Cybersecurity Valuations: Q3 2026
Cybersecurity's Q3 2026 median of 6.6x EV/Revenue describes almost none of the sector. Windsor Drake's twelve company comparable set, computed from closing prices of 19 August 2026 and company revenue guidance, splits into three constituents at a 25.5x median and nine at 6.3x, with nothing between 8.4x and 13.4x. Introduces The Absorption Line: the market prices whether a consolidating customer adds a vendor's budget line or removes it. CrowdStrike and Zscaler post near identical growth and cash margins, and Zscaler holds the higher Rule of 40 score, yet CrowdStrike trades at a 304% premium.
- Sector
- Cybersecurity
- Focus
- Valuations
- Published
- August 20, 2026
- Length
- 24 slides
- Reading time
- 13 minutes
Slide deck
24-slide deck. Desktop readers can page through the embedded viewer below. Mobile readers can open the direct PDF link.
Open slide deck PDF Key findings
- The twelve company listed cybersecurity set carries a median 6.6x EV/Revenue, interquartile range 5.3x to 9.7x, full range 1.2x to 33.9x.
- Three constituents clear a 25.5x median and nine clear 6.3x, a gap of 4.0 times, with no constituent between 8.4x and 13.4x.
- Rule of 40 explains only about one third of multiple variance across the set, and revenue growth explains less than one fifth.
- CrowdStrike and Zscaler grow at 23.2% and 24.6% on cash margins of 29.6% and 30.4%, and CrowdStrike trades at a 304% premium.
- Fortinet holds the highest Rule of 40 score in the set at 60.2 and trades at 13.4x, less than half CrowdStrike's 33.9x.
- Total cyber budgets grow at roughly 2.5% a year while AI's share rises from about 4% to 15%, implying the non-AI pool contracts about 1.6% a year.
- No cybersecurity company of scale priced a US IPO in 2026 through 20 August, in a half-year when 65 US listings raised about $114.2B.
- Only 2 of 505 Windsor Drake index records are classified cybersecurity and neither discloses a revenue multiple, so the index supplies no sector benchmark here.
- Accenture's June 2026 assembly of Dragos, runZero and NetRise implies roughly 20 times combined recurring revenue of about $208M.
Methodology
Framework: The Absorption Line. Every multiple is Windsor Drake's own computation from primary market data: enterprise value equals market capitalisation plus gross debt less cash and short-term investments, using closing prices of 19 August 2026, share counts and balance sheets from the most recent filings, and each company's own current-fiscal-year revenue guidance as the denominator. Sixteen companies screened, twelve included; four excluded because security is not the majority of reported revenue, each named with its reason. CrowdStrike is adjusted for its four for one forward split of 2 July 2026. The firm's transaction index holds only two cybersecurity records, neither with a disclosed multiple, and supplies no benchmark in this report.
Frequently asked questions
What is the median cybersecurity valuation multiple in Q3 2026?
Windsor Drake's twelve company listed comparable set carries a median of 6.6x enterprise value to current-year revenue, computed from closing prices of 19 August 2026. The interquartile range is 5.3x to 9.7x and the full range runs from 1.2x to 33.9x. The median is a poor guide to any individual business because the distribution is bimodal rather than clustered.
Why do two cybersecurity companies with the same financials trade four times apart?
Because the market is pricing position in the customer's consolidation, not the income statement. CrowdStrike and Zscaler post growth of 23.2% and 24.6% and free cash flow margins of 29.6% and 30.4%. CrowdStrike trades at 33.9x and Zscaler at 8.4x. The difference is whether a consolidating security buyer adds spend to the vendor or removes it.
Does a high Rule of 40 score raise a cybersecurity valuation?
It raises the floor and does not set the price. Across the set, Rule of 40 explains about a third of the variance in multiple. Fortinet holds the highest score at 60.2 and trades at 13.4x. Six constituents score above 50 and their multiples span 8.2x to 33.9x. Treat the score as a qualifying threshold rather than a valuation driver.
Is the cybersecurity megadeal cycle over?
The three transactions that defined it have completed and nothing of that scale has replaced them. Google closed Wiz in March 2026 and Palo Alto Networks closed CyberArk in February 2026. Since April 2026 only one announced cybersecurity deal has exceeded $500M. Deal count is at or near a record while disclosed value is sharply lower, which is a market buying capability rather than merging platforms.
Can a cybersecurity company still go public in 2026?
Not on the current evidence. No cybersecurity company has priced an initial public offering in 2026 through 20 August, in a year when 65 US listings raised about $114.2B in the first half alone. The last cybersecurity pricing was Netskope in September 2025. Planning around a listing exit in this sector currently means planning around an event with no 2026 precedent.
Who is buying cybersecurity companies now, and what are they paying for?
Platform incumbents, systems integrators and mid-size security vendors buying adjacent capability. Accenture's June 2026 assembly of Dragos, runZero and NetRise at a combined $4.175B enterprise value against roughly $208M of combined annual recurring revenue is the template: three complementary assets bought together to build a position rather than one asset bought for its revenue.
What does the rate path mean for cybersecurity valuations?
It has stopped helping. The FOMC held at 3.50% to 3.75% on 29 July 2026 on a nine to three vote in which all three dissenters wanted a rise, and the June 2026 projections put the median 2026 dot above the current range midpoint. A market discounting a possible increase compresses the multiples of long duration, sub-scale growers before it touches anything else.
Companies covered
Public and private companies referenced in this report.
Download the deliverables
If you are evaluating a sale
Windsor Drake is a sell-side only M&A advisory firm for founder-led software, fintech, and technology companies with enterprise values between $5 million and $300 million. This research comes from the same desk that runs our sale processes. If you are weighing an exit in this market, a confidential valuation is the place to start: no obligation, senior attention, and a view grounded in the transactions this report tracks.
Cite this report
Cybersecurity Valuations: Q3 2026. Windsor Drake Market Intelligence, 2026. windsordrake.com/market-intelligence/reports/cybersecurity-valuations-q3-2026. Windsor Drake Market Intelligence data is free to use with attribution to Windsor Drake (windsordrake.com).