Valuation Lab · Calculator
Security companies are three different businesses wearing one label. A product company is priced on ARR: private security software with 30%-50% ARR growth cleared a median 9.8x EV/ARR (P25-P75 7.5x-12.0x) in the SaaS Capital and PitchBook data tabulated by Windsor Drake, against 3.2x below 10% growth. An MSSP is priced on the EBITDA its recurring monitoring contracts produce after SOC analyst cost (5.0x-7.0x at $1M-$3M EBITDA; 6.5x-9.0x at $3M-$10M). A consulting or testing firm is priced on utilization and realized rate in the lower half of that services band. This calculator asks which you are before it shows a single input.
Public security software traded at 7.8x forward revenue for the general index in August 2026, with cloud security at 13.9x and identity at 10.5x in the November 2025 subsector cut; SEG’s security segment sat at 4.3x trailing revenue within its broader index at 2Q26. None of those numbers apply to a managed security provider, whose value rests on contract retention and the analysts who deliver it, or to a penetration-testing firm, whose value rests on billable hours. The model switch exists so that a services company never receives a software multiple by accident.
The governing metric is reported on every result: net revenue retention and gross margin for product, contract retention and analyst delivery cost for MSSPs, utilization and rate for consulting.
The interactive calculator loads here. The published example scenario below is the same model (2026.09.22-1) evaluated at the example inputs.
Indicative enterprise value, EV / ARR (product): $24.4M. $18.0M to $31.2M; selected 6.1x
Governing metric: Net revenue retention and gross margin. Band: EV/ARR 4.5x to 7.8x for 10-30% growth (SaaS Capital / PitchBook via Windsor Drake cybersecurity report).
ARR: $4.0M · CAC payback: 10.3 mo · 36-mo ARR: $12.8M
| Horizon | ARR | Enterprise value at fixed multiple |
|---|---|---|
| Today | $4.0M | $24.4M |
| Month 12 | $6.7M | $40.6M |
| Month 24 | $9.6M | $58.4M |
| Month 36 | $12.8M | $78.1M |
Future values are not present valuations.
| Input | Value |
|---|---|
| Business model | Product software (subscription) |
| ARR | $4,000,000 |
| Net revenue retention | 110% |
| ARR growth (last 12 months) | 25% |
| Gross margin | 78% |
| Monthly acquisition spend | $120,000 |
| Customer acquisition cost | $20,000 |
| ACV per new customer | $30,000 |
| Other operating costs per month | $150,000 |
| Selected multiple (0 = benchmark) | 0x |
| Excess cash | $0 |
| Debt | $0 |
Uses the SaaS operating engine: monthly retention factor from NRR, new customers from the acquisition budget and CAC, gross margin on recognized revenue. The EV/ARR band is selected by the ARR growth you enter from the private-market growth table (below 10%: 2.1x-4.5x; 10%-30%: 4.5x-7.8x; 30%-50%: 7.5x-12.0x; above 50%: 12.5x-18.4x). Security-specific example: a $4M ARR endpoint-detection vendor at 25% growth, 110% NRR and 78% gross margin.
Uses the recurring-contract engine: monthly retention on contracted MRR, new contracts, SOC analyst and delivery cost as a share of recurring revenue, incident-response projects at their own margin, operating costs once. Example: $300,000 of monitoring MRR at 90% retention with analyst cost at 50% of recurring revenue. The band is the cybersecurity services & MSSP row of the 2026 industry table.
Uses the capacity engine: consultants x 1,700 hours x utilization x realized rate, less compensation, subcontractors and overhead. Example: twelve consultants at 65% utilization and $210 per hour. Because there are no recurring contracts, the band is the lower half of the services range.
Exploring what your company is worth? A principal will give you a confidential perspective on how the market is pricing businesses like yours: current multiples, the acquirers active in your sector, and where your company would likely land.
Product software: 3.2x EV/ARR at under 10% growth to 15.2x above 50% growth in private data, with public cloud-security peers at 13.9x forward revenue. MSSPs: 5.0x-7.0x EBITDA at $1M-$3M of earnings to 8.5x-12.0x above $10M. Consulting: the lower half of that services band.
Because recurring monitoring contracts carry analyst delivery cost that software does not. Buyers price the EBITDA those contracts produce; the calculator shows recurring share alongside it.
Net revenue retention, then gross margin. Both drive the monthly model directly; the ARR growth you enter selects the band.
It is a consulting business: utilization and realized rate govern earnings, and without recurring contracts it sits in the lower half of the services band.
Enterprise value is quoted cash-free and debt-free; equity value adds excess cash and subtracts debt and debt-like items, before fees, taxes, escrow, rollover and earn-outs. Every method states its denominator, period (trailing twelve months unless labelled), currency (USD) and treatment of cash and debt. Results are ranges under stated assumptions, not statistical confidence intervals. Company inputs stay in the browser and are never transmitted. Benchmark snapshot 2026.09.22-1; model 2026.09.22-1; changes are recorded in the Valuation Lab changelog in the Windsor Drake repository.
Benchmark: Cybersecurity valuation multiples · Related: SaaS valuation calculator · MSP valuation calculator · Cybersecurity M&A advisory · All valuation tools