What is a cybersecurity services firm worth?

Two cybersecurity firms with the same revenue can differ in value, because revenue alone does not show how much of it will keep arriving, and how safely, once the founder is no longer the person clients call. In this sector that comes down to three questions: whether the work repeats, who actually does it, and what the firm has promised clients if something goes wrong. A firm that monitors client networks under renewing agreements can be a different asset from one that sells assessments project by project, even if both billed the same amount last year. What follows covers what buyers pay for, what they discount, and how earnings are adjusted before any valuation method is applied.

Repeating work and project work

Security operations centre (SOC) monitoring, managed detection and response (MDR) and virtual chief information security officer (vCISO) engagements can be billed on a schedule under renewing agreements, so check each contract’s term and renewal rights to see how much of next year’s revenue is committed. Penetration tests, audits and readiness assessments may be bought project by project, so a buyer should ask what refills the pipeline. A buyer can look at the renewal history of each recurring revenue contract, how many are near expiry, and whether pricing has been revisited since signing. If assessment clients go on to sign a monitoring agreement, that shows a path from one kind of revenue to the other, and the records should show how often it happens. Commentary like this is general industry discussion, not an appraisal of any particular firm.

Who delivers the work

Much of what a buyer acquires may be delivery capacity, and in a security firm that sits in people: analysts, incident responders and engagement leads may know each client’s environment. If most billable work and most client relationships run through one or two senior people, that concentration is a risk a buyer may ask to have reflected in the price or the payment structure. Ask how much delivery depends on subcontracted analysts, whose commitment may last only as long as the contract engaging them. The CRA’s guidance on employment status says the facts of the working relationship, not just the parties’ intention, determine whether someone is an employee or self-employed, so it is worth asking whether each subcontractor arrangement would hold up as described.

What a buyer discounts

Several patterns raise questions about what a buyer would inherit, and each can be reflected in the price.

• Delivery that depends on the founder or a handful of senior analysts, which is a departure risk.
• Client contracts that cap the firm’s liability well below what the work could cause, or that give clients wide indemnity rights.
• Heavy reliance on subcontracted analysts instead of employed staff.
• Project-only revenue, with no monitoring base or incident-response retainer behind it.
• An incident history, at clients or at the firm itself, that has not been written up and explained.

How the earnings get recast

Before any method is applied, a buyer or valuator can recast the firm’s earnings to show how a new owner would experience them. If the owner also works as the firm’s senior consultant, the owner’s pay can be restated to a market cost for the work actually performed, because the replacement may cost more or less than the owner draws; this is the logic behind add-backs. Tool and licence costs can be separated into what the firm resells at a margin and what it needs to run its own operation. Spending on monitoring hardware and software may be depreciable property claimed as capital cost allowance rather than deducted at once. The CRA’s class list sorts general-purpose computer hardware and its systems software into classes that depend on when they were acquired, lists data network infrastructure equipment separately, and puts computer software that is not systems software in Class 12, so ask the accountant how each item was treated before comparing cash earnings. Retainers billed in advance can be checked so that cash for months not yet served is not counted as earned. Each adjustment is a judgment the seller’s accountant should document.

Liability and insurance sit inside the price

A security firm is paid to reduce a client’s risk, so when a client suffers a breach the firm may be asked what it missed. The engagement letter can set how far the firm’s exposure reaches, and its insurance whether a claim is survivable. A buyer can read the liability cap, the indemnities and the insurance schedule together and asks whether the cover matches the work being done. A gap does not have to end a deal, but a buyer may ask for a lower price, a holdback or an earn-out to cover exposure it would inherit. The firm’s own record matters too. The federal privacy statute, PIPEDA, requires an organization to keep a record of every breach of security safeguards involving personal information under its control, and Quebec’s regime requires a register of confidentiality incidents, so a buyer can fairly ask to see them.

Who is buying changes the answer

The same firm may suit one kind of buyer better than another. A seller can ask each prospective buyer what it is looking for, such as technical fit, cross-selling or a bench that stays after integration, and present the recast earnings in terms that answer it.