Cybersecurity
Spending has moved from a line item for large enterprises to a requirement for organisations of every size — and from perimeter firewalls to cloud security, DevSecOps, XDR and managed detection. India is the fastest-growing market inside the fastest-growing region.
The growth is not in the category, it is in the sub-segments. Cloud security, DevSecOps and MDR compound far above the sector average, and services are consolidating fast — which makes M&A a live part of any thesis here.
Where the money is, and where it is growing.
By geography
- Americas · ~41%The largest market, growing ~10.7%. Western Europe follows at ~32% and ~9.8%.
- APAC + Middle East · ~21%The fastest-growing region, ~13.6–13.9%. China, Japan and Australia are the main contributors.
- IndiaThe fastest-growing country, at roughly 18%. High-potential segments: identity and access management, network security, email security.
- Africa & others · ~6%Low investment historically; 5G rollout is expected to change that.
By sub-segment — the growth is uneven
| Segment | From | To |
|---|---|---|
| Cloud security | $33bn (2022) | $106bn (2029) |
| DevSecOps | $3bn (2020) | $23bn (2025) |
| Endpoint / ZTNA | $13bn (2021) | $26bn (2025) |
| MDR | $985mn (2022) | $2,358mn (2027) |
Sub-segment CAGRs cluster in the 12–15% band: security operations ~15.3%, insider threat detection ~14.0%, application security ~13.9%, IAM ~12.0%.
Services outsourcing, and a consolidating market.
Why security gets outsourced. Around 55% of IT decision-makers cite cost efficiency as a critical driver — partnering frees budget for other priorities. Beyond cost, providers bring cross-platform experience and depth that in-house SecOps teams struggle to match as attacks grow more sophisticated. Within services, managed security services are growing faster than professional services.
Talent is the constraint and the arbitrage. India and the US together supplied roughly 32% of global cybersecurity talent in 2018. Because talent is not geographically concentrated and is genuinely scarce, projects get staffed wherever people are available — which is precisely the structural advantage offshore IT services players are building around, including partnerships with universities to grow the pipeline.
Delivery is shifting to hosted and cloud-based models. Multi-cloud, verticalisation and API-based monitoring are redefining MDR. XDR capability has become a competitive differentiator — around 73% of organisations consider it crucial when selecting an MDR provider.
The M&A market
- Deal volume263 transactions valued at $119.8bn — roughly 70% software, 30% services.
- Within servicesManaged services account for ~58% of services deals; professional services ~43%.
- MomentumCybersecurity services deals rose roughly fivefold between 2018 and 2021.
- GeographyThe USA and Europe account for ~88% of global deal volume.
- BuyersLarge IT services and consulting firms — Accenture, Deloitte, Capgemini, KPMG — alongside private equity, whose participation has broadened the buyer universe.
- FocusAcquiring capability on Microsoft, Palo Alto and Fortinet platforms, with emphasis on specialised BFSI and healthcare assets.
Recurring revenue, platform depth, and talent.
Managed & recurring
Managed security services grow faster than professional services and carry annuity economics. The share of revenue that recurs is the quality-of-earnings measure here.
Platform & capability depth
XDR capability wins competitive bids. Certified depth on the dominant platforms — and vertical specialisation in BFSI or healthcare — is exactly what acquirers pay for.
Talent engine
Scarce, globally distributed talent is the binding constraint on growth. The ability to recruit, train and retain — and to bill that talent efficiently — is the real capacity limit.
What to answer before underwriting.
- →Revenue mix. Product versus services; within services, managed versus professional. Managed is the faster-growing, higher-quality pool.
- →Sub-segment exposure. Cloud security, DevSecOps, MDR, IAM, endpoint. Which of the high-growth pockets does the company actually serve?
- →Recurring revenue share. Subscription and contracted revenue versus one-time project work, and contract tenure.
- →Platform certifications. Depth on Microsoft, Palo Alto, Fortinet — the capability set acquirers value and clients screen for.
- →XDR and MDR capability. Given ~73% of buyers weight XDR heavily, is this a genuine capability or a marketing claim?
- →Vertical specialisation. BFSI and healthcare command premium economics and are the focus of deal activity.
- →Talent metrics. Headcount, attrition, utilisation and cost per billable head — the actual constraint on scaling.
- →Geographic mix. Exposure to the Americas and Europe (88% of deal value, largest spend pools) versus a domestic-only book.
- →Client concentration and retention. Net revenue retention matters more than logo count in a subscription model.
- →AI positioning. Post-dating this source: how is generative AI changing both the threat surface and the company's own tooling and pricing?
What to monitor, quarter by quarter.
| KPI | Calculation / source | Benchmark or read-through |
|---|---|---|
| Recurring revenue % | Subscription + managed ÷ total revenue | The core quality-of-earnings metric in security services |
| Net revenue retention | Revenue from existing clients YoY | Above 100% means the base expands without new logos |
| Managed vs professional mix | Services revenue split | Managed grows faster and carries annuity economics |
| Sub-segment revenue mix | Cloud / DevSecOps / MDR / IAM / endpoint | Weighting toward the 13–15% CAGR pockets, not the sector average |
| Contract tenure & backlog | Weighted average contract length; order book | Longer tenure converts a services book into an annuity |
| Billable utilisation | Billable hours ÷ available hours | The lever on a people-based margin structure |
| Attrition | Departures ÷ average headcount | Scarce talent — attrition directly caps deliverable capacity |
| Revenue per employee | Revenue ÷ headcount | Tests whether growth is productivity or just hiring |
| Gross margin by line | Product vs managed vs professional | Managed should carry structurally better margin at scale |
| Client concentration | Revenue from top 5 / top 10 | Enterprise contracts are large and slow to replace |
| Geographic mix | Americas / Europe / APAC / India | Currency, pricing and growth all differ materially by region |
| Certification depth | Certified engineers by platform | The capability moat, and what acquirers actually pay for |
| Sales & marketing efficiency | S&M spend ÷ net new ARR | Whether growth is being bought or earned |
How the thesis breaks.
- !Managed services without healthy growth. The source is explicit that managed-services players not delivering healthy growth are unattractive — scale alone does not make the model work.
- !Talent scarcity as a growth cap. A people-based model cannot outgrow its ability to hire and retain. High attrition is an immediate ceiling on revenue.
- !Platform dependence. Deep specialisation on one vendor's stack is a moat until that vendor changes its partner economics or competes directly.
- !Hyperscaler and vendor encroachment. Native security tooling bundled into cloud platforms erodes the addressable market for standalone providers.
- !Technology obsolescence. Capability sets move quickly — XDR became a bid requirement in a few years, and AI-driven tooling is doing the same now.
- !Project-heavy revenue. A book weighted to one-time professional services has no annuity and re-rates poorly against subscription peers.
- !Fast-moving sizing. Segment forecasts in this category are revised frequently. Re-base to current actuals before underwriting against any published projection.
The figures, and where they stand.
| Metric | Value | Note | Basis |
|---|---|---|---|
| Regional share — Americas | ~41% | CAGR ~10.7% (2020–25) | 2020 |
| Regional share — Europe | ~32% | CAGR ~9.8% | 2020 |
| Regional share — APAC + ME | ~21% | CAGR ~13.6–13.9% — fastest region | 2020 |
| India growth | ~18% | Fastest-growing country; 2020–25 CAGR | 2020–25E |
| Cloud security | $33bn → $106bn | 2022 to 2029 | 2029E |
| DevSecOps | $3bn → $23bn | 2020 to 2025 | 2025E |
| Endpoint / ZTNA | $13bn → $26bn | 2021 to 2025 | 2025E |
| MDR | $985mn → $2,358mn | 2022 to 2027 | 2027E |
| Sub-segment CAGRs | 12–15% | SecOps ~15.3%, app security ~13.9%, IAM ~12.0% | Forecast |
| Average cost of a breach | $4.4mn | Up from $3.9mn in 2020; worst in healthcare and financial services | 2022 |
| IoT share of devices | ~75% | Expanding the attack surface | By 2030 |
| Outsourcing driver | ~55% | Of IT decision-makers cite cost efficiency | Survey |
| XDR as a selection factor | ~73% | Of organisations, when choosing an MDR provider | Survey |
| ZTNA adoption intent | ~80% | Planning implementation within 12 months | Survey |
| Global talent supply | ~32% | India and US combined | 2018 |
| M&A volume and value | 263 deals / $119.8bn | ~70% software, ~30% services | 2021–22 |
| Managed share of services deals | ~58% | Services deals rose ~5× from 2018 to 2021 | 2021 |
| US + Europe share of deals | ~88% | Of global deal volume | 2021–22 |