NEURACAP
Sector ReportSep 28, 2026 · 22 pages · Free to read

Cybersecurity Software Sector Outlook — September 2026

NeuraCap's Cybersecurity Software sector outlook: who plays, how the market prices them, what has transacted, and what it means for owners, operators and acquirers.

Download PDFDownload PowerPoint

Key figures

15.9x
Sector median EV/EBITDA
41.3x
Premium end EV/EBITDA vs 7.0x at the discount end
40
Transactions with disclosed terms

Read the report

C:\Users\dawoo\OneDrive\Desktop\Deployments\neuracap_sector_reports_fable\Code\NeuraCap_Sector_Report_Pipeline_v2.1.0\ncsr\deck_kit\assets\logo_light_full.png

INFORMATION TECHNOLOGY › SOFTWARE AND SERVICES › CYBERSECURITY SOFTWARE

Cybersecurity Software: Growth Travels with Premiums

This report shows where public valuations sit, which operating profiles stand apart and how precedent transactions frame strategic value.

September 2026 · Prepared by NeuraCap AI · Confidential

Market data as of 2026-09-28 · primary valuation basis EV / EBITDA (CY2027E)

Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice

1

1 / 22

Executive summary

Cybersecurity Software public pricing separates sharply across growth profiles and business models. Faster-growing names and security infrastructure platforms occupy the higher end of forward EV / EBITDA, while services-adjacent models sit lower.

Key findings

  • Faster Growth Sits Alongside Higher Forward Pricing
  • Security Infrastructure Platforms Hold the Valuation Center
  • Growth Without the Higher Margin Still Commands Attention
  • Transaction Benchmarks Reflect Strategic Fit

What each page shows

The analyst’s walkthrough of the deck, page by page.

  1. 01

    INFORMATION TECHNOLOGY › SOFTWARE AND SERVICES › CYBERSECURITY SOFTWARE

    INFORMATION TECHNOLOGY › SOFTWARE AND SERVICES › CYBERSECURITY SOFTWARE.

    Cover — Cybersecurity Software sector insights, September 2026. Prepared by NeuraCap AI; market data as of 2026-09-28; primary valuation basis EV / EBITDA (CY2027E). The framing line carries the deck's finding with the figures stripped. 1

    Everything on this page

    INFORMATION TECHNOLOGY › SOFTWARE AND SERVICES › CYBERSECURITY SOFTWARE Cybersecurity Software: Growth Travels with Premiums This report shows where public valuations sit, which operating profiles stand apart and how precedent transactions frame strategic value. September 2026 · Prepared by NeuraCap AI · Confidential Market data as of 2026-09-28 · primary valuation basis EV / EBITDA (CY2027E) Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 1

  2. 02
    CONTENTS

    What This Report Covers

    What This Report Covers.

    Contents — the report runs 5 numbered sections plus the appendix: the bottom line, the landscape, valuation & situations, precedent transactions, strategic implications. The Bottom Line comes first by design: a reader who stops after section 01 still leaves with the whole story. 2

    Everything on this page

    CONTENTS What This Report Covers 01 The Bottom Line Growth and Platform Breadth Stand Alongside Higher Valuations 02 The Landscape Security Infrastructure Platforms Hold the Sector’s Valuation Center 03 Valuation & Situations Faster Growth Sits Alongside a Wide Public Valuation Divide 04 Precedent Transactions Buyers Have Paid Across a Wide Range for Strategic Security Assets 05 Strategic Implications Stronger Positioning Starts with Durable Growth and Platform Relevance 06 Appendix Comparables Detail, Methodology, Sources and Assumptions Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 2

  3. 03
    01 · THE BOTTOM LINE

    Cybersecurity Software Pricing Favors Growing Security Infrastructure Platforms over Services-Adjacent Models

    Cybersecurity Software Pricing Favors Growing Security Infrastructure Platforms over Services-Adjacent Models.

    Cybersecurity Software Pricing Favors Growing Security Infrastructure Platforms over Services-Adjacent Models The full story on one page · figures on EV / EBITDA (CY2027E), market data as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Primary valuation basis: EV / EBITDA on CY2027E consensus (13 of 18 companies eligible; multiples failing the platform's plausibility gates are excluded, never plotted). Practitioners also quote EV / Revenue in this industry; this set is profitable (median forward EBITDA margin 26%, 13 of 18 names with a meaningful EBITDA), so EV / EBITDA leads and EV / Revenue is the cross-check. Qualitative characterisations are NeuraCap views. 3

    Everything on this page

    01 · THE BOTTOM LINE Cybersecurity Software Pricing Favors Growing Security Infrastructure Platforms over Services-Adjacent Models The full story on one page · figures on EV / EBITDA (CY2027E), market data as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Primary valuation basis: EV / EBITDA on CY2027E consensus (13 of 18 companies eligible; multiples failing the platform's plausibility gates are excluded, never plotted). Practitioners also quote EV / Revenue in this industry; this set is profitable (median forward EBITDA margin 26%, 13 of 18 names with a meaningful EBITDA), so EV / EBITDA leads and EV / Revenue is the cross-check. Qualitative characterisations are NeuraCap views. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 3 1 Faster Growth Sits Alongside Higher Forward Pricing On the 13 names with a forward valuation and growth estimate, the seven above the 8% growth split carry 25.3x versus 9.0x for the six below it. EV / EBITDA leads here, with meaningful forward EBITDA across 16 of 18 companies, and the premium remains after forecast growth is already reflected. 2 Security Infrastructure Platforms Hold the Valuation Center Security infrastructure platforms sit at 19.1x, while security-focused technology services sit at 6.8x. Mission-critical recurring revenue, threat telemetry and ownership of security operations workflows are associated with the higher position. 3 Growth Without the Higher Margin Still Commands Attention Among the 13 names in the operating quadrant, the three above the growth bar alone sit at 29.8x, while the three above the margin bar alone sit at 10.6x. The result shows a stronger valuation association with growth in this sample, while profitability remains part of the quality test. 4 Transaction Benchmarks Reflect Strategic Fit Disclosed EV / Revenue references range from 0.9x to 20.0x across the transaction record. Platform fit, recurring revenue quality, product overlap and cross-sell potential shape how owners can interpret that range. 15.9x Sector median EV/EBITDA CY2027E consensus · 13 rated of 18 companies 41.3x Premium end EV/EBITDA vs 7.0x at the discount end top quartile (n=4) against bottom quartile (n=4) on EV/EBITDA — the spread the report explains 40 Transactions with disclosed terms 123 recorded in this tier · 3 told as case studies, the full list in the appendix

  4. 04
    SECTION 02

    02

    02.

    Section 02 of 06 — Security Infrastructure Platforms Hold the Sector’s Valuation Center. The market separates scaled platforms from services-adjacent and application-focused models. Use this divider to reset the room before the section's pages; the progress dots show where the argument stands. 4

    Everything on this page

    SECTION 02 02 THE LANDSCAPE Security Infrastructure Platforms Hold the Sector’s Valuation Center The market separates scaled platforms from services-adjacent and application-focused models. 02 of 06 Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 4

  5. 05
    02 · MARKET MAP

    Security Infrastructure Platforms Concentrate Scale and Public Valuation

    Security Infrastructure Platforms Concentrate Scale and Public Valuation.

    Security Infrastructure Platforms Concentrate Scale and Public Valuation 18 approved companies grouped by business segment · median EV / EBITDA (CY2027E) per group · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Segment grouping follows the platform's classification; group medians on rated names only. "Why it matters" lines are NeuraCap views. 5

    Everything on this page

    02 · MARKET MAP Security Infrastructure Platforms Concentrate Scale and Public Valuation 18 approved companies grouped by business segment · median EV / EBITDA (CY2027E) per group · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Segment grouping follows the platform's classification; group medians on rated names only. "Why it matters" lines are NeuraCap views. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 5 SECURITY INFRASTRUCTURE PLATFORMS 15 cos median 19.1x Palo Alto Networks (PANW) CrowdStrike (CRWD) Zscaler (ZS) Rubrik (RBRK) Gen Digital (GEN) Check Point (CHKP) SentinelOne (S) Netskope, Inc. (NTSK) Qualys (QLYS) Varonis Systems (VRNS) BlackBerry Limited (BB) Tenable Holdings (TENB) Rapid7 (RPD) Allot (ALLT) VirnetX Holding (VHC) Scaled platforms matter where threat telemetry, detection efficacy and workflow ownership support durable enterprise relevance. ADJACENT: SECURITY-FOCUSED TECHNOLOGY SERVICES 2 cos median 6.8x N-able (NABL) Telos (TLS) Services-adjacent models matter where customer access and implementation capability support recurring security relationships. SECURITY APPLICATION PLATFORMS 1 cos no rated names Arqit Quantum (ARQQ) Application platforms offer focused product exposure, with value tied to differentiation and fit within broader security workflows.

  6. 06
    02 · LANDSCAPE

    Platform Breadth Separates the Sector’s Main Business Models

    Platform Breadth Separates the Sector’s Main Business Models.

    Platform Breadth Separates the Sector’s Main Business Models Segment view of the approved universe · EV / EBITDA (CY2027E) medians on rated names · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. "What they do / why it matters" is a NeuraCap view. Full company-level detail in the appendix and companion tables. 6

    Everything on this page

    02 · LANDSCAPE Platform Breadth Separates the Sector’s Main Business Models Segment view of the approved universe · EV / EBITDA (CY2027E) medians on rated names · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. "What they do / why it matters" is a NeuraCap view. Full company-level detail in the appendix and companion tables. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 6 Segment n Share of universe Median EV/EBITDA Names to know What they do — and why it matters Security infrastructure platforms 15 83% 19.1x Palo Alto Networks, Inc. (PANW) · CrowdStrike Holdings, Inc. (CRWD) · +13 more Platforms anchor sector value. This group spans core security infrastructure and carries 19.1x across the names with forward valuations. Breadth across security operations, telemetry and enterprise workflows can support retention and expansion. Adjacent: security-focused technology services 2 11% 6.8x N-able, Inc. (NABL) · Telos Corporation (TLS) Services trade on execution. This group sits at 6.8x across its two names. Customer access can be valuable, while services mix, sales-cycle length and the durability of recurring revenue remain central to positioning. Security application platforms 1 6% — Arqit Quantum Inc. (ARQQ) Focused products need distinction. The single name in this group offers application-level security exposure. Its standing rests on product relevance, low-friction integration and a clear role within broader platform buying decisions.

  7. 07
    SECTION 03

    03

    03.

    Section 03 of 06 — Faster Growth Sits Alongside a Wide Public Valuation Divide. Forward EV / EBITDA rewards durable earnings alongside credible recurring growth. Use this divider to reset the room before the section's pages; the progress dots show where the argument stands. 7

    Everything on this page

    SECTION 03 03 VALUATION & SITUATIONS Faster Growth Sits Alongside a Wide Public Valuation Divide Forward EV / EBITDA rewards durable earnings alongside credible recurring growth. 03 of 06 Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 7

  8. 08
    03 · PUBLIC MARKET VALUATION

    The Premium End Prices in More Durable Forward Earnings

    The Premium End Prices in More Durable Forward Earnings.

    The Premium End Prices in More Durable Forward Earnings EV / EBITDA (CY2027E) · all 13 rated companies, sorted descending · sector median 15.9x · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Primary valuation basis: EV / EBITDA on CY2027E consensus (13 of 18 companies eligible; multiples failing the platform's plausibility gates are excluded, never plotted). Practitioners also quote EV / Revenue in this industry; this set is profitable (median forward EBITDA margin 26%, 13 of 18 names with a meaningful EBITDA), so EV / EBITDA leads and EV / Revenue is the cross-check. Tier zones are NeuraCap groupings cut at the rated set's quartiles; every multiple quoted on this page is a median on the same EV / EBITDA (CY2027E) basis. Panel commentary is a NeuraCap view. 8

    Everything on this page

    03 · PUBLIC MARKET VALUATION The Premium End Prices in More Durable Forward Earnings EV / EBITDA (CY2027E) · all 13 rated companies, sorted descending · sector median 15.9x · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Primary valuation basis: EV / EBITDA on CY2027E consensus (13 of 18 companies eligible; multiples failing the platform's plausibility gates are excluded, never plotted). Practitioners also quote EV / Revenue in this industry; this set is profitable (median forward EBITDA margin 26%, 13 of 18 names with a meaningful EBITDA), so EV / EBITDA leads and EV / Revenue is the cross-check. Tier zones are NeuraCap groupings cut at the rated set's quartiles; every multiple quoted on this page is a median on the same EV / EBITDA (CY2027E) basis. Panel commentary is a NeuraCap view. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 8 PREMIUM · median 41.3x CORE · median 15.9x DISCOUNT · median 7.0x Sector median 15.9x WHAT SEPARATES THE TWO ENDS The top sells durability. The premium tier sits at 41.3x. As the lens already reflects forward earnings, the remaining premium is consistent with confidence in recurring growth, retention and earnings durability. The bottom needs proof. The discount tier sits at 7.0x. Lower growth, narrower product positions or a services-heavy mix can leave the market asking for clearer evidence of durable expansion. Platform relevance matters. Threat telemetry, detection efficacy and ownership of security operations workflows strengthen the case for lasting customer value. Point-product concentration and weak expansion trends can limit that case.

  9. 09
    03 · VALUATION DRIVERS

    Forward Growth Shows the Clearest Valuation Association

    Forward Growth Shows the Clearest Valuation Association.

    Forward Growth Shows the Clearest Valuation Association Median EV / EBITDA (CY2027E) by revenue-growth cohort and by EBITDA-margin cohort (each split at its covered median) · rated names with estimates · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Cohort medians on rated names with the required estimates (faster n=7; slower n=6; higher-margin n=7; lower-margin n=6). Driver readings are NeuraCap views on the supplied data — association, not causation. 9

    Everything on this page

    03 · VALUATION DRIVERS Forward Growth Shows the Clearest Valuation Association Median EV / EBITDA (CY2027E) by revenue-growth cohort and by EBITDA-margin cohort (each split at its covered median) · rated names with estimates · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Cohort medians on rated names with the required estimates (faster n=7; slower n=6; higher-margin n=7; lower-margin n=6). Driver readings are NeuraCap views on the supplied data — association, not causation. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 9 EV/EBITDA, median per cohort · growth split at 8% · EBITDA-margin split at 26% Faster Growth Sits Alongside Higher Forward EV / EBITDA On the 13 names with both measures, the seven above the 8% growth split sit at 25.3x versus 9.0x for the six below it. The observation supports a focus on durable recurring growth rather than a single-period uplift. Revenue Quality Strengthens the Growth Case Enterprise retention, expansion and recurring revenue quality help distinguish durable growth from growth supported by discounting or longer contracts. Security operations relevance and platform adoption provide the commercial context. Margins Remain a Quality Check Profitability still matters where sales efficiency, subscription gross margin and cash conversion show that growth can scale. The public evidence does not support treating margin alone as a complete valuation explanation.

  10. 10
    03 · SITUATION MAP

    Higher Peer Valuations Sit with Growth, While Operating Proof Varies by Strategic Path

    Higher Peer Valuations Sit with Growth, While Operating Proof Varies by Strategic Path.

    Higher Peer Valuations Sit with Growth, While Operating Proof Varies by Strategic Path Cut on EV / EBITDA vs the sector median (15.9x) (rows) and revenue growth vs the covered median (8%) (columns) · observations, not recommendations Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Situation boundaries are the cohort's own medians (Directional, NeuraCap view). This page characterises situations; it does not recommend buying or selling any security. 10

    Everything on this page

    03 · SITUATION MAP Higher Peer Valuations Sit with Growth, While Operating Proof Varies by Strategic Path Cut on EV / EBITDA vs the sector median (15.9x) (rows) and revenue growth vs the covered median (8%) (columns) · observations, not recommendations Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Situation boundaries are the cohort's own medians (Directional, NeuraCap view). This page characterises situations; it does not recommend buying or selling any security. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 10 Premium Growth Leaders Above-median multiple · above-median revenue growth 6 names Palo Alto Networks, Inc. (PANW) · Zscaler, Inc. (ZS) · SentinelOne, Inc. (S) · +3 more Six names sit above both the forward valuation and growth markers. Their priority is sustaining retention, expansion and platform adoption as forecast growth becomes harder to exceed. Premium with Slower Growth Above-median multiple · below-median revenue growth 1 names BlackBerry Limited (BB) BlackBerry Limited (BB) sits above the valuation marker and below the growth marker. The value case rests on earnings durability, revenue quality and a credible route back to stronger expansion. Growth Ahead of Valuation Below-median multiple · above-median revenue growth 1 names Gen Digital Inc. (GEN) Gen Digital Inc. (GEN) sits below the valuation marker and above the growth marker. The opportunity is to show that growth can persist alongside retention, product relevance and efficient cash generation. Valuation and Growth Reset Below-median multiple · below-median revenue growth 5 names Check Point Software Technologies Ltd. (CHKP) · Tenable Holdings, Inc. (TENB) · Rapid7, Inc. (RPD) · +2 more Five names sit below both markers. Their operating agenda centers on revenue mix, customer expansion, pricing discipline and cost structure rather than relying on market rerating alone.

  11. 11
    03 · GROWTH VS PROFITABILITY

    Growth Travels with More Valuation than Margin Alone

    Growth Travels with More Valuation than Margin Alone.

    Growth Travels with More Valuation than Margin Alone Revenue growth (CY2027E, x-axis) vs EBITDA margin (CY2027E, y-axis) · 13 companies with both estimates · cuts at the covered medians (8% growth, 26% margin) · median EV/EBITDA per quadrant · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Quadrant cuts are the covered set's medians. Quadrant medians on names with a meaningful EV/EBITDA (balanced n=4; margin-only n=3; growth-only n=3; neither n=3). 11

    Everything on this page

    03 · GROWTH VS PROFITABILITY Growth Travels with More Valuation than Margin Alone Revenue growth (CY2027E, x-axis) vs EBITDA margin (CY2027E, y-axis) · 13 companies with both estimates · cuts at the covered medians (8% growth, 26% margin) · median EV/EBITDA per quadrant · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. Quadrant cuts are the covered set's medians. Quadrant medians on names with a meaningful EV/EBITDA (balanced n=4; margin-only n=3; growth-only n=3; neither n=3). Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 11 0% 5% 10% 15% 20% 10% 20% 30% 40% 50% MARGIN ONLY median 10.6x BALANCED median 20.6x NEITHER median 7.4x GROWTH ONLY median 29.8x RPD TLS CHKP NABL TENB BB GEN QLYS ALLT ZS PANW S VRNS x: revenue growth (CY2027E) · y: EBITDA margin (CY2027E) HOW TO READ THIS The quadrant covers 13 names with both operating measures. The three names above the growth bar alone sit at 29.8x, while the three above the margin bar alone sit at 10.6x. Four names clear both bars, combining growth with profitability. The remaining three clear neither bar and face a more demanding positioning case. The balanced median rests on 4 names and is lifted by PANW at 57.8x. The neither median rests on 3 names and is lifted by BB at 33.3x. Rule of 40 (revenue growth + EBITDA margin ≥ 40%): 5 of 13 names clear it (PANW, ZS, QLYS, CHKP, GEN).

  12. 12
    03 · THE AGENDA

    Operating Evidence Differs Across Build, Partner and Buy Paths in the Peer Set

    Operating Evidence Differs Across Build, Partner and Buy Paths in the Peer Set.

    Operating Evidence Differs Across Build, Partner and Buy Paths in the Peer Set NeuraCap view · framed as the questions an owner or acquirer should resolve · observations, not recommendations Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. All content on this page is Directional — NeuraCap advisory judgment grounded in the cohort data shown earlier. It does not constitute investment advice. 12

    Everything on this page

    03 · THE AGENDA Operating Evidence Differs Across Build, Partner and Buy Paths in the Peer Set NeuraCap view · framed as the questions an owner or acquirer should resolve · observations, not recommendations Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. All content on this page is Directional — NeuraCap advisory judgment grounded in the cohort data shown earlier. It does not constitute investment advice. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 12 Strengthen the Premium Case Prioritize durable recurring growth, enterprise retention and expansion across products. Build platform relevance where threat telemetry and security operations workflows reinforce customer value. What changes the answer: Growth remains above the peer marker while retention and operating efficiency hold. Broaden the Platform Selectively Assess build-versus-buy choices in cloud, data, identity and security operations. Favor adjacencies that improve cross-sell potential without adding avoidable product overlap or integration complexity. What changes the answer: Customer demand supports broader adoption and the product adjacency fits existing workflows. Reset the Operating Model Refine pricing, services mix, sales capacity and cost structure where growth and valuation both lag. Protect mission-critical recurring revenue while removing activity that does not improve retention or expansion. What changes the answer: Renewal, expansion or sales productivity remains below the level needed for efficient growth.

  13. 13
    SECTION 04

    04

    04.

    Section 04 of 06 — Buyers Have Paid Across a Wide Range for Strategic Security Assets. Product fit, recurring revenue quality and platform relevance shape the usefulness of each precedent. Use this divider to reset the room before the section's pages; the progress dots show where the argument stands. 13

    Everything on this page

    SECTION 04 04 PRECEDENT TRANSACTIONS Buyers Have Paid Across a Wide Range for Strategic Security Assets Product fit, recurring revenue quality and platform relevance shape the usefulness of each precedent. 04 of 06 Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 13

  14. 14
    04 · DEAL CASE STUDIES

    Precedent Transaction Pricing Varies Across Forms of Strategic Relevance

    Precedent Transaction Pricing Varies Across Forms of Strategic Relevance.

    Precedent Transaction Pricing Varies Across Forms of Strategic Relevance 3 of 40 transactions with disclosed terms, told as case studies · multiples on LTM financials at announcement where disclosed · the complete list is in the appendix · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. 161 precedent record(s) carry data-quality flags (deal value unit unresolved; divestiture roles reassigned; duplicate filings collapsed); figures are shown as recorded in the filing. 83 recorded transactions with neither a disclosed value nor a multiple are omitted from the precedent list and the case studies (kept in the companion workbook). Deal multiples are LTM at announcement (Definitive, from filings); they are not directly comparable to the CY2027E public basis and no spread is claimed.

    Everything on this page

    04 · DEAL CASE STUDIES Precedent Transaction Pricing Varies Across Forms of Strategic Relevance 3 of 40 transactions with disclosed terms, told as case studies · multiples on LTM financials at announcement where disclosed · the complete list is in the appendix · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. 161 precedent record(s) carry data-quality flags (deal value unit unresolved; divestiture roles reassigned; duplicate filings collapsed); figures are shown as recorded in the filing. 83 recorded transactions with neither a disclosed value nor a multiple are omitted from the precedent list and the case studies (kept in the companion workbook). Deal multiples are LTM at announcement (Definitive, from filings); they are not directly comparable to the CY2027E public basis and no spread is claimed. "Why the deal happened" is a NeuraCap read of the recorded evidence. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 14 Jul-2025 $24.0B Palo Alto Networks, Inc. Palo Alto Networks, Inc. (PANW) Extends Its Platform Through CyberArk Software Ltd. EV / LTM revenue 20.0x EV / LTM EBITDA 124.2x WHY THE DEAL HAPPENED The transaction suggests a platform-expansion logic built around adjacent security capabilities and enterprise customer reach. At $24.0B, it also signals conviction in the strategic relevance of scaled cybersecurity platforms. HOW THE TARGET WAS VALUED CyberArk Software Ltd. was valued at 20.0x EV / Revenue and 124.2x EV / EBITDA. The gap between those measures highlights the need to weigh growth, earnings maturity and strategic platform fit together. Apr-2021 $10.3B Thoma Bravo acquires Proofpoint, Inc. EV / LTM revenue 9.4x EV / LTM EBITDA 55.6x WHY THE DEAL HAPPENED The transaction is best read through product fit, recurring revenue quality and integration potential. Those factors frame whether the asset strengthens platform breadth, telemetry or customer access. HOW THE TARGET WAS VALUED Its benchmark value rests on comparison with disclosed precedent transactions that share similar revenue quality, earnings maturity and strategic fit. Dec-2021 $5.2B Permira acquires Mimecast Limited EV / LTM revenue 8.8x EV / LTM EBITDA 32.1x WHY THE DEAL HAPPENED The transaction suggests that strategic relevance extends beyond headline scale. Product adjacency, workflow ownership and cross-sell potential provide the clearest framework for assessing the fit. HOW THE TARGET WAS VALUED Its valuation relevance depends on matching the asset with precedent transactions that share comparable growth, profitability and recurring revenue characteristics.

  15. 15
    SECTION 05

    05

    05.

    Section 05 of 06 — Stronger Positioning Starts with Durable Growth and Platform Relevance. Owners can strengthen revenue quality, operating efficiency and strategic fit without presuming a transaction. Use this divider to reset the room before the section's pages; the progress dots show where the argument stands. 15

    Everything on this page

    SECTION 05 05 STRATEGIC IMPLICATIONS Stronger Positioning Starts with Durable Growth and Platform Relevance Owners can strengthen revenue quality, operating efficiency and strategic fit without presuming a transaction. 05 of 06 Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 15

  16. 16
    05 · STRATEGIC IMPLICATIONS

    Durable Growth and Platform Relevance Are Associated with Stronger Strategic Standing

    Durable Growth and Platform Relevance Are Associated with Stronger Strategic Standing.

    Durable Growth and Platform Relevance Are Associated with Stronger Strategic Standing NeuraCap view · the questions this data puts on the table for the next twelve months Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. This page is Directional — NeuraCap views drawn from the analysis in this report. Observations, not recommendations. 16

    Everything on this page

    05 · STRATEGIC IMPLICATIONS Durable Growth and Platform Relevance Are Associated with Stronger Strategic Standing NeuraCap view · the questions this data puts on the table for the next twelve months Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. This page is Directional — NeuraCap views drawn from the analysis in this report. Observations, not recommendations. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 16 FOR OWNERS Build Value Through Revenue Quality Focus the operating plan on retention, expansion, pricing discipline and the product areas where customers deepen adoption. Durable growth carries more weight when it is supported by efficient delivery and mission-critical use. FOR MANAGEMENT TEAMS Connect Growth with Efficiency Align sales capacity, product investment and cost structure with the segments that support recurring expansion. Margin improvement is more persuasive when it preserves product momentum and customer outcomes. FOR BOARDS Test Platform Choices Rigorously Frame capital allocation around build-versus-buy, product adjacency and integration fit. Cloud, data and identity convergence can expand relevance, but overlap and implementation complexity can dilute the benefit.

  17. 17
    SECTION 06

    06

    06.

    Section 06 of 06 — The Full Universe, Methodology and Sources. Comparables detail behind every figure in the body, the valuation basis, and where each underlying disclosure lives. Use this divider to reset the room before the section's pages; the progress dots show where the argument stands. 17

    Everything on this page

    SECTION 06 06 APPENDIX The Full Universe, Methodology and Sources Comparables detail behind every figure in the body, the valuation basis, and where each underlying disclosure lives. 06 of 06 Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 17

  18. 18
    06 · PUBLIC COMPARABLES (1 OF 1)

    Public Comparables on EV / EBITDA (CY2027E), Grouped by Valuation Tier

    Public Comparables on EV / EBITDA (CY2027E), Grouped by Valuation Tier.

    Public Comparables on EV / EBITDA (CY2027E), Grouped by Valuation Tier Teal shading marks a EV/EBITDA above the sector median (15.9x); amber marks below · 13 rated companies; 5 not rated (no eligible EV/EBITDA) · tickers link to the underlying source · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. All 13 rated rows are in this appendix and in the companion workbook, which carries the complete field set. Names without an eligible multiple are listed in the companion workbook. 18

    Everything on this page

    06 · PUBLIC COMPARABLES (1 OF 1) Public Comparables on EV / EBITDA (CY2027E), Grouped by Valuation Tier Teal shading marks a EV/EBITDA above the sector median (15.9x); amber marks below · 13 rated companies; 5 not rated (no eligible EV/EBITDA) · tickers link to the underlying source · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. All 13 rated rows are in this appendix and in the companion workbook, which carries the complete field set. Names without an eligible multiple are listed in the companion workbook. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 18 Company Ticker Segment EV EV/EBITDA (CY2027E) Rev growth EBITDA margin Rule of 40 PREMIUM — ≥29.8x · median 41.3x · 4 companies Palo Alto Networks, Inc. PANW Security infrastructure platforms $318B 57.8x 16% 37% 53 Varonis Systems, Inc. VRNS Security infrastructure platforms $5.2B 49.3x 19% 12% 31 BlackBerry Limited BB Security infrastructure platforms $5.0B 33.3x 8% 23% 31 SentinelOne, Inc. S Security infrastructure platforms $7.1B 29.8x 18% 17% 35 CORE — 7.5x–29.8x · median 15.9x · 5 companies Zscaler, Inc. ZS Security infrastructure platforms $30.6B 25.3x 16% 29% 45 Allot Ltd. ALLT Security infrastructure platforms $323M 19.1x 13% 13% 25 Qualys, Inc. QLYS Security infrastructure platforms $5.7B 15.9x 8% 45% 54 Tenable Holdings, Inc. TENB Security infrastructure platforms $3.9B 12.9x 7% 26% 33 Check Point Software Technologies Ltd. CHKP Security infrastructure platforms $12.9B 10.6x 6% 41% 47 DISCOUNT — <7.5x · median 7.0x · 4 companies Gen Digital Inc. GEN Security infrastructure platforms $20.3B 7.5x 8% 48% 56 Telos Corporation TLS Adjacent: security-focused technology services $261M 7.4x 0% 18% 19 Rapid7, Inc. RPD Security infrastructure platforms $1.1B 6.7x -1% 20% 19 N-able, Inc. NABL Adjacent: security-focused technology services $1.1B 6.2x 6% 30% 36

  19. 19
    06 · PRECEDENT TRANSACTIONS (1 OF 2)

    All Precedent Transactions with Disclosed Terms, Newest First

    All Precedent Transactions with Disclosed Terms, Newest First.

    All Precedent Transactions with Disclosed Terms, Newest First 40 transactions with disclosed terms in this tier (123 recorded) · multiples on LTM financials at announcement where disclosed · deal values link to the underlying filing · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. 161 precedent record(s) carry data-quality flags (deal value unit unresolved; divestiture roles reassigned; duplicate filings collapsed); figures are shown as recorded in the filing. 83 recorded transactions with neither a disclosed value nor a multiple are omitted from the precedent list and the case studies (kept in the companion workbook). Deal multiples are LTM at announcement (Definitive, from filings); they are not directly comparable to the CY2027E public basis and no spread is claimed.

    Everything on this page

    06 · PRECEDENT TRANSACTIONS (1 OF 2) All Precedent Transactions with Disclosed Terms, Newest First 40 transactions with disclosed terms in this tier (123 recorded) · multiples on LTM financials at announcement where disclosed · deal values link to the underlying filing · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. 161 precedent record(s) carry data-quality flags (deal value unit unresolved; divestiture roles reassigned; duplicate filings collapsed); figures are shown as recorded in the filing. 83 recorded transactions with neither a disclosed value nor a multiple are omitted from the precedent list and the case studies (kept in the companion workbook). Deal multiples are LTM at announcement (Definitive, from filings); they are not directly comparable to the CY2027E public basis and no spread is claimed. 18 of 40 transactions shown; the rest are in the companion workbook. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 19 Date Transaction EV EV/LTM Rev EV/LTM EBITDA Why it matters May-2026 n/a → Cycurion, Inc. $14M 0.9x n/a The Cycurion, Inc. transaction was recorded at $14M and 0.9x EV / Revenue. It provides a lower-end reference, subject to the filing’s stated value-unit qualification. Sep-2025 Mitsubishi Electric Corporation → Nozomi Networks n/a 12.7x n/a Mitsubishi Electric Corporation’s announced transaction for Nozomi Networks carries 12.7x EV / Revenue. The pairing suggests value in security capabilities that can sit alongside a broader technology platform. Jul-2025 Mobileye Global Inc. → Zscaler, Inc. n/a 0.7x 8.8x Mobileye Global Inc.’s announced transaction for Zscaler, Inc. (ZS) carries 0.7x EV / Revenue and 8.8x EV / EBITDA. Its usefulness depends on assessing the strategic and financial context together. Jul-2025 Palo Alto Networks, Inc. → CyberArk Software Ltd. $24.0B 20.0x 124.2x Palo Alto Networks, Inc. (PANW) and CyberArk Software Ltd. combine scaled security platforms with adjacent capabilities. The transaction highlights the strategic relevance of platform breadth and enterprise cross-sell potential. Nov-2024 AeroVironment, Inc. → BlueHalo Financing Topco, LLC $4.1B n/a n/a AeroVironment, Inc.’s completed transaction for BlueHalo Financing Topco, LLC was valued at $4.1B. The pairing suggests strategic interest in capabilities aligned with resilient, mission-focused technology demand. Aug-2024 Refresco Group N.V. → Cyberint Technologies Ltd. n/a n/a 9.2x Refresco Group N.V.’s announced transaction for Cyberint Technologies Ltd. carries 9.2x EV / EBITDA. The reference is most useful when recurring revenue quality and earnings durability are comparable. Aug-2024 AlphaVest Acquisition Corp → AMC Corporation $175M n/a n/a AlphaVest Acquisition Corp’s announced transaction for AMC Corporation was valued at $175M. It adds a smaller disclosed-value reference to a transaction record spanning varied strategic contexts. May-2024 CyberArk Software Ltd. → Venafi Holdings, Inc. $1.5B n/a n/a CyberArk Software Ltd.’s announced transaction for Venafi Holdings, Inc. was valued at $1.5B. The pairing suggests strategic interest in extending security coverage through adjacent identity capabilities. Apr-2024 Thoma Bravo → Darktrace plc n/a 7.8x n/a Thoma Bravo’s announced transaction for Darktrace plc carries 7.8x EV / Revenue. The reference aligns with sponsor attention to recurring revenue, category resilience and a credible path to efficient growth.

  20. 20
    06 · PRECEDENT TRANSACTIONS (2 OF 2)

    All Precedent Transactions with Disclosed Terms, Newest First

    All Precedent Transactions with Disclosed Terms, Newest First.

    All Precedent Transactions with Disclosed Terms, Newest First 40 transactions with disclosed terms in this tier (123 recorded) · multiples on LTM financials at announcement where disclosed · deal values link to the underlying filing · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. 161 precedent record(s) carry data-quality flags (deal value unit unresolved; divestiture roles reassigned; duplicate filings collapsed); figures are shown as recorded in the filing. 83 recorded transactions with neither a disclosed value nor a multiple are omitted from the precedent list and the case studies (kept in the companion workbook). Deal multiples are LTM at announcement (Definitive, from filings); they are not directly comparable to the CY2027E public basis and no spread is claimed.

    Everything on this page

    06 · PRECEDENT TRANSACTIONS (2 OF 2) All Precedent Transactions with Disclosed Terms, Newest First 40 transactions with disclosed terms in this tier (123 recorded) · multiples on LTM financials at announcement where disclosed · deal values link to the underlying filing · as of 2026-09-28 Source: NeuraCap analytics platform; market data and consensus estimates as of 2026-09-28; company disclosures via SEC EDGAR where linked. 161 precedent record(s) carry data-quality flags (deal value unit unresolved; divestiture roles reassigned; duplicate filings collapsed); figures are shown as recorded in the filing. 83 recorded transactions with neither a disclosed value nor a multiple are omitted from the precedent list and the case studies (kept in the companion workbook). Deal multiples are LTM at announcement (Definitive, from filings); they are not directly comparable to the CY2027E public basis and no spread is claimed. 18 of 40 transactions shown; the rest are in the companion workbook. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 20 Date Transaction EV EV/LTM Rev EV/LTM EBITDA Why it matters Feb-2024 Haveli Investment Management → ZeroFox Holdings n/a 1.4x n/a Value shown as recorded in the filing; deal value unit unresolved. Oct-2023 Undisclosed buyer → BlackBerry Limited $2.7B 3.3x n/a Value shown as recorded in the filing; deal value unit unresolved, divestiture roles reassigned. Mar-2023 Thoma Bravo, LP → Magnet Forensics Inc. n/a 10.3x n/a Oct-2022 Vista Equity Partners Management, LLC → KnowBe4, Inc. n/a 14.9x n/a Sep-2022 NortonLifeLock Inc. → Avast plc n/a 9.6x n/a Apr-2022 Turn/River Capital → Tufin Software Technologies Ltd. n/a 0.7x 8.8x Value shown as recorded in the filing; deal value unit unresolved. Mar-2022 Google LLC → Mandiant Inc. n/a 11.1x n/a Feb-2022 Fortra → Tripwire n/a 3.3x n/a Value shown as recorded in the filing; deal value unit unresolved. Dec-2021 Permira → Mimecast Limited $5.2B 8.8x 32.1x Value shown as recorded in the filing; deal value unit unresolved.

  21. 21
    06 · METHODOLOGY

    Sources, Assumptions and Data Quality

    Sources, Assumptions and Data Quality.

    Sources, Assumptions and Data Quality How this report was built, what was excluded, and where every underlying disclosure lives · as of 2026-09-28 Every figure in this report links to the record it was taken from. Where a figure has no link, the appendix names its source and the basis on which it was read. 21

    Everything on this page

    06 · METHODOLOGY Sources, Assumptions and Data Quality How this report was built, what was excluded, and where every underlying disclosure lives · as of 2026-09-28 Every figure in this report links to the record it was taken from. Where a figure has no link, the appendix names its source and the basis on which it was read. Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice 21 VALUATION BASIS Primary valuation basis: EV / EBITDA on CY2027E consensus (13 of 18 companies eligible; multiples failing the platform's plausibility gates are excluded, never plotted). Practitioners also quote EV / Revenue in this industry; this set is profitable (median forward EBITDA margin 26%, 13 of 18 names with a meaningful EBITDA), so EV / EBITDA leads and EV / Revenue is the cross-check. EV / EBITDA on CY2027E is the lead convention: it is the sector-appropriate prior for Cybersecurity Software and it clears the coverage gate with 16 of 18 companies (89%). EV / Revenue, P / E are carried as a cross-check. The set earns: 16 of the 16 companies with a reported forward EBITDA carry a meaningful one, so the profit multiple leads and a revenue multiple would understate what the market is pricing. DATA QUALITY & EXCLUSIONS 22 records were excluded or quarantined by the platform's validation gates (unit errors, implausible ratios, ineligible securities and classification failures); the full ledger ships in the companion tables and never feeds a statistic in this report. DEFINITIVE VS DIRECTIONAL Definitive content is disclosed or consensus data passed through stated arithmetic. Directional content — tier boundaries, situation cuts, "why it matters" commentary, the agenda pages — is NeuraCap analyst judgment and is labeled as such where it appears. WHAT THIS REPORT IS NOT This report characterises a sector. It does not recommend buying, selling or holding any security, and no statement in it should be read as investment advice or a price target. WHERE THE DATA LIVES 952 registered source documents stand behind the figures in this report. Metric hyperlinks throughout the deck open the specific filing or data record; by publisher: sec.gov (951) · home.treasury.gov (1). The companion workbook beside this deck carries the complete source index.

  22. 22

    Higher Forward Valuations Sit with Durable Growth and Platform Relevance.

    Higher Forward Valuations Sit with Durable Growth and Platform Relevance..

    Closing — Higher Forward Valuations Sit with Durable Growth and Platform Relevance. The companion tables beside this deck carry the full universe, the exclusion ledger and the complete source index for any figure a client wants to trace. 22

    Everything on this page

    Higher Forward Valuations Sit with Durable Growth and Platform Relevance. NeuraCap AI — Cybersecurity Software Coverage September 2026 · Prepared by NeuraCap AI · Confidential Cybersecurity Software Coverage | September 2026 | Confidential | Not investment advice Sources & methodology 22

Sources and methodology

This report covers Cybersecurity Software (Information Technology › Software and Services › Cybersecurity Software) with market data and consensus estimates as of September 28, 2026. The company universe is the 18 listed companies whose core business is Cybersecurity Software according to NeuraCap's industry classification of each company's reported business segments (a company is included only when this industry is central to what it does, not merely adjacent to it). Companies in the set: Allot Ltd. (ALLT), Arqit Quantum Inc. (ARQQ), BlackBerry Limited (BB), Check Point Software Technologies Ltd. (CHKP), CrowdStrike Holdings, Inc. (CRWD), Gen Digital Inc. (GEN), N-able, Inc. (NABL), Netskope, Inc. Class A Common Stock (NTSK), Palo Alto Networks, Inc. (PANW), Qualys, Inc. (QLYS), Rubrik, Inc. (RBRK), Rapid7, Inc. (RPD), SentinelOne, Inc. (S), Tenable Holdings, Inc. (TENB), Telos Corporation (TLS), VirnetX Holding Corp (VHC), Varonis Systems, Inc. (VRNS), Zscaler, Inc. (ZS). The market map groups them by business vertical — Security infrastructure platforms: 15 companies (PANW, CRWD, ZS, RBRK, GEN, CHKP, S, NTSK, QLYS, VRNS, BB, TENB, RPD, ALLT, VHC); Adjacent: security-focused technology services: 2 companies (NABL, TLS); Security application platforms: 1 company (ARQQ). 13 of the 18 companies carry a valid multiple on the primary valuation basis and form the rated set behind every cohort statistic; the others are shown but do not enter the statistics.

Scope and company universe

This report covers Cybersecurity Software (Information Technology › Software and Services › Cybersecurity Software) with market data and consensus estimates as of September 28, 2026. The company universe is the 18 listed companies whose core business is Cybersecurity Software according to NeuraCap's industry classification of each company's reported business segments (a company is included only when this industry is central to what it does, not merely adjacent to it). Companies in the set: Allot Ltd. (ALLT), Arqit Quantum Inc. (ARQQ), BlackBerry Limited (BB), Check Point Software Technologies Ltd. (CHKP), CrowdStrike Holdings, Inc. (CRWD), Gen Digital Inc. (GEN), N-able, Inc. (NABL), Netskope, Inc. Class A Common Stock (NTSK), Palo Alto Networks, Inc. (PANW), Qualys, Inc. (QLYS), Rubrik, Inc. (RBRK), Rapid7, Inc. (RPD), SentinelOne, Inc. (S), Tenable Holdings, Inc. (TENB), Telos Corporation (TLS), VirnetX Holding Corp (VHC), Varonis Systems, Inc. (VRNS), Zscaler, Inc. (ZS). The market map groups them by business vertical — Security infrastructure platforms: 15 companies (PANW, CRWD, ZS, RBRK, GEN, CHKP, S, NTSK, QLYS, VRNS, BB, TENB, RPD, ALLT, VHC); Adjacent: security-focused technology services: 2 companies (NABL, TLS); Security application platforms: 1 company (ARQQ). 13 of the 18 companies carry a valid multiple on the primary valuation basis and form the rated set behind every cohort statistic; the others are shown but do not enter the statistics.

What was excluded and why

22 records failed a validation gate and never feed a statistic in this report (19 excluded from aggregate; 3 quarantined). Each exclusion, with its reason: ARQQ — EBITDA is non-positive; EV/EBITDA is n/m (effect: excluded from aggregate) · ARQQ — Implied EBITDA margin -2908.3% outside the plausible band [-100%, 80%] (effect: quarantined) · ARQQ — EBITDA is non-positive; EV/EBITDA is n/m (effect: excluded from aggregate) · ARQQ — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · ARQQ — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · ARQQ — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · ARQQ — Revenue for CY2026E is 40.0x the CY2025E value and 11.8x larger than CY2027E; the value is on a different basis from the periods either side of it and cannot be compared with them (effect: quarantined) · CRWD — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · NABL — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · NTSK — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · NTSK — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · RBRK — EBITDA is non-positive; EV/EBITDA is n/m (effect: excluded from aggregate) · RBRK — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · RBRK — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · S — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · TENB — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · TLS — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · VHC — EBITDA is non-positive; EV/EBITDA is n/m (effect: excluded from aggregate) · VHC — Implied EBITDA margin -11237.0% outside the plausible band [-100%, 80%] (effect: quarantined) · VHC — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · VRNS — Non-positive EPS; P/E is n/m (effect: excluded from aggregate) · ZS — Non-positive EPS; P/E is n/m (effect: excluded from aggregate)

Primary valuation basis and how it was chosen

Primary valuation basis: EV / EBITDA on CY2027E consensus (13 of 18 companies eligible; multiples failing the platform's plausibility gates are excluded, never plotted). Practitioners also quote EV / Revenue in this industry; this set is profitable (median forward EBITDA margin 26%, 13 of 18 names with a meaningful EBITDA), so EV / EBITDA leads and EV / Revenue is the cross-check. EV / EBITDA on CY2027E is the lead convention: it is the sector-appropriate prior for Cybersecurity Software and it clears the coverage gate with 16 of 18 companies (89%). EV / Revenue, P / E are carried as a cross-check. The set earns: 16 of the 16 companies with a reported forward EBITDA carry a meaningful one, so the profit multiple leads and a revenue multiple would understate what the market is pricing. The basis is selected in two steps: the industry's customary valuation conventions set the order of preference, and each convention is then tested for coverage — the share of companies with a valid, plausibility-checked multiple on the chosen period. A convention is used only when enough companies carry it; the best-covered convention is used, and disclosed, when none clears the threshold. Coverage measured for this report — EV / EBITDA: 16 of 18 companies; EV / rEVenue: 17 of 18 companies; P/E: 16 of 18 companies. 1 company shows a non-meaningful P / E denominator and is excluded from that statistic.

How the multiples and statistics are computed

Enterprise value (EV) is market capitalisation at the as-of date plus total debt minus cash and equivalents from the latest reported balance sheet, reconciled against the platform's stored value and disclosed where the two differ. Forward multiples divide EV (or the share price for P/E) by the consensus estimate for the stated calendar period; trailing multiples use the last twelve months of reported figures from SEC filings. A multiple with a negative or immaterial denominator is treated as not meaningful and excluded from every statistic. Cohort statistics are medians and quartiles over the rated set only; a group median with fewer than three observations is shown as the single company's figure and labelled as such. Valuation tiers cut the rated set at its quartiles (tiers cut at the rated set's quartiles: Premium ≥29.8x, Core 7.5x–29.8x, Discount <7.5x — NeuraCap groupings). Revenue growth compares consecutive calendar-year consensus revenue; EBITDA margin divides consensus EBITDA by consensus revenue for the same period. Figures shown in this report and the calculation behind each: 15.9x = median(ev_ebitda CY2027E) (13 rated companies) · 41.3x = median(ev_ebitda CY2027E) within Premium tier (n=4) · 15.9x = median(ev_ebitda CY2027E) within Core tier (n=5) · 7.0x = median(ev_ebitda CY2027E) within Discount tier (n=4) · 25.3x = median(ev_ebitda CY2027E) | growth ≥ 8% (n=7) · 9.0x = median(ev_ebitda CY2027E) | growth < 8% (n=6) · 12.9x = median(ev_ebitda CY2027E) | EBITDA margin ≥ 26% (n=7) · 24.5x = median(ev_ebitda CY2027E) | EBITDA margin < 26% (n=6) · 35% = median Rule of 40 score (revenue growth + EBITDA margin) (n=13) · 20.6x = median(ev_ebitda CY2027E) within balanced quadrant (n=4) · 10.6x = median(ev_ebitda CY2027E) within marginOnly quadrant (n=3) · 29.8x = median(ev_ebitda CY2027E) within growthOnly quadrant (n=3) · 7.4x = median(ev_ebitda CY2027E) within neither quadrant (n=3) · 57.8x = ev_ebitda CY2027E for PANW (quadrant outlier) · 33.3x = ev_ebitda CY2027E for BB (quadrant outlier)

Precedent transactions: what is in the record and why

The precedent record holds the M&A transactions in Cybersecurity Software recorded from SEC filings (8-K announcements and the documents they reference), newest first, with each value and multiple linked to the exact passage in the filing that states it. 123 transactions were recorded for this industry; 40 are shown. 83 recorded transactions with neither a disclosed value nor a multiple are omitted because they say nothing about price; they remain in the companion workbook. Deal multiples are enterprise value over the target's last-twelve-month revenue or EBITDA at announcement, as disclosed; they are not restated to the public basis and no spread to the public multiples is claimed. Before a transaction reaches the record it passes a screen for mirrored or duplicate filings of the same deal, for divestitures where the filer is the seller rather than the buyer, for carve-outs recorded under the parent's name, and for values whose citation describes something other than the price paid (a debt raise, a termination fee); such records are corrected or excluded and the correction is noted. Data-quality notes on this record: 55 × deal value unit unresolved; 92 × no evidence record; 10 × duplicate precedent id; 1 × duplicate filings collapsed; 3 × divestiture roles reassigned. Case studies lead with the 3 richest stories — disclosed value, a readable multiple, newest first.

Sources

Company financials and transaction terms come from the companies' own SEC filings on EDGAR (10-K, 10-Q and 8-K documents), linked from each figure in the report. Forward figures are analyst consensus estimates for the calendar periods shown. Share prices and market capitalisations are market data as of September 28, 2026. Treasury yields are published by the U.S. Department of the Treasury. 956 source documents stand behind this report; by publisher domain: sec.gov, home.treasury.gov (1). Every figure on every page is traceable to one of these records; nothing in the report is derived from outside data.

Interpretation and important notice

Tier labels, situation maps, the agenda and the implications pages are NeuraCap analytical views drawn from the recorded evidence and are labelled as such. The report is informational: it is not investment advice, not a recommendation to buy or sell any security, not an opinion of value and not an offer of any kind. Readers should perform their own diligence before acting on anything described here.

This report is published for information only. It is not a recommendation to buy or sell any security, an offer or solicitation, an appraisal or a fairness opinion, and no fiduciary relationship is created by reading it. Multiples that fail NeuraCap’s plausibility gates are excluded and never plotted. See the full methodology and the disclaimer.

More coverage in Information Technology

Want this analysis for a company in Cybersecurity Software?

Company valuation reports run the same method against a single business — public or private.

Get a free sample reportBrowse the research