Deal Structures

When Palo Alto Networks acquired CyberArk (announced Jul 2025, closed Feb 11 2026 — page 11), the press release led with "~$25B." The consideration was $45.00 in cash plus 2.2005 PANW shares per CyberArk share — a cash-and-stock package whose realized value floated with PANW's price for the seven months between signing and close. Read as a fixed number, "$25B" would misstate the seller's payout: the structure, not the headline, determines what lands in the account. The sections below cover how consideration is assembled, where the guaranteed price ends and the contingent price begins, how take-privates and carve-outs differ mechanically, and the gauntlet a signed deal must survive to close.

Why structure is a separate skill from valuation

Valuation answers what is the asset worth. Structure answers four different questions a multiple can't: (1) form of consideration — cash, stock, or a blend, each with different risk and tax treatment; (2) certainty — how much of the price is guaranteed at close vs. contingent on the future; (3) governance — who controls the asset and the management team after close; and (4) deliverability — whether the deal can actually clear regulators, financing and confirmatory diligence before it closes. Two offers at the same headline multiple can be worlds apart once you decompose them: an all-cash strategic bid at 10x is not the same instrument as a 10x take-private with an earnout and a founder rollover. The job of an advisor is to make those differences legible to the client before a term sheet is signed.

The consideration stack — guaranteed vs. contingent

Every purchase price is a stack of components; reading a deal starts with separating what is committed at close from what is contingent on the future:

The headline number sums all of these as if guaranteed. The guaranteed price — cash + committed stock, net of escrow and earnout — is what a seller can plan around, and it is frequently 15–30% below the headline once contingent layers are stripped out.

Take-private mechanics — the sponsor's signature structure

A take-private (PE acquires a listed company and delists it) is the dominant cyber structure for scaled, profitable-but-derated vendors, and it is mechanically distinct from a strategic acquisition:

• Pricing is a premium to a depressed tape. Sponsors strike when public multiples have reset below private/strategic levels (12); the offer is a premium to the unaffected share price (typically ~20–40%) that is still a discount to where the asset would trade in a hot market. Turn/River–SolarWinds ($4.4B) and Thoma Bravo's serial take-privates (Proofpoint $12.3B, 06f) are the template.
• The board process is governed. A special committee of independent directors, its own advisor, a fairness opinion and a "go-shop" or "no-shop" period govern the sale; the structure is built to survive shareholder litigation, which is near-automatic on any public take-private.
• Financing is conditional. Most take-privates are leveraged (Lenders); a committed debt package gates the close. In a tight credit market the financing condition is the live risk.
• Management usually rolls. Founders/executives reinvest equity into the newco — the alignment mechanism that distinguishes a sponsor's "buy to improve" from a strategic's "buy to absorb."

The whole point is the round-trip: buy at a public discount, de-risk and grow privately, exit at a strategic or re-IPO premium (SailPoint, 06g / 29b).

Carve-out mechanics

A carve-out (buying a division or product line out of a larger owner) is the hardest structure to execute and therefore often the cheapest entry multiple — the complexity is the discount:

• Stand-up cost is the hidden price. The carved unit shares the parent's billing, HR, security, data and engineering; a Transition Services Agreement (TSA) keeps the parent providing those functions for 6–24 months while the buyer builds standalone infrastructure. TSA scope, duration and cost are negotiated line items, not afterthoughts.
• Revenue is entangled. Shared customers, bundled contracts and cross-sold pipeline must be disaggregated; the carved entity's "true" standalone ARR is frequently lower than the allocated figure the seller presents — a core diligence task (34a).
• The talent question is acute. Which engineers and salespeople transfer? Retention pools and rollover offers decide whether the buyer gets a business or an empty shell. Broadcom–Symantec ($10.7B carve-out, 06f) and the historical McAfee/FireEye splits to STG (29 landing) are the cyber exemplars.
• Why sponsors favor them: complexity scares strategics away, the seller is often a motivated divestor, and the asset is improvable — exactly the inefficiency a buy-and-build platform (06e) is built to exploit.

Earnouts, escrows and reps

When buyer and seller can't agree on a number — almost always because they disagree about the future — structure bridges the gap:

• Earnouts convert a valuation argument into a wager: the seller gets the high number if the business performs (ARR, retention, product milestones). They are most common on high-growth/early targets where the bull and bear cases diverge sharply. The fights are in the definitions — what counts toward the milestone, who controls the business that must hit it, and whether the buyer's integration choices can sabotage the target.
• Escrows/holdbacks (typically 5–15% for 12–24 months) cover breaches of representations & warranties — the seller's contractual assertions about the business (ARR is real, IP is owned, no undisclosed breach, contracts are assignable). Reps & warranties insurance (RWI) increasingly replaces large escrows, shifting breach risk to an insurer and letting sellers walk with more cash at close.
• The reps that matter most in cyber are unusual: the target's own security posture (a breached security vendor is an existential rep), open-source/IP provenance, contract assignability, and the integrity of the ARR schedule. These are exactly the 34a confirmatory-diligence findings that get papered into the purchase agreement.

The completion gauntlet

Signing is not closing. Between the two sits a gauntlet, and the gap (often 3–9 months) is where value leaks or deals break:

How structure maps to situation

→ Cross-references: Deal Structures & Exits, Exits: M&A vs IPO, M&A Deals & Comps, Precedent-Transaction Methodology, Valuation, PE Operating Model, Buy-and-Build Math, Worked Cases, Lenders & Credit, Commercial Due Diligence Funnel.

Sources — PANW–CyberArk consideration ($45.00 cash + 2.2005 PANW shares/share; announced Jul 2025, closed Feb 11 2026) cross-checked against page 11 primary sources; take-private/carve-out/rollover exemplars (Proofpoint, KnowBe4, Broadcom–Symantec, SolarWinds) per 06f; regulatory/completion-risk framing per 29 landing. Illustrative consideration-mix percentages are stylized, not deal-specific.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.