The Business of Cyber Security

Deal Structures & Exits

Deal structure covers the mechanics that bankers and sponsors negotiate beyond the multiple. Valuation (12) indicates what an asset is worth; structure determines how a transaction is assembled, how it can fail to close, and the routes by which value is realized. (Book: Part III, Ch. 14–15.)

Deal structures

Structure What it is When used in cyber
Take-private PE acquires a public company and delists Scaled vendors at a discount to private/strategic multiples (Thoma Bravo's signature)
Carve-out Buy a division/product line from a larger owner Big-Tech or distressed-vendor divestitures (e.g., McAfee/FireEye splits → STG)
Strategic acquisition A platform buys a capability Fills a suite gap; commands the strategic premium (Palo Alto–CyberArk)
Tuck-in / bolt-on Small target integrated into a platform The engine of buy-and-build roll-ups (services, GRC, identity)
Earnout Part of price contingent on post-close performance Bridges valuation gaps, esp. for high-growth/early targets
Structured / minority equity Preferred, convertible, or minority stake Growth capital or partial liquidity without full sale
Secondary buyout Sponsor-to-sponsor sale Mid-life liquidity when public/strategic exit isn't ideal
Merger of equals / roll-up combination Combine comparable assets Sub-scale players combining to reach platform scale

Deal-completion risk

Exits: M&A and public markets

Exits are not only M&A. The route chosen reflects which market prices the asset highest (see the public/private/M&A multiple stack in 12).

Route Notes
Strategic sale Most common; control + synergy premium; the platforms are the buyers (03, 08)
Secondary buyout Sponsor-to-sponsor; common when public window is shut
Continuation vehicle (CV) GP sells the asset into a new fund it also manages; LPs roll or cash out. Now a structural fourth route — ~16% of sponsor exit volume by 2025 — for trophy assets held past fund life (06h)
IPO Episodic; needs an open window; public comps anchor pricing
Re-IPO Take-private → improve → return to public markets (e.g., SailPoint)
Dual-track Run an IPO and a sale simultaneously to discover which pays more
SPAC Largely a post-mortem; the 2020–21 wave mostly closed

Window timing matters: the IPO market opens and shuts; a frozen exit market (as in parts of the 2026 reset — see Bear Case) leaves sponsors holding assets past their horizon, under pressure to return capital they can't yet realize.

How a process runs


Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.