Your M&A
Skills Library

DEAL THESIS — Managed Detection & Response (MDR) Expansion
Prepared for: Corp Dev Committee · Draft v1

THESIS STATEMENT
Acquire a founder-owned regional MSSP with $8–15M revenue in the US Southeast to
accelerate entry into Managed Detection & Response (MDR), targeting a signed deal
within two quarters.

STRATEGIC RATIONALE
1. Fills the SOC / 24×7 monitoring gap named in the FY26 strategy [VALIDATE vs. strategy doc]
2. Cross-sell MDR into our ~220 existing mid-market managed-services accounts
3. Buys ~18 months of time-to-market vs. building a SOC and hiring analysts organically
4. Defensive — 3 of our top competitors added MDR in the last 24 months [VALIDATE]

IDEAL TARGET PROFILE
Revenue        $8–15M
Headcount      60–120 FTE (incl. 15+ trained SOC analysts)
Recurring rev  >65% of total
Geography      US Southeast (GA, FL, NC, TN preferred)
Ownership      Founder-owned / PE-light, clean cap table
Tech           Established SIEM/EDR stack; SOC 2 Type II

VALUE-CREATION LOGIC
Revenue     Attach MDR to existing base; cross-sell uplift [VALIDATE with sales]
Cost        Consolidate overlapping tooling + back office (~$0.4–0.6M/yr) [ASSUMPTION]
Capability  Acquire a trained SOC team we cannot hire fast enough in-house

KEY RISKS & ASSUMPTIONS
• ASSUMPTION: SOC analysts stay post-close — the #1 value driver
• RISK: customer concentration is common in this segment — diligence must confirm
• RISK: integrating a 24×7 operation is harder than a standard tuck-in
• ASSUMPTION: cross-sell works without heavy AM re-training

WALK-AWAY CRITERIA
✗ Top customer > 25% of revenue
✗ No non-competes / retention hooks on key SOC staff
✗ Asking price > 2.5x revenue with no growth-premium justification
✗ Failed or absent SOC 2 audit

STEP 1 — PROPOSED CRITERIA & WEIGHTS  (derived from your thesis)

Criterion                Weight  Why
SOC talent & retention    35%    Thesis hinges on acquiring a team we can't hire fast
Segment fit (MSSP/MDR)    25%    Must be true managed security, not a general MSP
Recurring revenue         15%    Durability of the customer base
Geographic fit (SE US)    15%    Cross-sell into our existing footprint
Customer concentration    10%    Flagged as a walk-away risk

Reply "confirm" to run the screen with these weights, or tell me what to change.

─────────────────────────────────────────────────
(User: "confirm")
─────────────────────────────────────────────────

STEP 2 — TARGET SCREEN — MDR Expansion Thesis
Weights applied as above · Universe screened: 14 · Advancing: 3

RANKED SHORTLIST
#  Target             Fit  Fin  Risk  Score  Rationale
1  Meridian Cloud      9    7    8     8.1   Exact SE footprint; strong 18-analyst SOC
2  Northgate Managed   8    –    6    ~7.4   Great capability fit; financials not disclosed
3  Pinnacle IT         6    7    7     6.5   Size fits; thin security bench, more MSP than MSSP
4  Harbor Secure       7    5    4     5.4   Good tech, but ~34% customer concentration (flag)
5  BlueRidge Networks  4    6    8     5.5   Solid financials; wrong segment (network, not SOC)
   … 9 more below threshold (parked / excluded)

EXCLUDED (hard fails)
• Sentinel Ops — PE-owned, mid-auction (process risk, likely priced out)
• CyberField — top customer ~40% of revenue (exceeds concentration deal-breaker)

MISSING INFORMATION
Meridian Cloud  — confirm FY25 revenue & margin; ownership structure
Northgate       — no financials disclosed; request via broker before scoring finance
Pinnacle IT     — confirm # of dedicated SOC analysts vs. general MSP techs

RECOMMENDED NEXT STEPS
ADVANCE  Meridian (priority), Northgate (pending financials)
PARK     Pinnacle, Harbor Secure (revisit if top 2 stall)
DROP     BlueRidge (segment mismatch), Sentinel, CyberField

DILIGENCE REQUEST LIST — Project Meridian
Structure: 100% stock purchase · Industry: MSSP · Size: ~$40M EV · 6 workstreams

FINANCIAL                                        Owner       Pri
□ Audited financial statements, FY23–FY25        Target      P1
□ Monthly P&L, trailing 24 months                Target      P1
□ AR aging + customer revenue concentration      Target      P1
□ Adjusted EBITDA bridge w/ add-back detail      Target/Adv  P1
□ Current-year budget vs. actuals                Target      P2
□ Deferred revenue & backlog schedule            Target      P2

LEGAL                                            Owner       Pri
□ Cap table & option ledger                      Target      P1
□ Material contracts >$100k [structure-dependent] Target     P1
□ Customer contracts w/ change-of-control clauses Target/Adv P1
□ IP assignments & registrations                 Target      P2
□ Litigation / dispute history                   Target      P2

COMMERCIAL                                       Owner       Pri
□ Top-20 customer list w/ tenure & ARR           Target      P1
□ Logo retention / churn (trailing 3 yr)         Target      P1
□ Pipeline & win-rate data                       Target      P2

TECHNOLOGY / SECURITY                            Owner       Pri
□ SOC 2 Type II report (current)                 Target      P1
□ SIEM/EDR tooling inventory & licenses          Target      P1
□ SOC staffing & 24×7 shift-coverage model       Target      P2

HR / PEOPLE                                      Owner       Pri
□ Org chart + compensation bands                 Target      P1
□ Key-employee agreements & non-competes         Target      P1
□ SOC analyst tenure & attrition data            Target      P1

TAX                                              Owner       Pri
□ Federal & state returns (3 yr)                 Target/Adv  P1
□ Nexus / sales-tax exposure analysis            Advisor     P2

RECOMMENDED DATA-ROOM STRUCTURE
01_Financial  02_Legal  03_Commercial  04_Technology  05_HR  06_Tax  07_Corporate

CIM SUMMARY — Meridian Cloud   (lens: MDR fit + earnings quality)

EXECUTIVE SUMMARY
• FY25 revenue $11.0M, +14% YoY; adjusted EBITDA $2.0M (~18% margin), unaudited
• Recurring revenue 76% of total — healthy for the segment
• 18 dedicated SOC analysts; SOC 2 Type II in place (per CIM)
• Broadly marketed by a boutique advisor; management "willing to stay, subject to terms"
• Implied ask ~3.6x revenue / ~20x adj. EBITDA — above our walk-away band

KEY FACTS & TERMS
Metric               Value           Source
Revenue (FY25)       $11.0M          CIM p.12
Revenue growth       +14% YoY        CIM p.12
Adj. EBITDA          $2.0M           CIM p.13 (incl. add-backs)
Reported EBITDA      $1.6M           CIM p.13
Recurring revenue    76%             CIM p.14
SOC analysts         18              CIM p.21
Top customer %       not disclosed   —

FLAGS & OPEN QUESTIONS
⚑ Adj. EBITDA includes ~$400k of add-backs (owner comp + one "non-recurring" item) — request schedule
⚑ Customer concentration NOT disclosed — critical vs. our walk-away rule; request top-20
⚑ Growth attributed to "two large logos" in FY25 — how durable / concentrated?
⚑ 76% recurring claimed but contract terms not evidenced — verify in data room
NOTE: CIM figures are unaudited management CLAIMS, not evidenced results.

INTEGRATION WORKPLAN — Project Meridian
Close: [DD MMM] · Functions: People, IT/Security, Finance, GTM, Facilities
Synergy target: $1.2M run-rate · Owner: Integration Lead

DAY-1 CHECKLIST (must-happen)
People   □ Welcome comms to all Meridian staff (09:00)        Integration Lead
People   □ Retention agreements countersigned & confirmed      HR
IT/Sec   □ SSO + email access provisioned; no SOC downtime     IT
Finance  □ Payroll continuity confirmed for first cycle        Finance
Legal    □ Customer change-of-control notices issued           Legal
GTM      □ "Nothing changes today" note to top-20 accounts     GTM Lead

100-DAY PLAN
Phase 1 · Wk 1–2 (Stabilize)
  IT       SSO/email cutover complete                 IT       Wk 1
  People   Retention offers signed (all 5)            HR       Wk 1
  Finance  Reporting consolidated into group P&L      Finance  Wk 2
Phase 2 · Wk 3–6 (Connect)
  GTM      Joint pipeline review; cross-sell v1       GTM      Wk 4
  IT/Sec   Tooling rationalization plan (SIEM/EDR)     IT       Wk 5
Phase 3 · Wk 7–10 (Optimize)
  Ops      Duplicate role decisions [SENSITIVE]       HR/Ops   Wk 8
  IT/Sec   Tooling consolidation executed             IT       Wk 9
Phase 4 · Wk 11–14 (Prove)
  Finance  Synergy tracking cadence live              Finance  Wk 11
  All      Integration retro + Board readout          Lead     Wk 14

RACI (major workstreams)
Workstream           R          A      C            I
IT/Security cutover  IT Lead    Lead   CISO         ELT
Retention/People     HR         Lead   Founder      ELT
Cross-sell GTM       GTM Lead   CRO    Sales, Mktg  Lead
Synergy tracking     Finance    CFO    Workstreams  Board

MILESTONES & DEPENDENCIES
• SSO/email cutover (Wk1) BLOCKS tooling consolidation (Wk9)
• Retention signed (Wk1) is a PREREQUISITE to any role decisions (Wk8)
• QoE-confirmed baseline feeds the synergy tracking cadence (Wk11)

SYNERGY LINKAGE
Tooling consolidation    → $180k   (IT, Wk9)
Duplicate role removal   → $520k   (HR/Ops, Wk8) [high sensitivity]
Cross-sell (MDR attach)  → $500k   (GTM, Q3 ramp)
                  TOTAL  → $1.20M run-rate

INTEGRATION UPDATE — Project Meridian — Week 6
Audience: Executive Team · Prepared by: Integration Lead

HEADLINE
🟢 ON TRACK — systems cutover complete and retention locked; synergy capture is slightly
behind plan but recoverable.

PROGRESS vs. PLAN
Workstream          Status  Detail
IT / Security       🟢      SSO + email cutover complete; zero SOC downtime
People / Retention  🟢      All 5 retention agreements signed
Finance             🟢      Reporting consolidated into group P&L
Synergies           🟠      38% captured vs. 40% planned (tooling slipped 1 wk)
Cross-sell (GTM)    ⚪      Kicks off Week 8 as scheduled
Facilities          🟢      Lease renewal signed

RISKS & ASKS
⚠ RISK: Duplicate back-office role decisions (Wk 8) are sensitive and slipping — need
        HR/ELT sign-off by end of Week 7 to stay on plan.
🙋 ASK: Approve retention budget for 2 additional back-office roles ($90k) to secure
        continuity through consolidation.

NEXT MILESTONES
Wk 8   GTM cross-sell launch · role decisions finalized
Wk 9   Tooling consolidation executed (recovers synergy gap)
Wk 11  Synergy tracking cadence goes live

TARGET PROFILE — Meridian Cloud

OVERVIEW
HQ            Atlanta, GA
Founded       2014
Headcount     ~90 FTE (incl. 18 SOC analysts)
Ownership     Founder-owned (single majority holder)

BUSINESS & MARKET
Managed security services (MSSP) — 24×7 SOC, managed detection & response, and
compliance monitoring. Serves SE US mid-market (200–2,000-seat organizations).
Established SIEM/EDR stack; SOC 2 Type II certified.

FINANCIAL SNAPSHOT
Revenue (FY25)     $11.0M (per CIM, unaudited)
Growth             +14% YoY
Recurring revenue  76%
Margin             not disclosed
Top customer %     not disclosed

STRATEGIC FIT
Directly fills our SOC / MDR capability gap and gives us a trained analyst team we
can't hire fast enough. Strong overlap with our ~220 mid-market accounts for cross-sell.

WATCH ITEMS
• Customer concentration not disclosed — confirm before advancing
• Growth reportedly driven by 2 large FY25 logos — check durability
• Key SOC-analyst retention will make or break the value

OUTREACH PREP — Meridian Cloud   (cold · founder-owned)

APPROACH NOTE
Subject: A confidential conversation

Hi [Founder] — I lead corporate development at [Acquirer]. We've followed what
Meridian has built in Southeast managed security and have real admiration for your
SOC team and reputation. We're expanding in MDR and would value a confidential,
no-obligation conversation about whether there's a fit between our two businesses.
Open to a short call in the next couple of weeks?

TALKING POINTS (first call)
• Who we are and why Meridian specifically — not a spray-and-pray process
• We're a strategic buyer, not financial — a long-term home for the team
• Respect for the brand and people; continuity matters to us
• Keep it exploratory — listen more than pitch
• Agree a light next step (mutual NDA) only if there's mutual interest

LIKELY QUESTIONS  →  SUGGESTED ANSWERS
"Are you just fishing?"     → No — you're a priority target that fits a specific thesis.
"What happens to my team?"  → Continuity is central; we're buying the team, not replacing it.
"What's it worth?"          → Too early — we'd want to understand the business first.
"Is this confidential?"     → Fully; we'll sign a mutual NDA before anything substantive.

WHAT TO HOLD BACK (for later)
• Valuation range or multiples
• Integration / headcount specifics
• Internal thesis details and synergy numbers

Legend: T-0 = close day / Day 1 · T-minus N = N days before close · T+N = N days after close

DAY-1 READINESS CHECKLIST — Project Meridian
Structure: 100% stock purchase · Close: [DD MMM]

PEOPLE                                          Owner    Due
□ Welcome comms drafted & approved              HR       T-2 days
□ Retention agreements countersigned            HR       T-1 day
□ Manager talking points distributed            HR       T-1 day

IT / SECURITY                                   Owner    Due
□ SSO + email accounts staged                   IT       T-1 day
□ SOC access continuity verified (no downtime)  CISO     T-0
□ Asset & license inventory confirmed           IT       T-1 day

FINANCE                                         Owner    Due
□ Payroll continuity confirmed                  Finance  T-2 days
□ Bank / authority signatories updated          Finance  T-0
□ Day-1 opening balance sheet ready             Finance  T-0

LEGAL                                           Owner    Due
□ Closing docs executed & filed                 Legal    T-0
□ Customer change-of-control notices ready      Legal    T-0

COMMS                                           Owner    Due
□ Internal all-hands scheduled (11:00)          Comms    T-0
□ External / customer announcement approved     Comms    T-1 day

CUSTOMER / GTM                                  Owner    Due
□ "Nothing changes today" note to top-20        GTM      T-0
□ Support & escalation paths confirmed          GTM      T-0

━━ MUST HAPPEN BY 9:00 AM, DAY 1 ━━
✓ Employee welcome comms sent
✓ Payroll & system access verified
✓ SOC running with zero downtime
✓ Customer change-of-control notices live
✓ Leadership all-hands confirmed for 11:00