SIEM/ SOAR Valuation - Cybersecurity Valuation Report: Q4 2025

Download the Full Report

Available exclusively to cybersecurity founders, executives, and investors.

Executive Summary: The Age of Agentic Premium and Platform Darwinism

We are now navigating the final months of 2025. The cybersecurity valuation landscape has settled into a new reality. It is defined by two things. Platform Darwinism and the Agentic Premium. We saw a lot of volatility during the post-pandemic correction of 2022. Then came the efficiency-driven stabilization of 2023. That is over now. The market has structurally split. In Q4 2025, capital allocation is not driven by the simple mandate of growth at all costs that we saw during the zero-interest-rate policy era. It is also not constrained by the strict profitability first overcorrection that came right after. Institutional investors are deploying capital with surgical precision instead. They are rewarding a specific type of cybersecurity company. This is the Autonomous Security Operations Platform.

This report is titled “Cybersecurity Valuation Report – Q4 2025.” It offers a deep dive into valuation metrics and merger and acquisition activity. It covers the strategic drivers shaping the SIEM and SOAR markets. Our research looks at the most recent Q3 and Q4 2025 earnings data. We also look at landmark transaction disclosures and guidance from major financial institutions to build a valuation framework for founders and investors.

The Macro Thematic Shift From Human Augmentation to Labor Displacement

The main idea driving valuations in Q4 2025 is the shift from human in the loop security models to fully autonomous agentic systems. The market has started to aggressively re-rate companies that can prove they displace labor rather than just help it. You can see this Agentic Premium in the valuation gap between legacy SIEM vendors and AI-native platforms. Legacy vendors trade at 3.0x to 5.0x EV/Revenue. AI-native platforms integrating autonomous remediation command multiples between 12.0x and 18.0x EV/Revenue.1, 2, 3

The Department of Justice cleared Google’s $32 billion acquisition of Wiz in November 2025.4

Cisco also integrated Splunk.5

These events established new floor and ceiling benchmarks for the industry. They signal that the Data Lake and the Control Plane are the two most valuable pieces of real estate in the digital enterprise. The market is telling us that standalone SOAR is no longer a viable public market category. It has been absorbed as a feature within broader platforms. This creates a discount for pure-play vendors who failed to expand their total addressable market.

The Valuation Bifurcation

Our analysis shows a K-shaped recovery in cybersecurity valuations. The upper arm of the K holds the Super Platforms. This includes CrowdStrike, Palo Alto Networks, and Datadog. These firms have successfully merged SIEM, EDR, and Cloud Security into one data schema. They are trading at a Rule of 60 standard. That is Growth plus FCF Margin. The lower arm consists of point solution vendors and legacy conglomerates. They are struggling to move from on-premise licensing to cloud-native consumption models.

Key findings for Q4 2025 include several points.

The AI Multiplier: Companies with proven Agentic AI capabilities act as a force multiplier on valuation. These are autonomous Level 3 or 4 SOC operations. They expand revenue multiples by 40% to 60% compared to peer groups without these capabilities.
Profitability as a Gatekeeper: The market has stopped rewarding empty calories revenue growth. GAAP profitability or strong Free Cash Flow margins are now required for premium multiples. Companies like SentinelOne and Datadog are being rewarded for finding this balance.6, 7
Consolidation Super Cycle: Q4 2025 marks a peak in consolidation. Hyperscalers are seeking data supremacy. The goal is to own the pipeline of data before it reaches the analysis layer. CrowdStrike’s acquisition of Onum is a perfect example.8

The Macroeconomic Substrate of Q4 2025

You have to look at the big economic picture of late 2025 to understand SIEM and SOAR valuations. The broader economic context acts as the denominator in every valuation equation. It decides the cost of capital. It also decides the risk appetite of institutional allocators.

Interest Rate Stabilization and the Cost of Capital

It is the fourth quarter of 2025. The Federal Reserve’s monetary policy has moved away from the restrictive stance of 2023 and 2024. It is now neutral. In some ways it is even slightly accommodative. The federal funds rate has stabilized. This gives much needed clarity for equity duration risk. The risk-free rate is a critical input in Discounted Cash Flow models for valuing high-growth software. This rate has come down from its 2023 peaks. That lowers the discount factor applied to future cash flows. It effectively raises the present value of terminal growth for SaaS companies.9

This does not mean we are back to the free money days of 2021. The cost of equity is still high compared to the decade before 2020. This forces discipline in capital deployment. Investors in Q4 2025 want efficient growth. The Rule of 40 principle says revenue growth rate plus free cash flow margin should equal or exceed 40%. This has turned into the Rule of 60 for top performers. The market believes the best assets can generate cash while growing at scale. This debunks the old idea of a trade-off between growth and profitability.

The Resilience of Cybersecurity Spending

Broader IT spending has some soft spots. But cybersecurity budgets are tough. They have shown remarkable inelasticity. Gartner forecasts worldwide IT spending to grow by 9.8% in 2025. It will reach $5.61 trillion.10

Information security spending is expected to do even better. It should reach $213 billion in 2025. The forecast says it will grow 12.5% to $240 billion in 2026.11

Three structural tailwinds drive this resilience.

Regulatory Compulsion: New SEC disclosure rules and global directives like NIS2 in Europe have changed things. Cybersecurity went from a technical cost to a boardroom compliance mandate.
The AI Threat Landscape: Threat actors have weaponized generative AI. This makes legacy detection systems obsolete. It forces a refresh cycle toward AI-native defenses.
Cloud Migration: Workloads keep moving to the cloud. This requires investment in cloud-native security tools like CNAPP and Cloud SIEM.

Second Order Implication: Aggregate spending is robust. But the distribution of that spending is heavily skewed. CIOs are actively pursuing Vendor Consolidation. They want to cut management overhead and integration costs. Budgets are moving from legacy on-premise SIEMs to cloud-native platforms. This creates a winner take most dynamic. Platform consolidators like Palo Alto Networks and CrowdStrike capture most of the new budget. Point solution vendors face high churn.12

The Platformization Premium

Platformization is the biggest valuation driver in 2025. Institutional investors have decided the modern security stack is too complex. They are giving a premium to companies that can simplify it.

Palo Alto Networks is aggressive with this strategy. They use free migration services to move customers from legacy vendors to their Cortex XSIAM platform. They specifically target IBM QRadar’s installed base.13
CrowdStrike calls the Falcon platform the operating system of cybersecurity. They integrate SIEM directly into the endpoint agent. This removes the need for separate infrastructure.8

Valuation Impact: Companies that execute a platform play get a Platform Premium. They trade at revenue multiples 3x to 5x higher than single product companies. Superior unit economics justify this. Platforms show higher Net Dollar Retention because of cross-selling. They also have lower Customer Acquisition Costs. It is more efficient to sell multiple modules to an existing installed base.

Public Market Valuation Analysis: Q4 2025

The public markets are the ultimate weighing machine for the sector. They give real-time feedback on the value of different business models. We see a distinct layering of valuation multiples in Q4 2025. This is based on growth durability and profitability and AI leverage.

What Are Current SIEM and SOAR Valuation Multiples?

The data below shows the valuation landscape as of December 1, 2025. It uses Q3 and Q4 earnings reports and forward guidance. The data shows the huge gap between Next-Gen platforms and Legacy providers.

Deep Dive: The Valuation Leaders

CrowdStrike (CRWD): The Data Gravity King

CrowdStrike still has the highest premium in the sector. It trades at about 30x LTM revenue and 18.5x NTM revenue.2

The market treats CrowdStrike as the Salesforce of Security.

Valuation Driver: Integrating Falcon LogScale allowed CrowdStrike to monetize the massive data volumes it collects. Investors see this as high margin revenue. The data ingestion cost is sunk because the agent is already deployed.
Q4 2025 Performance: CrowdStrike reported Q3 FY26 revenue of $885.7 million. That is up 28% year over year and beat estimates.21
Strategic Catalyst: Acquiring Onum in late 2025 was a key move. CrowdStrike can now filter and reduce data volumes before ingestion by owning the pipeline. This lowers the Total Cost of Ownership for customers. It also locks them into the Falcon ecosystem.8
This creates a moat around their SIEM business. It justifies the premium multiple.

Palo Alto Networks (PANW): The Total Platform Play

Palo Alto Networks trades at roughly 12.3x LTM revenue.14

It operates at a scale that usually compresses multiples. But it keeps a premium rating because it successfully changed from a hardware firewall vendor to a software platform giant.

Metric Focus: Investors watch Next-Generation Security ARR closely. This grew at 29% in the most recent quarter. It outpaced the legacy hardware business significantly.22
The IBM QRadar Maneuver: Acquiring IBM’s QRadar SaaS assets was a defining moment.23
PANW acquired the customer base instead of the legacy technology stack. They executed a customer lift and shift strategy. This let them accelerate the adoption of Cortex XSIAM without inheriting technical debt. Investors rewarded this capital efficient growth strategy. They see it as a blueprint for future consolidation.

Datadog (DDOG): Convergence of Observability and Security

Datadog trades at approximately 15.8x LTM revenue.16

It is known as an observability tool for DevOps. But its Cloud SIEM product is one of the fastest growing security products in the market.

DevOps as the Buyer: Datadog has a unique go to market motion. They sell to the DevOps buyer. This person often controls the cloud budget. This lets Datadog bypass the traditional CISO procurement process.
Financial Discipline: Datadog reported revenue growth of 28% year over year to $886 million in Q3 2025. They also had free cash flow margins of 24%.7
This combination of high growth and high profitability makes it a core holding for institutional growth funds.

SentinelOne (S): The Value Arbitrage

SentinelOne trades at a discount relative to CrowdStrike. It is at roughly 9.5x LTM Revenue.3

This is interesting because they share a similar technological DNA.

The Undervalued Twin Narrative: Revenue is growing 22%. They passed the $1 billion ARR milestone in FY26. SentinelOne is ready for a valuation re-rating.24
The market is waiting for sustained GAAP profitability to close the valuation gap.
Upside Scenario: SentinelOne needs to position its Purple AI and Singularity Data Lake as a true enterprise grade SIEM replacement. If they do that, the multiple has room to expand toward the 12x to 14x range.

The Growth Trap of Legacy Vendors

Companies like Rapid7 and Tenable show the risks of the mid market valuation trap.

Rapid7 (RPD): It trades at roughly 3.2x Revenue. Growth has slowed to 2% year over year.25, 26
The market prices it as a distressed asset. It is viewed as ex-growth. This makes it a target for private equity rather than a strategic acquisition.
Tenable (TENB): Tenable trades at roughly 5.3x Revenue.17
It faces the challenge of being a feature in a world of platforms. Profitability is solid. But the lack of top line velocity caps its multiple.

Strategic Implication: The gap between the platforms and the point solutions confirms the Platform Darwinism thesis. The middle ground is the most dangerous place to be in a consolidated market.

M&A Transactions: The Consolidation Super Cycle (2024-2025)

We saw a Super Cycle of M&A activity from late 2024 through 2025. These transactions give us the most accurate mark to market valuations for private SIEM and SOAR assets. They also show the strategic priorities of industry titans.

What M&A Transactions Occurred in Q4 2024 – Q4 2025?

Analysis of Key Transactions

Google Acquires Wiz ($32 Billion): The Defining Deal of the Decade

The Department of Justice cleared Google’s $32 billion all-cash acquisition of Wiz in November 2025.4

This is the biggest valuation event in recent cybersecurity history.

Valuation Logic: Wiz reportedly reached $500 million in ARR in 2024. It was projected to hit $1 billion ARR in 2025.32
A $32 billion price tag implies a forward multiple of roughly 32x ARR. This is a huge premium for a software asset of this scale.
Strategic Signal: Hyperscalers like Google and Microsoft and AWS view cloud security as a fundamental layer of the cloud infrastructure stack. It is not just a niche application. Wiz provides the security fabric for Google to compete with AWS and Azure. The high multiple reflects the scarcity of assets that can scale to $1 billion ARR with triple digit growth rates.

Cisco Acquires Splunk ($28 Billion): The Old Guard Consolidation

This deal closed in March 2024. It represents the consolidation of the legacy SIEM market.5

Valuation Logic: The multiple was significantly lower than the Google Wiz deal at roughly 7x ARR. This discount reflects Splunk’s lower growth rate. It also reflects the heavy lift required to migrate its massive on-premise installed base to the cloud.
Market Impact: Splunk was the largest independent SIEM player. Removing it from the public markets created a vacuum. Datadog and CrowdStrike and SentinelOne raced to fill it. It forced every CISO with a Splunk contract to re-evaluate their roadmap. This triggered a wave of displacement Proof of Concepts across the Global 2000.

Exabeam Merges with LogRhythm: The Private Equity Playbook

Exabeam and LogRhythm merged in July 2024. This created a pure-play SecOps vendor focused on scale rather than growth.29

Valuation Logic: This transaction was different from the growth focused acquisitions of Wiz or Onum. It was a defensive consolidation orchestrated by Thoma Bravo. The goal is operational efficiency. This includes combining R&D teams and rationalizing sales forces. They want to create a profitable entity that can compete on price against the hyperscalers.
Valuation Benchmark: The combined entity likely trades at private equity multiples. That is usually 4x to 6x Revenue. It reflects its status as a value player in a growth market.

CrowdStrike Acquires Onum: Controlling the Data Supply Chain

CrowdStrike acquired Onum in August 2025 for roughly $290 million.30

This highlights the value of the data pipeline.

The Problem: SIEM costs have ballooned because of the volume of data ingestion.
The Solution: Onum provides telemetry pipeline technology. It filters and enriches and reduces data before it hits the SIEM.
Valuation Implication: CrowdStrike can offer a lower TCO to customers by owning this technology. This removes the main friction point for SIEM adoption. This acquisition is accretive to CrowdStrike’s valuation because it protects the gross margins of their core Falcon LogScale product.

Strategic Drivers of Valuation: The Investor’s Scorecard

Institutional investors in Q4 2025 use a sophisticated scorecard to evaluate SIEM and SOAR companies. The black box of valuation can be broken down into specific operational metrics that drive premium multiples.

The Autonomous SOC Premium and Agentic AI

The most potent valuation driver in 2025 is the successful deployment of Agentic AI.

Definition: The market distinguishes between Co-pilots and Agents. Co-pilots help a human analyst work faster. Agents autonomously triage and investigate and remediate threats without human intervention.
Valuation Impact: Companies that can demonstrate Labor Displacement command significant pricing power. This means their software allows a Global 2000 enterprise to hire fewer Tier 1 SOC analysts. This outcome based value proposition is far stickier than simple software utility.
Metric: Investors track Mean Time to Respond and the percentage of autonomous resolutions. Platforms like Palo Alto Networks’ Cortex XSIAM and Torq market these metrics aggressively.33

The Shift from Ingest Pricing to Outcome Pricing

SIEMs were historically valued based on data ingestion volume. This model was flawed. It penalized customers for collecting more data. This led to visibility gaps.

2025 Trend: Valuations favor companies using Outcome Based Pricing or Endpoint Based Pricing.
Why it matters: Investors prefer pricing models that align with customer growth. CrowdStrike’s LogScale is a prime example. It offers unlimited logging to drive platform stickiness. This aligns the vendor’s revenue growth with the customer’s business growth.

Net Dollar Retention as the North Star

Net Dollar Retention remains the undisputed king in the SaaS valuation hierarchy.

Benchmark Framework:

Top Tier (Valuation >12x): NDR > 120%. The company grows 20% annually even without signing a single new customer. Examples are CrowdStrike and Datadog.
Mid Tier (Valuation 6x-10x): NDR 110%-120%. Healthy expansion but likely faces some churn or pricing pressure.
Low Tier (Valuation <5x): NDR < 105%. This signals a leaky bucket. New sales are merely replacing lost ARR. Rapid7 is an example.

SIEM Specifics: High NDR in the SIEM market indicates customers are adding more data sources and more users.

Data Gravity and the BYOS Threat

A critical risk factor is the rise of Bring Your Own Storage architectures.

The Trend: Enterprises are storing security logs in cheap cloud native data lakes like Snowflake or Databricks. They are moving away from expensive proprietary storage of SIEM vendors.
Valuation Consequence: SIEM vendors are forced to decouple their compute from their storage. Vendors that insist on proprietary storage see their gross margins compressed. Vendors that embrace the Data Lake architecture are being re-rated as modern data platforms. SentinelOne is doing this with its Singularity Data Lake.

Private Market Valuation Data & Venture Capital Dynamics

The public markets offer transparency. The private market in 2025 operates with higher variance. The Unicorn landscape reveals where venture capital is placing its bets.

The Unicorn Landscape: Private Market Benchmarks

Private Equity vs. Venture Capital Dynamics

There is a big difference in strategy between Venture Capital and Private Equity in the SIEM and SOAR space.

Venture Capital: VC activity has returned to the early stage. They focus on Series A and B rounds for AI native security startups. But VC funding has tightened for later stage companies. Investors are wary of funding growth at all costs unless there is a clear path to an IPO or exit within 12 to 18 months.
Private Equity: PE firms like Thoma Bravo and Francisco Partners are aggressively rolling up legacy vendors. They pay lower multiples. This is usually 4x to 7x Revenue. But they offer liquidity and operational discipline.

Case Study: Sumo Logic was taken private by Francisco Partners for $1.7 billion in 2023. That was roughly 5x revenue. This transaction set a benchmark for distressed cloud SIEM assets.40

The IPO Pipeline for 2026

The IPO window was largely shut in 2023 and 2024. It is showing signs of reopening for high quality assets in 2026.

Cato Networks: Cato is considered the top candidate for a 2026 IPO. It has a valuation exceeding $4.8 billion and over $300 million in ARR.41
Claroty: Claroty leads in Operational Technology security. It addresses the critical infrastructure protection mandate. It has a valuation of $3.5 billion.35
Rubrik: Rubrik has already gone public. It serves as a bellwether for data security valuations. It trades at a market cap of approximately $13.7 billion.42

Comparative Valuation: SIEM/SOAR vs. Adjacent Categories

SIEM and SOAR do not exist in a vacuum. You must compare it against adjacent cybersecurity categories to understand its value.

Analysis:

SIEM and SOAR sit in the middle of the pack. They are stickier than network security. It is harder to rip and replace them. But they have historically grown slower than the explosive Cloud Security category. Next-Gen SIEMs that position themselves as Security Data Lakes are being re-rated to match Cloud Security multiples. The market is saying that being a log collector is worth 4x. But being an AI-driven data platform is worth 15x.

Future Forecast: Market Projections (2026-2030)

Market Size Growth

Grand View Research projects the global SOAR market to reach $4.11 billion by 2030. This is a CAGR of 15.8%.43
IDC forecasts global security spending to hit $377 billion by 2028. AI security will grow to a $100 billion sub-segment.44

The Preemptive Shift

Gartner predicts that Preemptive Cybersecurity will account for 50% of all security spending by 2030.45

Impact: This shift threatens traditional Reactive SIEMs. If the system stops the attack before it generates a log, the value of log analytics goes down.
Strategic Pivot: This explains why CrowdStrike and Palo Alto Networks are moving Left into exposure management and Right into autonomous remediation. They are hedging against the commoditization of detection.

The Death of Ingest

We project that 70% of SIEM implementations will use a Bring Your Own Storage or Data Lake architecture by 2027.

Valuation Consequence: SIEM vendors will be valued on their analytics engine and automation capabilities. They will not be valued on storage margins. This could compress gross margins for legacy vendors who rely on storage markup.

Emerging Trends Affecting Valuation: The AI Factor

The Agentic SOC

The rise of the Autonomous SOC is the most disruptive trend.

Technology: AI agents can triage alerts and apply patches without human intervention.
Valuation Premium: Companies like Torq and Palo Alto Networks market this aggressively. The market pays a premium for automation because it addresses the skills shortage.
33

Data Pipeline Control

The acquisition of Onum by CrowdStrike and the rise of Cribl highlights a key trend. This is Control over data motion.

Insight: Owning the pipeline is becoming as valuable as the SIEM itself. It allows the vendor to be the gatekeeper of security data.
46

Founder’s Guide: Benchmarking for Valuation

Cybersecurity founders need to focus on specific metrics that align with the Agentic and Platform narratives in Q4 2025.

Actionable Advice for Founders:

Don’t Sell Better SIEM. Sell Less Work. Investors are tired of faster search. They want automated resolution. Frame your value proposition around labor displacement.
Optimize for Data Independence. Build your architecture to work with Snowflake and Databricks. Being Data Lake Native is a valuation multiplier.
Watch Your Burn Multiple. A Burn Multiple of less than 1.0 is good in 2025. Less than 0.5 is exceptional. Efficiency is the new growth.

Conclusion: The K-Shaped Future

The cybersecurity valuation environment is robust as we close Q4 2025. But it is highly selective. We are witnessing a definitive K-shaped future.

The Upper K (The Super Platforms): CrowdStrike, Palo Alto Networks, Datadog, and Google. These entities are consolidating the market. They leverage Data Gravity and Agentic AI to command multiples of 12x to 30x Revenue. They are viewed as Safe Havens for institutional capital.
The Lower K (The Point Solutions): Legacy SIEMs and standalone Vulnerability Management tools. These are trading at 3x to 5x Revenue. They face existential risk from platform consolidation. They are destined for Private Equity roll-ups.

The SIEM and SOAR market is not dying. It is mutating. It is evolving into the AI-Driven Security Data Platform. Valuation flows to those leading this mutation. The lesson of 2025 is clear for investors and founders. Value is no longer just about collecting data. It is about the autonomous action taken upon that data.