A capped downside with a services-grade upside.
Self-funded in the base case: about $120k to launch, a modeled peak cash need of about $289k, and hard kill gates that cap the modeled loss before month 18 at about $330k. The bet is attractive because the loss is capped, not because the average is huge.
Every figure on this page is a Projection from the financial model (v2). There are no customers, partners, carriers or revenue today.
Year 5, if the base case holds.
Bear, mid, base, bull.
Pick a scenario. Exit is priced on normalized Year-5 EBITDA (EBITDA less the cost of replacing a part-time founder with a full-time CEO), 65% cash at close and 35% earnout over two years counted at 75%.
Revenue and EBITDA Projection
Cumulative founder cash Projection
Months 3 to 24. The lowest point is the peak cash need.
$120k to launch.
Off-the-shelf tools first. The platform is built in Year 2, only after 15 to 20 real drills show which steps repeat.
The E&O / cyber premium is a placeholder until a real quote, with the statement wording attached, arrives before day 30. If E&O cannot be placed at a workable price, that is a day-90 kill criterion.
Where we stop.
Positive, but modest. On purpose.
Weights are a finance reviewer's rough estimate, adopted unchanged: 50% stopped by a kill gate, 30% weak (the mid-case run to Year 5), 20% base. The bull case is not weighted.
Expected net value Projection
"Stopped" averages a day-90 stop and a month-12 stop in the bear case. Founder time is costed at $200/hour.
A built-in pipeline, not a cold start.
The usual question for a services business is whether the founder can sell and deliver it. Here the answer already exists.
Track record
The founder built and ran SecureTrust, a penetration-testing firm, and today runs NexOasis, which banks and financial institutions pay for logical and physical penetration testing. Scoping, authorization letters, rules of engagement and selling to executives are routine, not new.
Warm pipeline
Existing bank and fintech relationships are a warm list for the Baseline Wire Test. The plan's "founder personally sells the first 15-20 deals" is grounded in relationships that already exist, not an assumption.
Physical reach
NexOasis already runs physical penetration tests, so Hold The Wire can offer a combined logical-and-physical engagement that pure software or awareness vendors can't staff. See the premium tier in pricing.
Why 5x / 7x / 10x EBITDA.
The large deals show the buyer universe, not our multiple. Base EV is about 1.8x Year-5 revenue, near the 1.9x median EV/revenue for cybersecurity services deals.
| Data point | Figure | Source |
|---|---|---|
| Cybersecurity services M&A, 2015-2025 | Median 1.9x EV/revenue (56 deals); 13.4x EV/EBITDA (24 deals, directional) | Aventis Advisors |
| IT services, $2M-$20M revenue | 4x-7x EBITDA; specialized cyber 8x-10x (secondhand) | FE International |
| MSSPs, $1M-$3M revenue | 5.0x-7.5x adjusted EBITDA | CT Acquisitions |
| MSSPs, $3M-$10M revenue | 8x-11x high-recurring; under ~50% recurring repriced 2-4 turns lower | CT Acquisitions |
| KnowBe4 take-private (2022) | ~$4.6B | Vista Equity Partners |
| Corvus to Travelers | ~$435M | SecurityWeek |
What has to be proven
Retention above 85%, operator time per drill under one hour, and one carrier that values the result. None is assumed in the base case.
Biggest risks
Funded incumbents adding a payment-drill SKU; low renewal after a client "fixes it"; E&O placement; key-person dependence.
Who buys it
An awareness platform, an email-security vendor, or an insurtech wanting a pre-bind controls test. 10x requires one of them.
Talk about the plan.
The model, the red-team notes and the kill criteria are all available. Read the full plan first.