Cyber Security Companies as Acquisition Targets

Robert, one of my biggest concerns would be technology and substitution risk. Automated security solutions are getting better and increasingly capable of replacing some of the functions traditionally served by MSSPs (even things like compliance). Would maybe take a close look at the tech setup of the companies' customers. If they have lots of legacy/on prem stuff, potentially more difficult to automate out, but hard to say without knowing more about the companies you're evaluating.

From the description of the targets you are working on, it sounds more like an ICT company that looks after cyber security compliance outsourcing for its clients. Do these targets have their own product? Do they distribute any well-known cyber security products + service or are they just an outsourced “body-shop” that replaces clients’ IT security department. The valuation and the DD process for these three categories are very different. If the company has own or distribute 3rd party products - that’s good, switching is unlikely and very costly. If it provides some expertise and capacity, then the growth is more difficult, more dependent on how many people you employ and the cost of an average cyber security professional has been increasing rapidly). Additionally, do the employees have knowledge in cyber security for cloud environment, process automation and mobile device management. If not, such a legacy will need to change soon, but can be very costly to do so.