Cyber Security Value-Added Reseller & Consulting Firm, Federal & Public Sector

$8.7M

Revenue

$928K

SDE

Subscribe Free

Read the full deal writeup

Get Free Access

Already a member? Sign in

Full Editorial Writeup

This is a Mid-Atlantic based IT security firm that resells, advises on, and integrates cybersecurity solutions for US Federal government and public-sector customers. The Company carries a broad portfolio spanning messaging, web, application, network, and mobile security along with storage and archiving, delivered through partnerships with leading security vendors and packaged as fully managed security infrastructures. It generated roughly $8.7M in revenue and $928K in EBITDA over the trailing twelve months ending June 2026.

What makes this more interesting than a typical value-added reseller is the revenue quality. Around 95% of 2025 revenue came from subscription-based software licenses that renew annually, and the business holds an active GSA Multiple Award Schedule contract valid through June 2029 that provides a streamlined procurement path into federal buyers. Many of its government relationships stretch back over 15 years, which is the kind of switching-cost moat that is hard to build and hard to displace.

The growth story is real: revenue compounded at roughly 33% and gross profit at roughly 24% from 2023 through mid-2026. The business runs remote with only virtual office space, meaning there is little physical overhead and the value sits in contracts, vendor relationships, and a recurring license book. The single owner is seeking retirement and willing to stay up to three years, which is unusually generous transition runway for a founder-dependent federal contractor.

Why we like it

Earnings quality is strong for a reseller: about 95% of 2025 revenue came from annually renewing subscription software licenses, not one-off hardware flips. That converts a normally lumpy VAR model into a predictable, sticky book with $928K of EBITDA on $8.7M of revenue.
The moat is the federal footprint. An active GSA MAS contract through June 2029 plus government relationships that many have run over 15 years creates real switching costs and a procurement path competitors cannot easily replicate. Federal buyers are slow to move and slower to churn once you are on schedule.
Market tailwinds favor this deal. Cybersecurity spend by government agencies and regulated finance, healthcare, and critical infrastructure clients is mandated and growing, not discretionary. This is spend that survives a downturn because compliance and threat exposure do not pause for the economy.
The financial trajectory is genuinely rare for an SMB: roughly 33% revenue CAGR and 24% gross-profit CAGR from 2023 through mid-2026. Combined with a lean remote operating model and only virtual office leases, the business throws off cash without carrying heavy fixed overhead.

How to improve it

Push the managed services and multi-year subscription mix. The listing already flags this as an opportunity, and moving customers from annual renewals to multi-year commitments deepens stickiness and lets you forecast cash further out, which also raises the exit multiple.
Build a real sales and marketing engine. Growth has come largely from reputation and relationships with no dedicated sales team or SEO presence, so hiring a small quota-carrying sales function and adding demand generation could accelerate the existing 33% growth rate meaningfully.
Expand the vendor affiliate portfolio to cross-sell storage, archiving, and compliance-focused offerings into the existing federal base. These customers already trust the firm and buy annually, so widening the product shelf increases wallet share without new customer acquisition cost.
De-risk the owner dependency early. Use the negotiated transition window to document customer relationships, GSA schedule administration, and vendor contacts, and to install a general manager so the business does not lean on the founder's personal government network.
Pursue additional contract vehicles beyond the single GSA MAS. Adding vehicles like SEWP, GWACs, or agency-specific IDIQs diversifies the procurement pathways and reduces reliance on one schedule that expires in June 2029.
Segment and protect the top accounts. Since some relationships span 15-plus years, map revenue concentration and put named account managers and QBRs on the largest agencies to defend the recurring base through the ownership transition.

Diligence notes

Verify the 95% subscription-renewal claim with actual renewal and retention rates by cohort. Confirm whether these are true recurring licenses the Company controls or pass-through vendor subscriptions where the customer relationship could migrate directly to the vendor.
Scrutinize customer concentration in the federal base. With relationships over 15 years and public-sector buyers, a handful of agencies may drive most revenue, so quantify what the top five customers represent and how contracts are structured and renewed.
Examine the GSA MAS contract terms and the June 2029 expiration. Understand renewal likelihood, compliance obligations, pricing constraints, and whether the schedule and any options transfer cleanly to a new owner in a change of control.
Reconcile the EBITDA to true owner cash flow. With only virtual offices and a remote team, confirm addbacks, contractor versus employee headcount, and how much margin depends on the retiring owner's personal relationships versus repeatable process.
Confirm gross margin durability given the reseller model. A 24% gross-profit CAGR that trails the 33% revenue CAGR suggests margin compression, so break out product resale margin versus managed-services margin to understand where profit actually comes from.

Source

Originally listed on BizBuySell. View original listing →