SIEM/SOAR Valuations: Q1 2026
Q1 2026 SIEM/SOAR valuations are defined by an extreme bifurcation: AI-native platforms anchored by CrowdStrike at roughly 24.7x EV/Revenue sit more than 20x above legacy transitioners compressed to 1.7x to 5.0x, with Rapid7 at 1.7x and near-zero growth establishing the floor and signaling credible PE take-private candidacy against a backdrop of over $1T in dry powder. Thoma Bravo's $5.3B Darktrace acquisition at 8.1x EV/Revenue, the LogRhythm-Exabeam consolidation, and Palo Alto Networks' $500M absorption of IBM QRadar SaaS collectively mark the accelerating sunset of standalone legacy SIEM. The report covers public company multiples, the NRR and AI multiplier effects on valuation, the $11.3B SIEM/TDIR market sizing, and the M&A and take-private dynamics expected to define the sector through the remainder of 2026.
- Sector
- Cybersecurity
- Focus
- Valuations
- Published
- January 15, 2026
- Length
- 28 slides
- Reading time
- 23 minutes
Key findings
- CrowdStrike trades at ~24.7x EV/Revenue in January 2026, anchoring the AI-native platform benchmark with a $121B market cap, 22% YoY revenue growth, and a Rule of X score of 82%.
- The 2026 SIEM/SOAR market is bifurcated: AI-native platforms command 20x+ EV/Revenue while legacy transitioners are compressed to 1.7x–5.0x EV/Revenue.
- Global cybersecurity spend is forecast at $522B in 2026 (~15% CAGR), with the SIEM/TDIR segment at $11.3B growing at 14.5% CAGR.
- Rapid7 trades at 1.7x EV/Revenue with ~1% revenue growth and a Rule of 40 of -4%, establishing the valuation floor for mid-cap SIEM vendors and signaling PE take-private candidacy.
- Thoma Bravo acquired Darktrace for $5.3B at 8.1x EV/Revenue and 34x EBITDA, and merged LogRhythm and Exabeam in a deal implying ~$2.5B+ in value.
- Mastercard acquired Recorded Future for $2.65B at ~6.5x EV/Revenue, validating the data-layer thesis as a strategic control point commanding premium multiples.
- SaaS companies with NRR ≥ 120% command an EV/Revenue multiple of 11.7x—a 109% premium over peers, per the SEG SaaS Index.
- AI-centric Cloud 100 companies trade at ~24x EV/Revenue vs. ~19x for non-AI peers, per Bessemer Cloud 100 Benchmarks, illustrating the AI multiplier effect.
- M&A volume is projected to grow +20% in 2026 following a +32% recovery in 2025, with PE dry powder exceeding $1T supporting take-privates of sub-5x EV/Revenue cyber assets.
- Palo Alto Networks acquired IBM QRadar SaaS for $500M, signaling the sunset of legacy SIEM and accelerating customer migration to unified XDR platforms.
Methodology
This report synthesizes public company valuation data sourced from GuruFocus and Multiples.vc (EV/Revenue, EV/EBITDA, and forward P/E multiples as of January 2026), market-sizing estimates from Cybersecurity Ventures, Gartner, and IDC, SaaS benchmarks from the SEG 2025 Annual SaaS Report and Bessemer Cloud 100, and M&A transaction data from PitchBook, SecurityWeek, PE Hub, CRN, and Thoma Bravo press releases. Macroeconomic context draws on Morgan Stanley's 2026 Investment Outlook and Aranca IT M&A Deal Trends (Q2 2025). Windsor Drake applied proprietary sector calibration to synthesize valuation tiers, benchmark cohort ranges, and the AI-native versus legacy transitioner framework presented throughout the report.
Frequently asked questions
What EV/Revenue multiples are SIEM and SOAR companies trading at in Q1 2026?
The market is bifurcated into two distinct tiers. AI-native platforms command 20x+ EV/Revenue—CrowdStrike benchmarks at ~24.7x—while legacy transitioners are compressed to 1.7x–5.0x EV/Revenue. Tier 2 efficient growers such as Datadog (14.5x) and Zscaler (12.2x) occupy the middle range, and Tier 3 challengers SentinelOne (4.7x) and Elastic (4.3x) reflect execution discounts.
Who is buying SIEM and SOAR companies right now, and at what valuations?
Private equity—primarily Thoma Bravo and Francisco Partners—is the most active buyer class, arbitraging the spread between depressed public multiples and intrinsic value. Thoma Bravo took Darktrace private at $5.3B (8.1x EV/Revenue) and merged LogRhythm and Exabeam at an implied ~$2.5B+. Francisco Partners acquired Sumo Logic for $1.7B at ~5.6x EV/Revenue. Strategic buyers are also active: Mastercard paid $2.65B for Recorded Future and Palo Alto Networks acquired IBM QRadar SaaS for $500M.
What financial metrics does a SIEM or security software company need to achieve a premium valuation in 2026?
Investors require revenue growth above 30% YoY, net revenue retention of 120% or higher, gross margins of 75%+, and a Rule of 40 score above 40% to qualify for double-digit EV/Revenue multiples. Companies that also demonstrate agentic AI architecture and measurable SOC OPEX reduction—rather than retrofitted GenAI features—qualify for the scarcity-premium tier of 20x+ EV/Revenue.
How does the AI-native vs. legacy distinction affect SIEM valuations in 2026?
AI-native platforms featuring multiagent autonomous investigation and a security data fabric command scarcity premiums of 12x–20x+ EV/Revenue. Legacy tools with bolted-on GenAI overlays and static playbooks are penalized with 1x–5x EV/Revenue multiples due to technical debt, on-premise revenue risk, and inability to demonstrate measurable SOC OPEX reduction.
How are Microsoft Sentinel and Google Security Operations impacting SIEM competitor valuations?
Microsoft Sentinel, bundled with E5 licensing and Azure consumption credits, is commoditizing log ingestion economics and pressuring pure-play SIEM vendors on storage pricing. Google Security Operations (Chronicle) was named a 2025 Gartner Magic Quadrant Leader and raises the bar on query performance and scale. Pure-plays such as Splunk (Cisco) and Elastic must compete on analytics efficacy and open data portability rather than ingestion price.
What is the M&A outlook for cybersecurity and SIEM deals in 2026?
Global M&A volume is projected to grow +20% in 2026 following a +32% recovery in 2025, supported by over $1T in PE dry powder and improving credit availability. Take-private activity is focused on mid-cap cyber assets trading below 5x EV/Revenue, where PE sponsors see valuation arbitrage potential through cost discipline, MSSP channel optimization, and TDIR repositioning.
What is driving the platform consolidation premium in SIEM and security operations software?
Approximately 75% of enterprises are actively rationalizing their security stacks, concentrating budget with unified SIEM + SOAR + EDR + Identity platforms that command 12x–20x+ EV/Revenue versus 2x–6x for single-point tools. Palo Alto Networks (Cortex) and CrowdStrike (Falcon) are cited as the primary beneficiaries of this consolidation trend, which is further reinforced by hyperscaler pricing pressure on standalone SIEMs.
Companies covered
Public and private companies referenced in this report.