Key People
Cyber M&A is a people business: the warm-intro path beats the cold pitch. This relationship map organizes the human graph by role and decision power, cross-referenced against the 8,234 LinkedIn contacts for warm-intro pathfinding (a core Cyber Ecosystem Graph capability).
The map lists roles and archetypes plus named anchors where they are public and stable. Named executives shift as people move (exec moves are themselves M&A signals); specific individuals are enriched from the LinkedIn graph and CyberDB rather than stored speculatively.
See Key People by Role for the decision-maker map by role (authority vs. priority), named anchors per role, and warm-intro economics.
Decision-maker roles by deal relevance
| Role | Where they sit | Why they matter | relevance |
|---|---|---|---|
| CEO (vendor) | Target & buyer | Final decision on sell or buy | Sell-side: the founder/CEO is the client. Buy-side: the acquirer's CEO sets strategy |
| CFO | Both | Owns valuation, financing, board case | Key in any process |
| CTO / CPO | Both | Product/tech fit & integration | Diligence counterpart |
| CRO / VP Sales | Both | Revenue quality, GTM synergy | Diligence + value story |
| CISO (buyer/customer) | Enterprises, gov | The buyer of security; voice of demand | Validates target's product-market fit; reference network |
| PE Operating Partner | Sponsors | Drives portfolio M&A | Retainer decision-maker for portfolio mandates |
| VC/Growth Partner | Investors | Board influence on exits | Sell-side origination & warm intros |
The personas that matter most to 's three objectives
Notable public figures (stable anchors)
- PE: Orlando Bravo, Seth Boro, Chip Virnig (Thoma Bravo); Robert Smith (Vista); Greg Clark, Hugh Thompson (Crosspoint).
- Vendor CEOs: George Kurtz (CrowdStrike), Nikesh Arora (Palo Alto), Jay Chaudhry (Zscaler), Tomer Weingarten (SentinelOne), Todd McKinnon (Okta), Matt Kalan/Udi Mokady-legacy (CyberArk).
- Investors: Richard Seewald (Evolution), Alberto Yépez/Don Dixon (Forgepoint), Dave DeWalt (NightDragon), Yoav Leitersdorf (YL Ventures).
(Names are illustrative anchors; the LinkedIn graph is the live source of truth for current titles and moves.)
Recent executive moves (rolling)
| Date | Person | Move | Why it matters |
|---|---|---|---|
| Jul 2026 | John DeSimone (ex-CEO Nightwing — RTX's Cybersecurity, Intelligence & Services business carved out and sold to Blackstone for ~$1.3B in 2024, rebranded Nightwing) | Appointed Chief Operating Officer, Everfox | Government-cyber operator consolidation: Everfox (the government-security business carved out of Forcepoint) adds a defense-cyber CEO-caliber operator as COO, days after ex-Everfox CEO Sean Berg took the CEO seat at Carlyle's Secturion (see 11, 14). A second senior government-cyber leadership placement in the same orbit firms a repeatable sourcing pattern — carve-out/defense-cyber alumni cycling into sponsor- and platform-CEO/COO seats. (SecurityWeek People on the Move) |
| Jul 2026 | Ron Dovich (4 years as SVP Engineering, Brinqa; earlier engineering leadership in security) | Appointed Chief AI and Automation Officer, Brinqa | AI/automation C-suite creation in a PE-backed risk & compliance platform — signals board-level prioritization of agentic capabilities and automation in GRC/risk-management workloads; a pattern echoed across platforms as vendors position for autonomous-agent integration. Brinqa Objective-1 watch |
| Jul 2026 | Sherrod DeGrippo (two decades in threat intelligence; most recently senior threat-intel leadership at Microsoft; earlier Proofpoint) | Appointed Head of Threat Intelligence, Unit 42, Palo Alto Networks | Marquee threat-intel talent consolidating at the largest platform vendors — Unit 42's research output is a demand-generation and brand asset for PANW's platformization; talent flow from Microsoft to PANW mirrors the platform-vs-platform contest. (MarTech360, Jul 2026) |
| Jun 2026 | Philip Martin (ex-Chief Security Officer, Coinbase — led a 250+ person global security org; earlier Palantir, Amazon) | Appointed Chief Information Security Officer, Uber | Large-enterprise demand-side anchor: a top-tier consumer-platform CISO seat filled from crypto's largest exchange; continues the pattern of high-pedigree CISOs moving between mega-cap digital platforms. (SecurityWeek, Jul 2026) |
| Jul 2026 | Adrian Vallino | Appointed Group CEO, WhiteHawk (effective Jul 1, 2026) | Leadership transition in an incident-response / forensics / managed detection platform — signal worth monitoring for capital/M&A activity. (LinkedIn, WhiteHawk) |
| Jul 2026 | Rupesh Chokshi (ex-Senior VP & General Manager, Application Security, Akamai Technologies; 25+ years networking/cloud/security) | Appointed Executive Vice President, Global Business Head of Network Services, and Chief Technology Officer, Tata Communications | Demand-side signal: Large telco/carrier hardening its security and network infrastructure leadership; ex-Akamai SVP signals enterprise-platform vendor deep experience moving into operator infrastructure. |
| Jul 2026 | Kevin Hanes (ex-CEO Reveal Security; ex-CEO Cybrary; ex-COO 8+ years, Secureworks) | Appointed CEO, Quorum Cyber | Operator-CEO install — deep Secureworks (MDR/services) background signals potential value-creation through M&A or service-attach at Quorum. |
| Jul 2026 | Christopher Porter (10-year CISO tenure at Fannie Mae) | Appointed Global Chief Information Security Officer, Booz Allen Hamilton | Large systems integrator / consultant deepens in-house CISO posture — signals BAH's own security maturity becoming a strategic selling point for federal/agency clients; demand-side anchor. |
| Jul 2026 | Michael Fitch (ex-Executive Director, Cybersecurity & Critical Operations, SAIC) | Appointed Chief Technology Officer for health, state and local sector | Government-adjacent sector deepening cyber leadership — demand-side signal for healthcare/SLTT cybersecurity investment. |
| Jul 2026 | Toby O'Brien (3-year tenure as CFO, Intelsat, culminating in SES sale 2025) | Joined as Chief Financial Officer at cybersecurity company (name not disclosed) | Telecom/satellite-sector CFO transitions into cyber M&A exposure — potential indicator of PE-backed or growth-stage company; value-creation signaling. |
| Jul 2026 | Michael Sikorski (ex-CTO & VP Engineering, Palo Alto Networks; VP Mandiant/FireEye) | Appointed CISO, Coinbase to oversee enterprise security, cyber risk, governance, compliance, IT strategy | Senior fintech demand-side hire: a high-pedigree CISO from the largest pure-play acquirer signals Coinbase's security posture is becoming a board/strategic asset; part of broader crypto-industry hardening against regulatory and threat scrutiny. Demand-side signal; lower M&A relevance but monitors exec flow. |
| Jul 7 2026 | Scott Rachford (GuidePoint veteran of 10+ years; most recently Regional Partner, North Central) | Appointed CEO, GuidePoint Security; founder and former CEO Michael Volk → Executive Chairman | Succession signal at one of the largest US pure-play security services firms (see 04a, 05b): a founder-to-executive-chairman transition with an insider operator promoted to CEO is a pattern worth monitoring at founder-owned services platforms — it often accompanies or precedes a capital event (recapitalization, minority raise, or sale). Objective-1 / sell-side watch. (BusinessWire, Jul 7 2026) |
| Jun 2026 | Robert M. Lee | Stays Dragos CEO; will run runZero + NetRise post-Accenture | Now leads Accenture's combined xOT platform; the integration counterparty for any OT-adjacent process |
| Jun 2026 | Jonathan Trull | Joined Oracle as Global Head of Cyber Defense | Senior demand-side mover; Oracle deepening security posture |
| Jun 2026 | Sean Cassidy | Appointed CISO, Plaid | Fintech demand-side validator |
| Jun 2026 | Ann Barron-DiCamillo | Named EVP & Global CISO, U.S. Bank | Large-enterprise demand-side anchor |
| Jun 3 2026 | Dr. Bartley Richardson (ex-NVIDIA — led engineering for agentic AI, cybersecurity AI & AI infrastructure; built NeMo Agent Toolkit / AI-Q) | Appointed Chief AI and Autonomous Systems Officer, CrowdStrike (announced alongside Q1 FY27 results) | Strategy / "build" signal at the largest pure-play: a net-new C-suite AI seat — created, not vacated — to drive Charlotte AI, the agentic SOC and AI Detection & Response (AIDR) toward "level-5 SOC autonomy." Reads as CrowdStrike doubling down on organic agentic-AI capability (build over buy) and pressing its data-flywheel advantage; the agentic-SOC arms race (cf. 04c, 20) is now a board-level talent contest. Cross-read with the Q1 FY27 print on 23 |
| Jun 1 2026 | Wael Mohamed (ex-CEO Forescout; Operating Partner, Advent International; co-founder Third Brigade → Trend Micro 2009) | Appointed CEO, Rapid7 (board member → CEO), effective immediately; Corey Thomas → Executive Chairman (retains tech/AI/policy vision) | Sell-side / take-private trigger: a PE-operating-partner-pedigree CEO installed at an activist-pressured public pure-play (exposure-mgmt/VM) is the classic prelude to a value-creation reset and/or take-private; Rapid7 is a long-rumored sponsor target. The reset arrived on Aug 7, 2026: a board-approved 2026 Restructuring Plan cutting ~12% of the workforce ($10–11M of charges) alongside a Q2 print showing ARR down 2.0% to $824.0M, with FY26 guided to a 20% non-GAAP operating margin in Q4 and ~$130M of free cash flow — growth traded for margin within ten weeks of the transition. Strong Objective-1 / sell-side watch — see 03k, 12a, 23 |
| Mar 23 2026 | Ed Jennings (ex-CEO Quickbase; ex-COO Mimecast) | Joined Darktrace as President & CEO (Thoma Bravo-owned); succeeded Jill Popelka | Buy-side trigger: seasoned operator-CEO installed at a TB take-private (~£4.3bn / ~$5B, completed Oct 2024); Darktrace's 3rd CEO in ~18 months signals a value-creation reset — bolt-on M&A and a re-platforming around "control layer for enterprise AI" are likely. Classic Objective-1 watch |
→ Signal note: A new Head of Corp Dev hire at a PE-backed platform is a top-tier buy-side trigger event — they have a mandate and a budget and no incumbent advisor. The signal feed should flag these.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.