I spent years building a managed services business and never once thought of cybersecurity as a standalone value driver. It was part of the stack, bundled in, occasionally upsold. Something the pre-sales team mentioned on slide 14 of a deck no one read past slide 6.
That was wrong. And the market has moved on without that version of thinking.
Cyber MSPs now command 12.5x EBITDA. Generalist MSPs sit at 10.8x. That's not a rounding error. On a £5m EBITDA business, that gap is worth £8.5m at exit. For private equity firms running three-to-five year hold periods, that kind of multiple expansion doesn't come from a new CRM or a rebrand. It comes from structural positioning in a market that buyers are falling over themselves to get into.
The Numbers Behind the Premium
The UK cyber sector hit £13.2bn in revenue last year, growing at 12% year-on-year. Managed security services specifically are on a 9.38% CAGR trajectory. MDR and XDR, the detection and response capabilities that enterprise buyers now treat as table stakes, are growing at 18% against an MSP sector average of 9.7%.
There were 64 UK cyber deals in 2025 alone. That's more than one a week. And when Thoma Bravo took Darktrace private at $5.3bn, that was 34x EBITDA. You don't have to squint to see where the capital is flowing.
But here's the thing most operators miss: this isn't just a growth story. It's a regulatory story. And regulatory stories create the kind of recurring, non-discretionary demand that private equity buyers pay a premium for.
Regulation Is About to Change the Maths
The UK Cyber Security and Resilience Bill will bring 900 to 1,100 MSPs into regulated scope for the first time. Read that again. Up to 1,100 businesses that currently treat security as a nice-to-have will soon be legally required to meet defined standards.
Layer on NIS2 and DORA, both creating mandatory compliance demand across financial services and critical infrastructure, and you've got a market where "we should probably do something about security" becomes "our regulator says we must, and our insurer agrees."
That's not a sales conversation. That's an inbound queue.
For MSPs already delivering managed security, this is a structural tailwind. For those who aren't, it's a structural risk. The buyers in your market are about to be told, by law, to spend money on exactly what you should be selling. If you're not positioned to capture that, someone else will be.
The vCISO Arbitrage
One of the most underappreciated angles in this market is the virtual CISO model.
A full-time CISO costs around £250k a year. A vCISO engagement runs between £32k and £86k. That's 7.9x cheaper for the customer, and for the MSP delivering it, it's high-margin recurring revenue attached to a senior advisory relationship.
This isn't about replacing a CISO with a cheaper version. It's about giving mid-market businesses access to strategic security leadership they couldn't otherwise justify. Most companies with 200 to 500 employees don't need a full-time CISO. They need 2 days a month of someone who knows what they're doing, backed by a SOC that responds when something goes wrong.
For private equity-backed MSPs, this model does three things at once: it deepens customer relationships, it increases wallet share, and it creates the kind of sticky, advisory-led revenue that acquirers love. It's also a credible entry point for MSPs building out a security practice from scratch, because it doesn't require a £2m SOC investment on day one.
Consolidation Is Already Happening
The specialists are buying each other as well as being bought. SecurityWeek counted 426 cybersecurity M&A deals announced worldwide in 2025, and 125 of them involved a managed security provider.
If you're a private equity firm looking at cyber bolt-ons, that's who you're bidding against. The best assets are being picked off now, and the regulatory tailwinds haven't even fully kicked in yet. Waiting 18 months means paying more for fewer options.
If you're an MSP operator thinking about building versus buying a security practice, the calculus is similar. Organic build takes 18 to 24 months to reach credible scale. Acquisition gets you there faster, but the multiples reflect it. The smart play is often a hybrid: acquire a small, specialist cyber firm for its talent and SOC capability, then cross-sell into your existing base. That's where the real value creation happens.
What Actually Drives the Premium
Having sat on both sides of the due diligence table, I can tell you that buyers aren't paying 12.5x just because the word "cyber" appears in the pitch deck. They're paying for specific things.
Recurring revenue with regulatory lock-in. If your customers can't leave without breaching compliance, that's not just retention. That's a moat.
Demonstrable SOC capability. Not a resold SIEM with a fancy dashboard. Actual detection, actual response, actual human analysts who've handled real incidents.
A credible talent bench. Cyber talent is scarce and expensive. An acquirer who gets a team of 15 certified security engineers isn't just buying revenue. They're buying something they couldn't recruit in 12 months of trying.
And contract structures that reflect value. Multi-year agreements, annual price escalators, scope that expands as the threat landscape does. These are the mechanics that turn a good security business into a great acquisition target.
The Bottom Line
Cybersecurity is the clearest exit multiplier available to UK IT services businesses right now. The multiples are there, the regulatory tailwinds are building, the consolidation is accelerating, and the talent pool is shrinking.
But capturing that premium isn't automatic. It requires deliberate positioning: building or acquiring the right capabilities, structuring contracts properly, hiring and retaining the right people, and telling the story in a way that resonates with buyers who've seen a hundred decks claiming to be "cyber-led."
The difference between a 10.8x and a 12.5x exit isn't a PowerPoint. It's what you built.