Factors to Evaluate When Selling Your Cybersecurity Advisory Business
Selling a company requires a combination of company performance, preparation, timing, and a little bit of luck. While not all factors can be controlled, the mysteries of the sale process can be minimized with maximum value being achieved if the proper steps are taken while working with the proper professionals.
In this article, Capstone Partners’ Managing Director and cybersecurity industry specialist Tom McConnell, together with serial entrepreneur and cybersecurity expert Ken Stasiak, share valuable perspectives on how to sell a cybersecurity professional services company for maximum value. Most of these concepts can be translated to cybersecurity software companies, value-added resellers, and other technology-enabled services businesses with many insights applicable for business owners across myriad industries.
When I sold my cybersecurity company in 2018, I learned that while the M&A landscape changes, many fundamentals remain constant.
Today’s Transaction Environment by the Numbers:
- While the industry has matured, Cybersecurity stands out as a large and rapidly growing sector with a compound annual growth rate (CAGR 2024-2028) of 10.56%.1
- Cybersecurity (merger and acquisition) M&A volume is bouncing back from cyclical lows in 2022 and 2023, with Capstone’s historical transaction database revealing year to date deal flow as 13.6% greater than YTD 2023.
- Venture capitalists are also showing renewed interest in the sector with marquee deals such as a $1 billion investment into Wiz and more than $4.5 billion total invested year to date, an increase of 55.2% over the first half of 2023.
We may never again see the nosebleed valuations of 2021, however, professional services companies with strong financial performance, a differentiated offering, reasonable scale, and a committed team are receiving highly attractive valuations from strategic buyers and private equity groups in today’s market.
Entrepreneurs often ask similar questions about the M&A process. We hope that the following factors provide helpful key insights.
1) Timing the Sale
Timing is Important but Don’t Let it Consume You
- Early Planning: While it’s important to develop goals for an exit strategy well in advance, don’t let exit planning interfere with the day-to-day operations of the business. That said, different transaction types offer significantly different outcomes, so it’s important to learn about and consider the differences between a sale to a strategic buyer vs. a private equity buyer vs. an Employee Stock Ownership Plans (ESOP), for example.
- Set Milestones: Establish specific business milestones that trigger the selling process, with particular weight given to valuation and your personal financial goals. Other important milestones which may signal a transaction and make sense to include are revenue targets, market expansion goals, and technological achievements.
In my case, we hit our predetermined revenue, earnings and valuation milestones two years before we sold, which initiated our selling preparation process.
- Market Timing: Historically, there have been definitive market cycles representing both opportune and less attractive times to execute a transaction. All things being equal, market timing does have a significant impact on valuation. That being said, all other things are rarely equal, and your company’s individual performance will be the single most important factor regardless of market conditions. As such, it’s important to primarily focus on the things you can control rather than having a myopic concern with macro conditions. Rely on investment bankers to help you determine when market conditions are ripe for an optimal transaction.
2) Process
Preparation + Process = Maximum Value
- Pre-Transaction Process
♦ Preparing Your Company for Sale: Today’s diligence processes are rigorous and designed to uncover any strategic, operational, or financial flaws in the business. Professional careers at both strategic companies and private equity groups are on the line with each deal, so no expense is spared with in-depth financial, legal, and operational due diligence. Knowing that an exit is coming, potential sellers are wise to invest the time, money, and effort in working with outside professionals including accounting, legal, and investment banking firms to prepare for what is ahead.
Lack of preparation will lead to less cash at closing, more contingent consideration, and sub-optimal valuation.
♦ Reviewed or Audited Financial Statements: Prepare for an intensive due diligence process by having reviewed or audited financial statements prepared by a reputable outside accounting firm. Reviewed (accountant does not express an opinion) financials are generally acceptable for privately held business. However, for some companies it makes sense to spend the incremental dollars for audited statements.
♦ Quality of Earnings (QoE): Quality of Earnings reports serve a different purpose than reviewed or audited financial statements. QoE’s focus on business characteristics, trends, and data which can highlight certain strengths of the business. For example, a QoE may present key metrics regarding revenue, customers, and adjusted EBITDA that would not be covered by an audit or review.
In preparing for a sale process, Quality of Earnings reports have become the norm, rather than the exception.
♦ Internal Controls and Process Documentation: Getting through a rigorous buyer diligence process requires validating internal controls, showing compliance with tax and regulatory requirements, and documenting operational processes and procedures. Further demonstrating that the business has been professionalized with clear management reporting, strong corporate governance, and alignment between strategy and key performance indicators (KPIs) used to run the business can help smooth the path to closing. You don’t want any known or unknown red flags to pop up!
I was very lucky to have a strong chief financial officer (CFO) and chief operating officer (COO), that had everything well documented. Today chief revenue officers (CRO) are more common and would be very helpful in capturing this information.
♦ Financial Performance: In the eyes of most buyers, financial performance is the objective measure which determines whether you’ve built a quality business that is worthy of being acquired. A business that is growing and profitable with an outstanding set of KPIs often represents the crux of an M&A process for a professional services business.
It’s important to understand the KPIs for your business and industry and present them properly to prospective buyers.
♦ Realistic and Supportable Projections: Strong visibility into future revenue and earnings streams is critical to supporting buyer valuations. As a seller, it’s important to provide positive and realistic financial forecasts that show potential for continued growth and stability. It won’t help your cause to provide “hockey stick” projections that are not supportable with demonstrable operating results or that can’t be extrapolated from existing performance trends.
If buyers can’t get comfortable with company outlooks, they may ask for a substantial portion of the purchase price to be paid in the form of an earnout based on post-closing results.
♦ Preparing Yourself for Sale: Selling the business which has required your blood, sweat, and tears to build can be a very emotional time. These emotions can cloud decision making and drive outcomes which may not be good business decisions. It’s important to have a clear personal vision for what you are going to be doing post-closing. Each business owner will have their own plan for what’s next and it’s important to craft yours as you prepare for a transaction. A wealth management professional can be of tremendous help in assuring alignment between your personal goals and lifestyle expectations with your post-closing financial proceeds.
♦ Time Management: The M&A process takes a lot of time, money, and effort and as the CEO/Founder you must have enough cycles to not only work on selling your company but also ensure the company is continuing to perform and reach its financial targets. If company performance diminishes while you pursue a sale (which may take 6-12 months), the valuation will decline causing a sub-optimal result. Hiring an investment banker to run the process for you will alleviate this potential pitfall by allowing you to remain focused on continuous improvement and making your company even more attractive to potential buyers as you go through the sale process.
- M&A Process and “Going to Market”
♦ Buyer Email and Calling Campaigns: All companies of any meaningful size receive a steady stream of inbound inquiries from both strategic corporate development staffers and private equity groups. These buyers strive to source “proprietary deal flow” for the simple reason that they want to avoid competitive processes created by investment bankers. Buyers know that they will have to pay a higher price with seller favorable terms when they are forced to compete against other buyers. Yes, it’s possible to get a deal done without an investment banker involved, but why leave money on the table?
I was fortunate to have eight interested parties, and after several months, we were able to narrow the list down to three buyers. One thing I did learn while going through the process is that you can outgrow your target market. It’s expensive to acquire a company and depending on the multiples there may only be so many companies willing/able to spend the money, private equity companies excluded.
♦ Know What Your Business is Realistically Worth: Before wasting your time, money, and effort having substantive discussions with potential buyers, it’s important to understand what your business is realistically worth. There is little upside to sharing proprietary information and having in-depth conversations with buyers unless there is alignment between your value expectations and what the market will bear. You will achieve a stronger ROI (return on investment) from focusing your time, money, and effort on building your business than pursuing fruitless discussions.
♦ Move Forward When Key Factors Align: When alignment has been achieved with your company’s growth and development, fair market value of the business, your personal value expectations, and market conditions, then take the time to proactively prepare materials which will address the inevitable buyer questions. You may only get one shot with the best buyers, so make the most of each conversation and information exchange.
♦ Develop a Pitch Book or Confidential Information Memorandum (CIM): Once you’ve provided the base model, be sure to keep it up to date to ensure it reflects your strengths and opportunities, unique value proposition, and potential return on investment for buyers. Be sure to have supporting materials available in a virtual data room so you can timely and accurately respond to buyer questions. Advance preparation and maintenance of these materials can be a daunting task and represents another area where investment bankers can be of exceptional value.
♦ Initial Buyer Discussions: Of paramount importance, before sharing detailed information, make sure the buyer is well qualified financially. Equally, before taking the time to meet in person and share even more in-depth information, make sure the buyer is in your valuation range. Investment bankers can screen potential buyers ahead of time and manage the process closely to avoid useless meetings and inappropriate sharing of competitive intelligence.
Don’t be shy in communicating your initial evaluations, and what you are anticipating (aka how much money do you want). In this process, you want to disqualify potential buyers quickly. In my case, there were several companies that just didn’t have the “dry powder,” and the deal was too large for them.
♦ Management Presentation: Have a polished presentation ready for meetings with prospective buyers to address common questions and concerns. Include your financials and three- to five-year projections along with other key data and slides to demonstrate your strengths and differentiation.
As I have been working with cyber companies on strategy and overall rev ops, the one thing I cannot stress more is that “everyone has that,” mentality. You need to ensure you have a competitive advantage. You will be asked, “who are your biggest competitors?”; “how do you win/lose against them?” and these questions should be addressed in your pitch book and management presentation.
♦ Demonstrating compatible cultures in the process of buyer discussions can be a very important element of creating value in a buyer’s eyes. If the people fit or organizational alignment just aren’t there, it makes it very difficult for any transaction to work well. A cultural misalignment can lead to integration challenges and potential loss of key talent. On the flip side, great execution trounces great strategy so make sure you spend time highlighting your great people.
♦ Employee Communication: Employee communication during the M&A process is a strategic decision which can vary based on your culture. If you are an organization where full transparency is the norm, then early and open communications may be appropriate. However, many business owners choose to selectively bring other members of senior management into the process while reading others in as needed just prior to or at the time of closing. Whatever you decide to do, for those brought into the know it’s important to address their concerns and highlight the benefits of the transaction for their careers and professional development.
If you worked for my company for five years, you received a Rolex. At the time of sale, we had over fourteen Rolex members; we called this the Rolex Committee. This was a diverse group of individuals representing the entire company. We used this platform to gauge the interest of the company and the challenges/opportunities. Frankly not everyone on the committee wanted to sell, so we had to put it to a vote.
3) How to Value Your Business
Valuation Depends on a Multitude of Factors
- Key Factors: The Cybersecurity industry is vast and multi-faceted and, consequently, valuation multiples vary widely based on a variety of factors. While some companies may be valued at single digit EBITDA multiples, others may command double digit revenue multiples. At a high-level, key factors which impact valuation include scale, growth rate, gross margin, EBITDA margin, recurring revenues or project-based revenue, product and service differentiation, customer base, addressable market, competitive landscape, intellectual property, management team, company culture, buyer strategic fit, and market timing. Without going into depth on each of these variables, here are few key metrics to consider:
♦ Recurring Revenue: Software as a Service (SaaS) businesses are notorious for high valuations driven by annual recurring revenue, growth rates, and exceptional gross margins. For service businesses, these high margin, contractually recurring revenue streams may be more elusive so it’s important to build strong, long term customer relationships with reoccurring revenue streams.
♦ Gross Margins: High performing SaaS business will post gross margins of more than 80%. For professional service firms, 50% is a more realistic benchmark leaving ample cash to cover operating expenses. Buyers often look at gross margins as an indicator of a service provider’s differentiation or level of commoditization.
♦EBITDA: In today’s market, buyers have a strong preference for companies that are not only growing but also generating strong EBITDA margins. This “flight to quality” was especially pronounced in 2022 and 2023 as buyers risk-averse mindsets pushed them to covet “A+” businesses. As the market has bounced backed in 2024, we are seeing renewed enthusiasm for high-growth businesses.
- Comparable Transactions: Once you have developed a strong income statement and understand your KPIs, it’s important to look at how other similarly situated companies in your sector have traded. Finding and determining the most relevant comparable transactions for sake of comparison can be tricky and made more difficult by the lack of publicly available data for transactions involving private companies.
This is another area where an investment banker can add a lot of value leveraging proprietary knowledge and insights. When you are sitting down at the proverbial negotiating table, it’s important to understand the applicable comps to support your position on valuation.
- Discounted Cash Flows (DCF): DCF models require a host of assumptions regarding financial projections, appropriate discount rates to calculate net present value, future capex requirements, working capital cycles, buyer exit values, etc. Investment banking analysts stay awake into the wee hours adjusting these assumptions to build a defensible position. For emerging businesses, in particular, this valuation method can be an important negotiating tool.
4) Negotiating the Transaction
Achieving an Optimal Outcome and a Win-Win
- In today’s world, buyers are well capitalized and have hundreds of millions in dry powder to put to work. However, they will not invest that money unless they believe they will achieve a strong return on investment. Buyers would rather avoid doing a bad deal than miss out on doing a good one.
- In setting the stage for a negotiation, it’s important to properly position your company to help the buyer achieve their objectives. Align your negotiation strategy to address these priorities. This can help you understand the true intent of the acquiring firm and help set the three-to-five-year strategy.
Know the top priorities of the acquiring firm, whether it’s customer acquisition, technology integration, or market expansion.
- Since you are sharing your confidential information, ask the buyer to share some of theirs, as well. Just the basics regarding revenues, growth rate, some KPIs, growth plans, etc. are important to understand. A buyer may not be willing to share as much as you are sharing with them, but you should be able to gain a good understanding of their business which can be very helpful in the negotiating process.
- Bring a mindset of strength but also reasonableness to the negotiating table. By running a competitive process, buyers know that they must step up with their best valuation in order to successfully consummate a transaction. However, there are very few situations where they absolutely must do the transaction so it’s important to find win-win price and terms. That said, a competitive process allows a seller to aggressively push all parties to the point of their maximum bid. The best investment bankers more than pay for their fees by creating this type of leverage and negotiating hard on your behalf.
- Earnouts are often proposed by buyers and loathed by sellers. If you do find yourself in position of negotiating an earnout make sure that the financial metrics are crystal clear. Ideally, revenue will be the primary driver rather than EBITDA, with gross margin often being a compromise. Regardless, revenue recognition and profit margins can be calculated various ways so make sure these methodologies are described in detail in the purchase agreement. Note that the same can be said of any performance metrics which may be included in your post-closing employment agreement.
Don’t assume that all financials’ metrics are similar. During the transition we were asked to hit 95% realizations on open projects, which is high. However, we later found out that the acquiring company only required 55% realization on similar projects.
- Payment Terms: As the old saying goes, “you can set the price if I can set the terms.” Low probability consideration in the form of unrealistic earnouts, illiquid stock or deeply subordinated seller carry notes may never be paid. Retained equity as part of a private equity transaction can create a “second bite of the apple” which could be very lucrative but only if things go well. In thinking through all elements of consideration, evaluate the “risk/reward” tradeoff in determining your position. Clearly, cash is king but it’s important to analyze and understand all elements of the offer. Be mindful in setting your objectives and remember there are many ways to hit a higher multiple.
When I sold my company, I owned the building. As part of the negotiations, we had the acquiring company lease the building for five years (triple net lease, NNN), which allowed us to pay off the building and sell the building shortly after the five years. While a lump sum payment is good, deferring and paying taxes with depreciating assets can offset capital gains.
Post-Closing Employment Agreements and Retention
People are the Key to Any Deal
- Employee Retention: For professional services businesses, employees are the engine for the business and the key asset which is being acquired. As such, buyers want to be sure that post-closing retention is nearly 100%. Key leadership and mid-level managers are likely to be interviewed by the buyer just prior to closing to ensure they that bring a requisite level of support for the continuing business. Given their importance, buyers often craft attractive employee retention plans for key personnel.
We had 100% of our employees sign with the acquiring company, and after six years, we retained around 60% of these professionals.
- C-Level Leadership: Depending on the situation, the exiting Owner/CEO is likely to have a minimum 12-24 month transition period with a strategic buyer. After that initial timeframe, tenure is largely dependent on the former Owner/CEO’s personal goals and objectives. With private equity platform acquisitions, selling Owners are often required to roll a meaningful amount of equity (15%-25%) to assure alignment of post-closing incentives. Whatever the case may be, gaining an understanding of the buyer’s needs and how they align with your personal plans can help facilitate a mutually agreeable solution.
Initially acquiring companies wanted to me to stay on until I was in my early 60’s, eventually I negotiated this down to a five-year contract, by demonstrating a succession plan within my leadership team.
- Employment Agreements: For the CEO/Founder, it’s important to have a well-defined employment agreement. Key elements that should be included:
♦ Salary and Bonus Structure: Moving from Owner to employee means that you’ll want to have more certainty around compensation. A well-defined salary and bonus structure will help to alleviate post-closing tension. Responsibilities in your new position should align with any post-closing financial payouts tied to your business’ performance under new ownership.
I had six leadership changes during my tenure. After the third change, none of the leaders were aware of my agreements or clauses or how my compensation was paid out.
♦ Clawback Provisions: If negotiated properly, you shouldn’t be at risk of having any type of clawback provisions which would require you to return part of the sale proceeds if certain performance hurdles aren’t met post-closing. However, if you are faced with that situation, make sure you have the ability to manage the business accordingly after closing.
Initially, my clawback was based on regional metrics (i.e., growth in the Great Lakes). Luckily, this was changed to a national growth percentage. I say luckily because initially, our business was focused on regions. Shortly after being acquired, this changed to a national practice. This shift could have caused me to miss my clawback and suffer significant financial losses.
- Prepare for Transition: Anticipate challenges in the transition period, such as employee retention and client satisfaction. Develop plans to address these issues proactively. Ensure you have a dedicated liaison from the acquiring company who understands your agreements and can be an advocate for you and your employees. Some companies view “acquiring partners/owners” differently than others, so be prepared to use this advocate to help you navigate the terrain.
5) Deal Team
Great teams get better results every time.
- Leverage Advisors: Selling a cybersecurity advisory company is a complex and multifaceted process that requires careful planning and execution. There is too much to gain and, also, too much to lose to go through it alone. Work with an experienced investment banker who specializes in the industry to achieve maximum value and minimize risk. These professionals can provide valuable insights and help navigate the complex process from preparation to buyer engagement, negotiation and closing. In addition, with so many people involved in an M&A process you, the Founder/CEO, needs an advocate for your interests. A coach to call or lean on when going through this process is invaluable.
I had an outside resource that was part of the process, and it really helped, especially when evaluating all the offers.
Conclusion
By understanding the market, preparing thoroughly, building a strong deal team, and aligning with the right acquirer, you can maximize the value of your company and ensure a smooth transition. Whether you’re aiming for a high valuation, ensuring employee retention, or maintaining cultural alignment, these considerations will help guide you through a successful sale. Please feel free to reach out to us to discuss your journey!
Selling your business may be the single largest and most important transaction of your career. Investing in the right team to run an optimal process will manage the risk while maximizing the upside and generating an exceptional ROI.
Authors
Ken Stasiak, NACD.DC
Recognized industry leader with a distinguished career as a cybersecurity and revenue operations executive, building and growing a best-in-class management consulting firm—received the Security Industry’s Global Excellence Award for Best Overall Security Company of the Year—with clients including major global enterprises and federal civil and defense agencies. Establish clear growth strategies and roadmaps, building high-performance organizations and teams with the talent, culture, and accountability to achieve market differentiation and triple-digit growth.
Completed Northwestern University EMBA, Harvard Business School’s Strategy Certificate, and extensive professional designations from NACD, ISACA, and ISC2.
Named a Top 50 Cybersecurity Consultant and Leader of 2023 by The Consulting Report “This recognition serves as a testament to their outstanding contributions in protecting sensitive information, preventing cyberattacks, and shaping industry practices.” — The Consulting Report.
Ken is currently open to consulting opportunities, offering his expertise to assist cybersecurity companies in navigating this multifaceted landscape. Contact Ken at kc@stasiak.com
Tom McConnell, Capstone Partners
Capstone Managing Director Tom McConnell brings more than 25 years of investment banking experience working with entrepreneurs, private equity groups, venture capitalists, and publicly traded companies on successful transactions both domestically and internationally. Tom’s experience with cybersecurity software, managed services and professional services companies affords unique industry insights critical for proper company positioning. By adding value at each step of the transaction process, his clients achieve higher valuations, optimal deal structures and generally better outcomes. To learn more about how proper preparation and a competitive transaction process will bring top dollar for your business, please contact him at tmcconnell@capstonepartners.com.
Endnotes
-
Exploding Topics, “Top 20 Cybersecurity Companies & Startups to Watch in 2024,” https://explodingtopics.com/blog/cybersecurity-startups, accessed July 31, 2024.
Insights for Middle Market Leaders
Receive email updates with our proprietary data, reports, and insights as they’re published for the industries that matter to you most.