At the start of 2020, lists of “cybersecurity companies that could IPO this year” were everywhere. Illumio, the segmentation specialist, was often on them, alongside other private firms valued at a billion dollars or more. The pandemic soon rewrote the calendar, but the questions behind those lists have not gone away: what makes a security company ready for the public market, and why do some wait years?
Why security was a hot category
Breaches had become a board-level topic, and spending on protection kept rising even when other budgets were cut. Security software has attractive economics: customers pay recurring subscriptions, switching costs are high, and a new type of threat creates demand for a new type of product. Several security firms had already gone public to strong reception in the years just before, which encouraged investors to look for the next wave.
The checklist bankers use
- Recurring revenue. A high share of income from subscriptions that renew predictably.
- Healthy growth. Revenue rising quickly enough to justify a premium valuation, often 30 to 50 percent a year or more.
- Net retention. Existing customers spending more each year, a sign the product expands inside accounts.
- A path to profit. Not necessarily profits today, but improving margins and a clear plan.
- A large market. Room to keep growing for years, not a narrow niche.
- Clean books and governance. Audited financials, a credible board and controls that satisfy regulators.
Why a unicorn label is not enough
A billion-dollar private valuation is a negotiated number between a startup and its investors. Public markets are less generous. Some companies discover that their last private round priced them above what public buyers will pay, and an IPO would force a painful drop. Executives then face a choice: wait for a better market, raise more private money, seek an acquirer, or accept a lower valuation. Many choose to wait.
What happened to the 2020 hopefuls
The picture was mixed. Early spring brought market turbulence and a pause in new listings. By the second half of the year, the IPO window reopened and a number of software companies listed at high prices. Some security firms went public in the following years, others were acquired, and several stayed private, financing growth with large private rounds instead. The lesson is that a name on a “likely to IPO” list is a prediction, not a plan.
How the category evolved
Security buyers also changed what they wanted. Rather than buying a dozen point products, many large organizations pushed to consolidate onto platforms that cover endpoints, cloud, identity and email in one place. That favored larger vendors and put pressure on narrow specialists to broaden their offering or find a niche where they were clearly best. At the same time, zero-trust ideas, which assume that no network is safe by default, made segmentation and identity controls more mainstream.
What investors look at in a security company
- Detection quality. Does the product catch real attacks without drowning customers in false alarms?
- Integrations. Does it work with the tools a security team already uses?
- Sales motion. Can the firm sell to large enterprises and keep them for years?
- Reputation. Has the vendor handled its own incidents responsibly?
The pandemic effect on security buying
When offices emptied almost overnight, security teams had to protect employees working from kitchens and spare bedrooms. Remote access, identity checks and cloud monitoring moved to the top of every budget list, while projects tied to office networks were postponed. Vendors whose products fit the new reality saw demand climb, and those selling to physical sites had to adapt. For investors, it was a live test of which products were essential and which were nice to have, and the results shaped later opinions about who deserved a premium price.
Lessons for founders
If you are building a security company, think about the market you will have to explain to analysts. A clear category, strong references from customers and a repeatable sales process matter more than a flashy demo. Be careful with growth at all costs: public investors have become more interested in efficient growth, where each dollar of spending produces a healthy return. And prepare early for the discipline of being public, which means quarterly reporting, forecasting and tight controls.
The big picture
Lists of future IPOs make good headlines, but timing the market is notoriously hard. Cybersecurity remains one of the more durable corners of technology, because threats keep evolving and organizations keep paying to defend against them. Whether a given company lists, merges or stays private is secondary to the underlying demand, which has only grown since those early-2020 predictions were written.
