Cybersecurity Services Firm, 10-Year Fortune 500 & Government Provider

$17.5M

Revenue

$1.4M

SDE

18.3x

Multiple

Subscribe Free

Read the full deal writeup

Get Free Access

Already a member? Sign in

Full Editorial Writeup

Founded in 2016, this cybersecurity services company sells into the two buyer segments that spend on security through thick and thin: Fortune 500 enterprises and government agencies. At roughly $17.5M in revenue over a 10-year track record, the business has built the kind of credential set (large-enterprise logos, public-sector contracts) that functions as a real barrier to entry, since procurement cycles and security clearances take years to earn and are hard for a new entrant to replicate.

The headline problem is the economics. Reported cash flow is about $1.4M on $17.5M of revenue, an 8 percent margin, which is thin for a services business and suggests either heavy delivery labor costs, reinvestment, or an owner compensation structure that needs unpacking. The asking price of $25.6M against $1.4M of cash flow is an 18x-plus multiple, which is aggressive and almost certainly reflects the quality of the client base and revenue scale rather than current earnings power.

For the right operator, the story is a scaled, credentialed cybersecurity practice serving recession-resistant buyers, with a clear value-creation path through margin repair and contract conversion. The valuation, however, requires a buyer to believe the margin can be meaningfully expanded or that the client relationships justify paying for revenue rather than profit.

Why we like it

Cybersecurity spend is among the stickiest line items in any enterprise or government budget, since a breach is existential and compliance is mandatory. Serving Fortune 500 and government clients means demand holds up in downturns, and these buyers rarely cut security to save money the way they cut marketing or travel.
The client base is the real moat here. Landing and retaining Fortune 500 logos and government contracts requires years of past performance, security clearances, and procurement vetting, which makes this revenue extremely hard for a new competitor to displace and gives the incumbent natural renewal advantages.
At $17.5M in revenue the business has genuine scale, not a one-person consultancy. That scale implies a delivery team, repeatable engagements, and operational infrastructure that a buyer can build on rather than having to assemble from scratch.
The cybersecurity market has durable structural tailwinds from rising threat volume, expanding regulatory requirements, and growing government security budgets. A buyer is stepping into a category where the demand curve points up for the foreseeable future.

How to improve it

Attack the margin first. An 8 percent cash flow margin on $17.5M of revenue is low for IT and security services, so audit utilization rates, bench time, subcontractor costs, and project pricing to find where the gross margin is leaking before anything else.
Convert project and staff-augmentation work into managed services and recurring retainers. Monitoring, detection, and response contracts billed monthly are higher margin and far stickier than one-off assessments, and they would both lift earnings and justify the valuation over time.
Formalize contract renewal and upsell motion within the existing Fortune 500 and government accounts. These relationships are expensive to win and cheap to expand, so a deliberate account-management function can grow revenue without the cost of new logo acquisition.
Pursue additional government vehicles and certifications (GSA schedules, FedRAMP, relevant clearances). Each new contracting pathway widens the addressable government pipeline and deepens the moat that already makes this business hard to displace.
Build a repeatable productized service catalog with fixed-scope offerings. Standardizing common engagements reduces delivery variability, improves margin predictability, and makes the business far easier to scale and eventually resell.
Reduce key-person and client concentration risk by broadening the senior delivery bench and diversifying the logo base. This protects earnings quality and is essential for any future buyer or lender underwriting the deal.
Install real financial reporting with clean revenue recognition, project-level profitability, and a normalized owner compensation line. The current 18x optics make no sense unless the true earnings picture is clarified, and better reporting may reveal adjusted EBITDA well above the stated $1.4M.

Diligence notes

The valuation is the first thing to interrogate. An 18.33x multiple on $1.4M of cash flow is extraordinary for a services firm, so confirm whether the asking price reflects an add-back-heavy adjusted EBITDA, a strategic premium for the client base, or simply an unrealistic seller expectation.
Dig into revenue composition and recurring versus project mix. Determine how much of the $17.5M is contracted managed services versus one-time or staff-augmentation work, since the durability of the earnings and the right multiple depend entirely on that split.
Examine client concentration across the Fortune 500 and government accounts. If a handful of contracts drive most of the revenue, the loss of a single relationship could impair the business, and government contracts in particular can be non-renewing or re-competed.
Scrutinize the thin 8 percent margin to understand whether it reflects a genuinely low-margin delivery model, heavy reinvestment, or owner comp and add-backs. The entire investment case hinges on whether margin can be repaired to a normal services level.
Verify all security clearances, certifications, and contract vehicles and confirm they transfer on a change of ownership. Some government contracts and clearances are tied to specific entities or personnel and could be jeopardized by the transaction.
Assess staff and key-person dependency, especially senior cleared technical talent. Services firms live and die by their delivery team, so confirm retention, non-competes, and whether the owner is a critical rainmaker whose exit would damage the client relationships.

Source

Originally listed on DealStream. View original listing →