Valuation Lab · Calculator

Cybersecurity valuation calculator

Security companies are three different businesses wearing one label. A product company is priced on ARR: private security software with 30%-50% ARR growth cleared a median 9.8x EV/ARR (P25-P75 7.5x-12.0x) in the SaaS Capital and PitchBook data tabulated by Windsor Drake, against 3.2x below 10% growth. An MSSP is priced on the EBITDA its recurring monitoring contracts produce after SOC analyst cost (5.0x-7.0x at $1M-$3M EBITDA; 6.5x-9.0x at $3M-$10M). A consulting or testing firm is priced on utilization and realized rate in the lower half of that services band. This calculator asks which you are before it shows a single input.

By Jeff Barrington, Founder and Managing Director · Model 2026.09.22-1 · Benchmarks 2026.09.22-1 · Published 2026-09-22

Public security software traded at 7.8x forward revenue for the general index in August 2026, with cloud security at 13.9x and identity at 10.5x in the November 2025 subsector cut; SEG’s security segment sat at 4.3x trailing revenue within its broader index at 2Q26. None of those numbers apply to a managed security provider, whose value rests on contract retention and the analysts who deliver it, or to a penetration-testing firm, whose value rests on billable hours. The model switch exists so that a services company never receives a software multiple by accident.

The governing metric is reported on every result: net revenue retention and gross margin for product, contract retention and analyst delivery cost for MSSPs, utilization and rate for consulting.

The interactive calculator loads here. The published example scenario below is the same model (2026.09.22-1) evaluated at the example inputs.

Worked example

Indicative enterprise value, EV / ARR (product): $24.4M. $18.0M to $31.2M; selected 6.1x

Governing metric: Net revenue retention and gross margin. Band: EV/ARR 4.5x to 7.8x for 10-30% growth (SaaS Capital / PitchBook via Windsor Drake cybersecurity report).

ARR: $4.0M · CAC payback: 10.3 mo · 36-mo ARR: $12.8M

Published example: results table and inputs (model 2026.09.22-1)
Projected value
Horizon ARR Enterprise value at fixed multiple
Today $4.0M $24.4M
Month 12 $6.7M $40.6M
Month 24 $9.6M $58.4M
Month 36 $12.8M $78.1M

Future values are not present valuations.

Published example inputs
Input Value
Business model Product software (subscription)
ARR $4,000,000
Net revenue retention 110%
ARR growth (last 12 months) 25%
Gross margin 78%
Monthly acquisition spend $120,000
Customer acquisition cost $20,000
ACV per new customer $30,000
Other operating costs per month $150,000
Selected multiple (0 = benchmark) 0x
Excess cash $0
Debt $0

Product software mode

Uses the SaaS operating engine: monthly retention factor from NRR, new customers from the acquisition budget and CAC, gross margin on recognized revenue. The EV/ARR band is selected by the ARR growth you enter from the private-market growth table (below 10%: 2.1x-4.5x; 10%-30%: 4.5x-7.8x; 30%-50%: 7.5x-12.0x; above 50%: 12.5x-18.4x). Security-specific example: a $4M ARR endpoint-detection vendor at 25% growth, 110% NRR and 78% gross margin.

MSSP mode

Uses the recurring-contract engine: monthly retention on contracted MRR, new contracts, SOC analyst and delivery cost as a share of recurring revenue, incident-response projects at their own margin, operating costs once. Example: $300,000 of monitoring MRR at 90% retention with analyst cost at 50% of recurring revenue. The band is the cybersecurity services & MSSP row of the 2026 industry table.

Consulting mode

Uses the capacity engine: consultants x 1,700 hours x utilization x realized rate, less compensation, subcontractors and overhead. Example: twelve consultants at 65% utilization and $210 per hour. Because there are no recurring contracts, the band is the lower half of the services range.

Limitations

Next step for a founder

Exploring what your company is worth? A principal will give you a confidential perspective on how the market is pricing businesses like yours: current multiples, the acquirers active in your sector, and where your company would likely land.

Questions founders ask

What multiple do cybersecurity companies sell for?

Product software: 3.2x EV/ARR at under 10% growth to 15.2x above 50% growth in private data, with public cloud-security peers at 13.9x forward revenue. MSSPs: 5.0x-7.0x EBITDA at $1M-$3M of earnings to 8.5x-12.0x above $10M. Consulting: the lower half of that services band.

Why is my MSSP not valued on ARR?

Because recurring monitoring contracts carry analyst delivery cost that software does not. Buyers price the EBITDA those contracts produce; the calculator shows recurring share alongside it.

Which metric matters most for a security product company?

Net revenue retention, then gross margin. Both drive the monthly model directly; the ARR growth you enter selects the band.

How does a penetration-testing firm compare?

It is a consulting business: utilization and realized rate govern earnings, and without recurring contracts it sits in the lower half of the services band.

Methodology, sources and definitions

Enterprise value is quoted cash-free and debt-free; equity value adds excess cash and subtracts debt and debt-like items, before fees, taxes, escrow, rollover and earn-outs. Every method states its denominator, period (trailing twelve months unless labelled), currency (USD) and treatment of cash and debt. Results are ranges under stated assumptions, not statistical confidence intervals. Company inputs stay in the browser and are never transmitted. Benchmark snapshot 2026.09.22-1; model 2026.09.22-1; changes are recorded in the Valuation Lab changelog in the Windsor Drake repository.