Home / Selected Transactions / Project Talon
Selected Transaction · Cybersecurity

A managed detection and response provider, sold to a platform consolidator

The first offer buried a third of its value in a three-year earnout. Six months of pre-market work removed the dependence; it closed at $17M to $20M, ninety percent cash.

Request a Confidential Valuation
90%
Cash at close
$17M–$20M
Final consideration
0 yrs
Earnout, down from three
Transaction summary
Sector
Cybersecurity · Managed Detection & Response
Enterprise value
$17M – $20M
Structure
90% cash at close · earnout removed
Process
11 buyers under NDA
Cash in hand at close
First offer
$10M cash
Final deal
$15M–$18M cash
The first offer's $16M headline carried only $10M at close. The final deal carried $15M to $18M, with no earnout.
The engagement

The situation

The business ran on the founder's calendar. He was the lead architect, the closer on every enterprise renewal, and the first call for three of the five largest clients. The first acquirer priced that dependence directly: a $16M headline with $6M locked in a three-year earnout that required him to stay, hit targets he would no longer control, and report to an integration executive. The buyer was not pricing the company. It was pricing its fear that the company was him.

What we did

He had planned to be out within a year, so we started inside the business, not in the market. Over the six months before launch, the second engineer took over architecture publicly, client relationships were transitioned in pairs, the top five accounts were renewed on terms that did not name the founder, and a sales lead was hired and given two quarters of closed business to point to. When the process launched, the materials led with the management layer rather than hiding it. Eleven buyers came under NDA.

The outcome

The winning bid was $17M to $20M with ninety percent cash at close and a single one-year holdback tied to retention the team, not the founder, would deliver. The earnout was not negotiated down. It was engineered out of the deal before the deal existed. When the buyer's fear is the founder, the fix is not better terms. It is a business that demonstrably runs without him.

“The first buyer wasn't buying the company. It was buying me, for three years.”
Founder · representative
How the process ran
Pre-market · 6 months
Architecture, top accounts, and new sales were moved off the founder's name.
Positioning
Materials led with the management layer rather than hiding the dependence.
Outreach
11 buyers under NDA, a mix of platform consolidators and strategics.
Discipline
A late attempt to reintroduce a two-year earnout was refused; the bidder re-bid without it.
Close
$17M to $20M, 90% cash, a single one-year retention holdback.
What this transaction shows

When the buyer's fear is the founder, the fix is not a better earnout. It is a business that demonstrably runs without him before the process begins.

Details that could identify the company have been altered or withheld. Transaction details are representative of engagements of this type. Quotes are representative. References available to qualified parties under non-disclosure agreement.

Considering a sale of your company?

Request a confidential, no-obligation read on where your business would price today and which buyers are active in your market. Every inquiry is strictly confidential.

Market Intelligence

Latest Windsor Drake research

All research →
AI in Cybersecurity Valuations: Q2 2026Read the report →HR & Workforce SaaS Valuations: Q2 2026Read the report →AI Workflow Automation Valuations: Q2 2026Read the report →