Why Most Acquisitions Fail

Most acquisitions do not create value; that is the base rate, not a tail risk. This page examines where and why deals fail — the mirror image of Value Creation and Post-Acquisition Operations, which covers how value is made after close.

Cisco's acquisition of Splunk is the most-cited cautionary case in cyber dealmaking. Cisco bought Splunk for $28B (announced September 2023, completed March 18, 2024) — the largest acquisition in Cisco's history and a bet that observability + SIEM would anchor a SecOps platform. Nearly two and a half years on, the strategic logic still reads well and the integration is working better than most, yet the income statement shows how hard even a sound large deal is to convert: Cisco's Security segment revenue was roughly flat year-over-year at ~$2.0B in Q3 FY26 (reported May 2026), held back by Splunk's cloud-subscription transition (a near-term revenue drag as perpetual/term licenses convert to ratable cloud) even as Splunk added ~500 new logos in H1 FY26. The drag then lapped: in Q4 FY26 (quarter ended Jul 25 2026, reported Aug 12 2026) Cisco's security revenue reached $2.2B, +14% year-over-year, with Splunk named among the growth contributors alongside network security and SASE. The deal is not a failure, but it shows that a sound thesis, a fair-to-rich price, and a competent integrator still buy roughly 28 months of margin and revenue turbulence before the synergy case begins to show in the reported line. Most acquirers have none of those three advantages. (Earnings)

The base rate: most deals destroy value

Across decades of academic study reviewed in Harvard Business Review, the M&A failure rate sits between 70% and 90% — "failure" meaning the deal did not create value for the acquirer's shareholders, whether measured by post-deal stock reaction, unrealized synergies, or divestiture within five years. Companies spend >$2T a year on acquisitions against that base rate. The implication is not that firms should not buy — consolidation is the dominant strategy in cyber for structural reasons (PE, Platform Wars) — but that the burden of proof is on the deal, and the default outcome is value-neutral-to-negative unless execution is deliberate.

Experience compounds in the acquirer's favor: studies put first-time acquirers' success rate near 23%, rising toward ~54% by roughly the tenth deal. Serial, programmatic acquirers (Palo Alto, Cisco, Thoma Bravo's platforms) are playing a different game than a first-timer doing a transformational deal — which is itself a reason the consolidation accrues to a handful of repeat buyers.

The three causes and their cyber-specific edges

Studies that decompose failed deals converge on three dominant causes: overpaying (~42% of failures), inadequate due diligence (~31%), and poor post-merger integration (~27%). Each has a cyber-specific edge that makes it more dangerous than in a generic software deal.

1 · Overpaying — the scarcity-premium trap. Cyber's best assets are scarce, strategically contested, and sold in competitive processes, so winning often means paying the top of the range (Precedent Methodology, Valuation by Sub-Segment). The winner's curse is structural: the buyer who wins is frequently the one who most overestimated synergies. A 20x-ARR price embeds a synergy and growth case that must be executed; the price is not the risk, the embedded operating assumptions are. Overpaying is not a pricing error so much as an underwriting error — paying for synergies you have no concrete plan to capture.

2 · Inadequate diligence — the revenue-quality and "own-breach" blind spots. Generic diligence checks financials and legal; cyber diligence has two existential workstreams generic diligence skips (CDD Funnel). First, revenue quality: ARR growth can be bought (CAC payback north of 2–3 years) and net retention can be sliding beneath a clean headline — a target that looks like a software comp but behaves like a services business. Second, the target's own security posture: a security vendor that is itself breached is a deal-killer, not a discount, and the reputational contagion transfers to the acquirer. Diligence that misses either pays a software multiple for a re-rate-down asset.

3 · Poor integration — where cyber deals actually die. The synergies underwritten at signing are precisely the ones integration destroys: - Product rationalization. Overlapping products that were supposed to unify instead compete for the same budget line; the roadmap stalls while the org decides which SKU lives (Platform Wars). - Channel conflict. Two partner programs that should reinforce instead collide — margin tiers, deal-registration rules, and MSP relationships clash, and the channel quietly routes around the friction (Channel, 05a). - Founder & key-person flight. The scarce talent that was the asset — the research team, the founding engineers — vests and walks 12–18 months post-close unless locked with rollover and retention pools (Talent, Deal Structures). - The cloud/billing transition tax. Folding a target into the acquirer's selling motion or ratable cloud model can depress reported revenue for several quarters before it compounds — the live Cisco–Splunk drag, and a generic risk whenever a perpetual/term book converts to subscription. - Culture and velocity mismatch. A startup's release cadence dies inside an enterprise's process; the very speed that made the target valuable is the first casualty of integration.

Acquisition type shapes the outcome

Not all deals should be judged the same way. The most useful frame (Christensen's New M&A Playbook, HBR 2011) splits acquisitions by purpose: deals meant to leverage the existing business model — buy a product/customers/capacity and push them through the engine you already run — versus deals meant to reinvent the business model — buy a fundamentally different way of operating. The two have different success criteria and different failure modes. Leverage deals reward GTM amortization ("acquire a product, push it through an existing GTM engine: a $10M customer becomes $20M next time" — 30) and are wrecked by overpaying and by integrating too aggressively. Reinvention deals reward keeping the target separate and are wrecked by forcing the new model into the old org's processes and metrics. The most common cyber-integration error is treating a reinvention deal (an AI-native disruptor, a different motion) like a leverage deal — absorbing it into the mothership and extinguishing exactly what was bought.

The exception: programmatic roll-ups that compound

A specific style of acquirer beats the base rate repeatedly, and the pattern is falsifiable. Programmatic, same-thesis buyers (sponsor-backed platforms doing serial tuck-ins below their own multiple; serial strategics with a repeatable integration playbook) post materially better outcomes because they (a) buy small relative to their base, so any single miss is survivable; (b) run the same integration motion every time, turning it into a competency rather than a project; and (c) underwrite multiple arbitrage and GTM amortization they have already proven, not synergies they hope for (Buy-and-Build Math, Worked Cases). The falsifiable test: if the platform's organic growth decays as it scales, if tuck-in multiples creep up to meet the platform's own multiple (erasing the arbitrage), or if integration costs rise per deal instead of falling, the flywheel is breaking and the roll-up is just expensive serial M&A. The signals to watch are DPI and same-store organic growth, not deal count (Fund Structures).

→ Cross-references: Value Creation & Operator Playbook, CDD Funnel, Commercial Due Diligence, Deal Structures, Buy-and-Build Math, Worked Cases, Precedent-Transaction Methodology, Ecosystems & Talent, Earnings.

Sources: Cisco–Splunk deal $28B announced Sep 2023, completed Mar 18 2024 (Cisco press release); Cisco Security revenue roughly flat YoY at ~$2.0B in Q3 FY26 with Splunk cloud-transition drag and ~500 H1 FY26 new logos (Cisco FY26 Q3 8-K; Cybersecurity Dive); Q4 FY26 security revenue $2.2B, +14% YoY (Cisco Q4 FY26 press release; Cybersecurity Dive, Aug 14 2026); failure-rate base rate 70–90% and cause decomposition (overpay 42% / diligence 31% / integration 27%), first-time-acquirer 23%→~54% by ~10th deal, from HBR M&A research, incl. Christensen et al., "The Big Idea: The New M&A Playbook," HBR 2011. Value-bridge figures are illustrative of the mechanism, not a specific transaction.

Updated 2026-08-16 18:13 UTC · © El Dorado Capital · el-doradocapital.com · Market intelligence for informational purposes only; not investment advice.