-prices by 10x. The niche is not broken — it reflects threat intel's low scalability and thin independent-buyer set, so neither the public market nor strategics will validate a venture mark. Every sub-segment carries a story like this.

The principle: multiples track scarcity × scalability × strategic pull

A niche's multiple is not set by how important the security problem is — it is set by three structural facts about the assets in it:

1. Scarcity of independent leaders. The fewer the credible pure-plays, the higher the premium a strategic must pay to own one (cloud, data, OT, identity). Once a niche has been consolidated down to two or three independents, each remaining one re-rates on scarcity alone.
2. Scalability of the business model. Software with 75–85% gross margins and land-and-expand NRR supports a high multiple; people-heavy services (MSSP/MDR, consulting, IR) and lower-retention models (threat intel) are capped — they trade on EBITDA, not ARR.
3. Strategic pull (platform demand). When platform consolidators need a capability to complete a bundle, they bid above financial-buyer levels (AI security, machine identity, CNAPP). When a capability has commoditized into platforms, acquirers price the discount (AppSec, endpoint, threat intel).

The same three forces explain why the M&A-vs-private premium flips sign by niche: where pure-plays are scarce and strategically pulled, acquirers pay above the private market; where the capability is commoditizing, they pay below it (see the 12 niche table).

The sub-segment multiple ladder (Q2 2026, EV/Revenue)

The niches, in detail

Cloud security (CNAPP / CWPP / DSPM) — the ceiling (~31x M&A avg). The hottest value pool in cyber: scarce platform assets, hyperscaler demand, and a generational reset comp in Google–Wiz ($32B, 2025). CNAPP consolidates a half-dozen formerly separate tools, so a leader is a platform, not a feature. The premium is real and concentrated — Wiz traded ~26.7x, Lightspin ~37.0x — but it lives in the few genuine independents. Why it matters for M&A: the scarcity is nearly exhausted; the remaining independents re-rate every time one is bought.

Data security (DSPM / DLP / governance / resilience) — premium on the AI tailwind (~29x M&A avg). AI has turned "where is our sensitive data and who/what can touch it" into a board-level question, and Cyera is the bellwether: ~2x valuation step-up in ~12 months ($6B Jun'25 → $9B Jan'26 → $12B Jun 2026, >$150M ARR; page 11). Regulation + AI data sprawl drive durable demand. Why it matters: this is the niche where private marks are running fastest, so the forward rather than the last round is the discipline.

Identity / IAM / PAM / machine identity (~20x M&A avg). The most active niche — most M&A deals of any segment — on zero-trust and the explosion of non-human / agent identity. PANW–CyberArk ($25B, closed Feb 11 2026) put PAM at the platform center; a wave of NHI tuck-ins follows (SailPoint–Entro, 1Password–Apono, Cisco–WideField; page 11). Why it matters: identity is fragmenting into sub-niches that each price differently — workforce IAM (mature) vs. CIAM vs. PAM (strategic) vs. NHI/secrets (scarcity).

OT / ICS — re-rating up on scarcity (~20x M&A avg, recently above). Asset-centric, hard-to-replace, and suddenly the object of a strategic scramble: Mitsubishi Electric–Nozomi (~$1B EV, completed Jan 28 2026), ServiceNow–Armis ($7.75B, completed Apr 20 2026), and Accenture–Dragos/runZero/NetRise (~$4.18B, ~20x ARR, announced Jun 18 2026) removed three of the largest independents inside six months. Why it matters: Claroty — now essentially the last marquee independent — re-rates on scarcity; the niche moved from "mid" to premium inside a year.

Endpoint / XDR — oligopoly discipline (~13–15x; M&A below private). A mature oligopoly (CrowdStrike, SentinelOne, Microsoft, Palo Alto) where buyers are disciplined and the few remaining targets are sub-scale. Why it matters: acquirers price the commoditization; a control premium is unlikely where the category is already won.

AppSec / supply chain — commoditization discount (M&A ~−1.6x to private). Real demand, but the category is fragmenting and commoditizing into platforms; acquirers price that. Snyk sets the developer-first ceiling; everything below trades on absorption risk (03f). Why it matters: strategic pull is realized by selling early, before the platform builds the capability natively.

Threat intel — the lowest ladder rung (~8–11x M&A, public ~1.2x). Low scalability, weak retention, and a thin independent-buyer set. Mastercard–Recorded Future ($2.65B, 2024) was a fraud/identity-adjacency buy, not a pure-play re-rate (Recorded Future ~7.8x, Darktrace ~8.2x). Why it matters: this is the niche where stale public comps badly underprice and last-round marks badly overprice — the relevant anchor is recent precedents only.

Managed services (MSSP / MDR) — a different axis entirely (8–14x EBITDA). People-heavy, so these price on EV/EBITDA, not EV/ARR. The value lever is recurring/managed mix and services attach, not ARR growth (LevelBlue–Trustwave, Sophos–Secureworks; 04a, 04b). Why it matters: an MSSP does not belong on a revenue-multiple chart — that mis-frames the asset by 2–3x.

How the ladder is applied

The niche sets the base multiple; company fundamentals (growth, net revenue retention, Rule of 40) then position an asset within the niche's band rather than moving it across bands. A 35%-growth identity asset sits toward the top of the ~20x identity band, not in the cloud band. Cross-niche comparison is the most common source of valuation error.

The sign of the M&A-vs-private gap shapes how a niche's transactions are priced. In niches trading at an M&A premium (cloud, data, OT, identity), precedent transactions run above private marks and tend to anchor pricing. In niches trading at a discount (threat intel, endpoint, AppSec), recent private rounds sit above what acquirers pay, and completed transactions typically clear below the last-round valuation.

→ Cross-references: Valuation Benchmarks, Public Trading Comps, M&A Deals & Comps, Precedent-Transaction Methodology, Sub-Segment Deep Dives, Vendors.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.