From seller notes tied to client retention to earnouts based on EBITDA targets, here is how buyers and sellers structure acquisitions of cybersecurity firms with $1M–$5M in revenue.
Cybersecurity consulting acquisitions in the lower middle market typically carry valuations of 4x–7x EBITDA, driven by revenue quality, team certification depth, and the percentage of recurring retainer or managed security service revenue in the mix. Because these businesses often carry meaningful key-man risk — where the founder holds client relationships, certifications, and institutional knowledge — deal structures almost always include mechanisms to keep the seller engaged post-close and protect the buyer if revenue erodes. The three most common structures are cash at close with a seller note tied to client retention, earnouts contingent on post-close EBITDA or revenue performance, and equity rollovers used in private equity-backed roll-up scenarios. SBA 7(a) financing is available and frequently used for individual buyers, provided the business meets underwriting thresholds around EBITDA coverage and contract transferability. Understanding which structure fits your situation — as buyer or seller — depends heavily on revenue mix, client contract terms, team depth, and whether a change-of-control clause exists in key client agreements.
Find Cybersecurity Consulting Businesses For SaleCash at Close with Seller Note
The buyer pays the majority of the purchase price at closing in cash, often funded through SBA 7(a) debt or equity, with 10–20% of the total price held back in the form of a seller note. The seller note is typically repaid over 12–24 months and is conditioned on client retention thresholds — for example, 85–90% of trailing twelve-month recurring retainer revenue remaining with the business after the transition. This structure is especially common in SBA-financed deals where lenders require the seller to carry a note as a signal of confidence in the business.
Pros
Cons
Best for: Individual buyers using SBA financing to acquire a cybersecurity firm where the founder is transitioning out over 12–24 months and retainer revenue concentration is manageable.
Earnout Structure
A portion of the purchase price — typically 20–30% — is deferred and paid only if the business hits defined financial targets after closing. In cybersecurity consulting deals, earnouts are most commonly tied to EBITDA or total revenue performance over a two-year period. Earnouts are used when there is a gap between what a seller believes the business is worth based on pipeline or projected growth and what a buyer is willing to pay based on verified historical performance. They are also used when revenue is concentrated in a small number of clients or when a significant portion of revenue is project-based rather than recurring.
Pros
Cons
Best for: Deals where the seller is projecting significant near-term growth from a government contract pipeline, a new vCISO service line, or a pending CMMC compliance engagement that a buyer is unwilling to pay for upfront.
Equity Rollover with Private Equity Sponsor
Common in PE-backed roll-up acquisitions, the founder or owner retains 15–25% equity in the acquiring platform or newly formed entity in exchange for a portion of the purchase price. The founder receives a meaningful cash payment at close — the first bite of the apple — while maintaining upside participation in the platform's future exit. This structure is designed to keep technically credentialed founders engaged as the platform scales, which is critical in cybersecurity where client trust, security clearances, and CISSP or CISM credentials are attached to individuals.
Pros
Cons
Best for: Experienced cybersecurity founders selling to a PE-backed IT services platform executing a roll-up strategy, particularly those with government clearances, CMMC expertise, or a strong team that makes them a platform-level asset rather than a bolt-on acquisition.
SBA-Financed Individual Buyer Acquiring a Compliance-Focused Cybersecurity Firm
$3,200,000
$2,560,000 SBA 7(a) loan at close (80%), $480,000 buyer equity injection (15%), $160,000 seller note (5%) tied to 85% client retention over 18 months
Seller note bears 6% interest and is forgiven proportionally if retainer revenue drops below 85% of trailing twelve-month baseline due to client-initiated terminations. Seller agrees to a 24-month consulting transition, 3-year non-compete within the firm's primary service geographies, and transfers all client contracts with change-of-control consents obtained prior to close. Business has $640,000 EBITDA, $1.8M in recurring retainer revenue out of $2.8M total, and a team of four CISSP-certified consultants who maintain direct client relationships independent of the founder.
Strategic Acquirer Buying a Penetration Testing Firm with Project-Heavy Revenue
$2,400,000
$1,680,000 cash at close (70%), $720,000 earnout over 24 months contingent on achieving $1.2M EBITDA cumulatively across Year 1 and Year 2 post-close
Earnout measured on EBITDA using pre-close accounting policies with a carve-out excluding any integration costs charged by the acquirer. Seller remains as Director of Offensive Security for 24 months at market compensation. Non-compete applies for 3 years in the geographic market and service lines covered at time of close. Earnout is accelerated in full if the business is sold or merged into another platform within the earnout period. Business has $480,000 trailing EBITDA with 55% project-based penetration testing revenue and a growing managed detection and response retainer base representing $420,000 in annual recurring revenue.
PE Roll-Up Platform Acquiring a vCISO and Healthcare Compliance Firm
$5,600,000
$4,200,000 cash at close (75%), $1,400,000 equity rollover (25%) representing a 12% ownership stake in the acquiring cybersecurity services platform
Rollover equity is subject to standard PE terms including drag-along rights triggered on a majority sponsor exit, tag-along rights protecting the founder on any partial sale, and a 4-year vesting schedule with a 1-year cliff tied to continued employment. Founder joins the platform's executive team as Chief Security Officer. Business generates $800,000 EBITDA on $3.2M revenue, with 68% of revenue from multi-year HIPAA compliance retainers across 22 healthcare clients. No single client exceeds 14% of revenue. Three staff hold CISM or CISSP certifications and maintain independent client relationships, significantly reducing key-man risk.
Find Cybersecurity Consulting Businesses For Sale
Pre-screened targets ready for your deal structure — free to join.
Cybersecurity consulting firms with $1M–$5M in revenue generally sell for 4x–7x EBITDA. The range is wide because revenue quality matters enormously. A firm generating 60–70% of revenue from multi-year retainer contracts with diversified clients and a team of three or more independently certified consultants will command multiples at the high end of that range. A firm dominated by one-time penetration testing projects, with the founder holding all client relationships personally, will trade at 4x or below — if it trades at all — because buyers must price in the risk of revenue erosion post-close.
Yes. Cybersecurity consulting firms are eligible for SBA 7(a) financing, and individual buyers frequently use SBA loans to fund 75–85% of the purchase price. Lenders will scrutinize the quality of recurring revenue, the transferability of client contracts, and whether the business can service debt without the founder in a billable role. Businesses where the founder accounts for more than 30–40% of billable revenue will face underwriting challenges, and lenders will typically require a seller note of 10–20% as a condition of approval to ensure the seller has skin in the game during the transition period.
Earnouts in cybersecurity deals are typically structured over 24 months and tied to EBITDA or total revenue targets. The most common source of disputes arises when the buyer makes post-close decisions — adding corporate overhead, increasing salaries, changing pricing, or redirecting business development resources — that reduce the EBITDA against which the earnout is measured. To protect against this, sellers should negotiate that earnout EBITDA is calculated using pre-close cost structures with explicit carve-outs for any integration-related expenses charged by the acquirer. Having experienced M&A counsel draft the earnout mechanics before signing a letter of intent is essential.
Many professional services contracts, including cybersecurity retainer agreements, contain change-of-control clauses that give the client the right to terminate the contract if the firm is sold without their consent. Before closing, buyers should require the seller to identify all contracts with change-of-control provisions and obtain written consents or waivers from those clients. This is especially critical for government clients subject to CMMC or FedRAMP requirements, where contract novation may require agency approval. Failing to address this pre-close can result in immediate post-closing revenue loss that triggers seller note forgiveness disputes or earnout underperformance.
The most effective steps a seller can take are redistributing client relationship ownership to other team members before going to market, ensuring that two or more staff independently hold CISSP, CISM, or CISM certifications and are recognized by name in client contracts, and documenting standardized delivery methodologies for core services like penetration testing, compliance audits, and incident response. Buyers pay premium multiples for businesses where the founder can step back without client revenue collapsing. If the founder is the only relationship holder, every sophisticated buyer will price that risk into the deal structure through lower upfront cash and larger contingent components.
An equity rollover means the seller retains a minority ownership stake — typically 15–25% — in the acquiring platform or entity rather than receiving 100% cash at close. It is most common in private equity-backed roll-up acquisitions. For cybersecurity founders with strong vertically specialized businesses, government clearances, or a platform-quality team, a rollover can be a compelling wealth creation strategy if the PE sponsor has a credible path to a larger exit. The tradeoff is accepting illiquid equity in an entity you no longer control. Sellers should evaluate the sponsor's track record, the platform's existing revenue base, the equity terms including drag-along and anti-dilution provisions, and whether the projected second exit multiple justifies the forgone immediate liquidity.
More Cybersecurity Consulting Guides
More Deal Structure Guides
Find the right target, structure the deal, and close with confidence.
Create your free accountNo credit card required
For Buyers
For Sellers