The Business of Cyber Security
Key People by Role
Cyber M&A is a people business, and the roles are not interchangeable. A sell-side mandate is won from a founder-CEO; a buy-side retainer is signed by a Corp Dev leader or a PE operating partner; a deal closes only after a CFO models it and a CTO blesses the integration; demand is validated by CISOs who will never sign a transaction. Which role controls which decision — and which roles are clients, counterparties, or referral nodes — separates a warm path to a mandate from a cold pitch.
The role map
Plotted on those axes, the prospecting priorities sort themselves.
The roles, by deal relevance
The bullseye
Chief Corp Dev / Head of M&A / VP Corporate Strategy. They run the acquisition pipeline at strategic acquirers and PE platforms, own the target list, and hold the budget for outside advisory. A newly hired Head of Corp Dev at a PE-backed platform is the single cleanest buy-side trigger event in the entire graph — they arrive with a mandate, a budget, and no incumbent advisor.
PE Operating Partner / Portfolio Operations / Deal Partner. At sponsors, these are the people who drive portfolio-company M&A and decide whether a platform retains outside help. One relationship here is leverage: an operating partner sits across multiple portfolio companies, so a single mandate can become several. Public anchors include the value-creation and ops leadership at the cyber-heavy sponsors — Thoma Bravo (Orlando Bravo, Seth Boro, Chip Virnig), Vista (Robert Smith), and Crosspoint (Greg Clark, Hugh Thompson) — and the broader sponsor landscape in Private Equity. These are the gatekeepers behind Objective 1.
The principals — the people on the two sides of a deal
CEO of the acquirer. Sets the buy strategy and is the public voice of the demand narrative. The most-watched operators — Nikesh Arora (Palo Alto Networks), George Kurtz (CrowdStrike), Jay Chaudhry (Zscaler), Tomer Weingarten (SentinelOne), Todd McKinnon (Okta), Matthew Prince (Cloudflare) — publish their platform gaps on earnings calls and podcasts; each stated gap is a target thesis (see Buyer-Universe Matrix).
The enablers — reached through the principal, decisive inside a process
CFO owns valuation, financing, and the board case; on a live deal the CFO is often the most important counterparty after the CEO. CTO / CPO own product-and-tech fit and post-close integration — the diligence counterpart whose verdict can make or break a deal thesis. CRO / VP Sales own revenue quality and GTM synergy — central to the value story and to commercial due diligence (see CDD). These roles are not prospected cold; they are engaged once the principal opens the door.
The intro & validation nodes — low authority, high leverage
VC / Growth Partner. Limited authority over a transaction, but board influence over when and how a company exits, and — crucially — the best warm-intro source to the next sell-side client. Anchors: Richard Seewald (Evolution), Alberto Yépez / Don Dixon (Forgepoint), Dave DeWalt (NightDragon), Yoav Leitersdorf (YL Ventures); the full roster sits in Investors — VC. CISO (at enterprises and agencies) has effectively no authority over vendor M&A, but is the voice of demand — the person who validates whether a target's product-market fit is real, and a referral network for diligence references and for distributing The Agentic Edge and The Weakest Link.
| Role |
Authority over a deal |
conversion |
How to engage |
| PE Operating Partner |
High (portfolio) |
Multi-mandate gateway |
Relationship-led; one → many |
| Founder / CEO (target) |
High (seller) |
Sell-side client |
Warm intro + empathy |
| CEO (acquirer) |
High (strategy) |
Buyer in a sell-side process |
Via stated platform gaps |
| CFO |
High (in-process) |
Deal counterparty |
Through the principal |
| CTO / CPO |
Medium (integration) |
Diligence counterpart |
Through the principal |
| CRO / VP Sales |
Medium (value story) |
CDD counterpart |
Through the principal |
| VC / Growth Partner |
Low (board) |
Warm-intro source |
Relationship-led |
| CISO |
Low (demand) |
Validator + referral node |
Thought-leadership led |
Warm-intro economics — why the path beats the pitch
A cold outreach to a Corp Dev leader competes with every other advisor's cold outreach and converts poorly. A warm path — a mutual investor, a former colleague, a founder you advised — converts at a multiple of cold, because the introduction transfers trust. This is why the 8,234 LinkedIn contacts are a structural asset and not a vanity metric: they are the edge list of a graph whose shortest path to any target is the actual product. The discipline is to (1) identify the in-profile target (a PE-backed cyber platform, 500–1,500 employees, year 2–5 of hold, consolidating sub-segment — see Buy-Side Prospect Framework); (2) resolve the decision-maker role (almost always Corp Dev leader or operating partner); (3) compute the strongest warm-intro path from the contact graph; (4) trigger on a signal (a new Corp Dev hire, a platform announcement, a funding round). The Cyber Ecosystem Graph's warm-intro pathfinding is built for exactly this.
Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.