12 Acquisitions in a Trench Coat: The BGH Capital CyberCX Rollup Playbook
In October 2019, Melbourne private equity buyout firm BGH Capital launched an audacious campaign across the Australian cybersecurity landscape. Formed by former TPG Capital executives Ben Gray, Simon Harle, and David Brooks, BGH deployed its A$2.6 billion Fund I to roll up twelve independent cybersecurity consultancies into a single corporate vehicle: CyberCX.
Publicly, CyberCX was marketed to corporate boards and federal departments in Canberra as Australia's "sovereign cybersecurity champion." With former Optus Business managing director John Paitaridis appointed as Chief Executive and former Australian Cyber Security Centre (ACSC) head Alastair MacGibbon as Chief Strategy Officer, the venture presented a formidable public profile.
Behind that polished corporate exterior, however, sits classic private equity financial engineering.
Stitching together twelve distinct technical consultancies with disparate cultures, divergent tooling, and conflicting client relationships created operational fractures. Today, CyberCX operates with a 3.2 out of 5.0 rating across 340 Glassdoor reviews, as engineers grapple with aggressive billable utilization quotas, bureaucratic reporting hierarchies, and wage compression designed to feed leveraged EBITDA targets.
The Rollup Machine: 12 Boutiques Behind One Corporate Shingle
Before 2019, Australia's cybersecurity sector was defined by respected technical boutiques. These firms were founded by veteran penetration testers and risk consultants who prioritized technical rigor, open-source security research, and direct engineering relationships over corporate bureaucracy.
BGH Capital acquired and absorbed twelve of these operators into CyberCX:
- Offensive Security & Red Teaming: Sense of Security (Sydney), Alcorn Group (Brisbane), and CQR Consulting (Adelaide/Melbourne)βthree of Australia's premier penetration testing practices.
- Security Operations Centres (SOC) & MSSP: Asterisk Information Security (Perth), Base2 Services security division (Melbourne), and Foresight (Sydney).
- Governance, Risk & Compliance (GRC): Enex Carbon, Assurance, and The Cyber Institute.
- Security Awareness & Cloud Architecture: Phriendly Phishing, Consegna, and the security division of Diamond IT.
Consolidating these twelve entities created immediate scale, expanding headcount past 1,000 personnel and pushing annual revenue run-rates past A$220 million to A$300 million+.
However, corporate integration proved agonizingly complex. Rather than functioning as a unified firm, the business operated as a loose federation of legacy teams competing for internal resources, struggling with incompatible ticketing systems, and adjusting to corporate account executives placed between technical teams and clients.
Check how CyberCX stacks up in our CyberCX Directory Profile and compare metrics across all 95 firms on The MSP Ledger.
The Private Equity Playbook: Debt Service and EBITDA Arbitrage
Private equity rollups are designed around multiple arbitrage.
BGH Capital acquired individual boutique firms at valuation multiples of roughly 6x to 9x EBITDA. By assembling twelve firms into an industry-leading player commanding significant federal government and ASX200 market share, BGH aims to exit the investment at 14x to 18x EBITDA through an initial public offering (IPO) or sale to a global defense prime or international private equity syndicate.
| Operational Dimension | Independent Boutique (Pre-Rollup) | CyberCX Corporate Entity (Post-Rollup) |
|---|---|---|
| Annual Revenue Focus | A$5M β A$25M per boutique | A$220M β A$300M+ combined group |
| EBITDA Target | 8% β 12% (reinvested in labs) | 14% β 16% (focused on debt service) |
| Mandatory Billable Utilization | 65% β 70% (time for research/exploits) | 80% β 85%+ rigid timesheet tracking |
| Client Hourly Rate | A$220 β A$350 / hour | A$350 β A$550 / hour |
| Senior Pen Tester Base Pay | A$120,000 β A$150,000 | A$110,000 β A$135,000 (compressed) |
| Glassdoor Rating | 4.2 β 4.6 (high technical morale) | 3.2 / 5.0 (340 reviews) |
To justify that exit multiple, CyberCX must deliver EBITDA margins between 14% and 16% while servicing the senior debt facilities used to fund the initial buyouts.
When debt service and private equity hurdle rates dominate operational strategy, technical budgets are constrained. Discretionary spending on vulnerability research labs, hardware testing rigs, and international conference attendances (Black Hat, DEF CON) is curtailed to protect quarterly earnings before interest, tax, depreciation, and amortization.
Learn more about financial structures across the industry in our investigation into Following the Money: Private Equity in Australian IT and our analysis of MSP PE Rollups 2026.
Cultural Fractures: Smashing Hackers into Timesheets
The clash between boutique engineering culture and private equity governance is visible across 340 employee reviews on Glassdoor:
- The Destruction of Autonomy: Veteran penetration testers who once managed client engagements with technical independence now report to regional practice managers and non-technical account directors. Every billable hour must be accounted for in 15-minute increments within corporate PSA platforms.
- The Utilization Meat Grinder: Billable utilization targets have been pushed to 80%β85%+. For security researchers, a mandatory 85% billable quota leaves zero time to develop custom tooling, research emerging zero-day vulnerabilities, or mentor junior analysts.
- Senior Operator Exodus: The imposition of corporate overhead triggered waves of departures. Founding partners and principal security consultants from Sense of Security, Alcorn, and CQR departed once their post-acquisition earn-out covenants expired, either founding new independent boutiques or joining enterprise internal red teams.
These cultural tensions are evaluated through our MSP Engineering Culture Score and examined in our Contract Grader.
The Cyber Experience Discount: Billing $450/hr on an $85K Base
A cornerstone of the rollup margin model is the "cyber experience" wage discount.
Recruiting managers highlight the firm's sovereign brand and threat intelligence access to attract junior talent at entry-level compensation bands:
- Junior SOC Analysts & Associate Pen Testers: Starting base salaries sit between A$75,000 and A$85,000.
- Mid-Level Security Engineers: Salaries average A$95,000 to A$115,000, while equivalent roles in enterprise banking SOCs pay A$135,000+.
- Senior Penetration Testers & Threat Hunters: Compensation is capped between A$110,000 and A$140,000, significantly below the A$160,000 to A$190,000 commanded by cleared cybersecurity specialists across Canberra and Sydney.
Meanwhile, CyberCX statements of work (SOWs) bill these same technical resources to enterprise clients at rate cards of A$350 to A$550 per hour.
A senior penetration tester on a A$125,000 base salary billing 1,500 hours annually at A$450/hour generates A$675,000 in gross revenue for the firmβa 5.4x multiplier over base salary. While private equity investors capture the resulting margin, the engineers executing the technical assessments face wage stagnation.
Verify your market compensation on our MSP Salary Calculator and review statutory severance protections using our Redundancy Calculator.
Buyer Beware: Auditing the Rolled-Up Security Stack
For enterprise procurement teams, engaging a rolled-up security provider requires forensic diligence:
- Verify Delivery Personnel: Does your master services agreement guarantee that penetration testing will be executed by senior onshore operators from original tier-1 practices, or will your environment be handed to junior analysts operating automated vulnerability scanners?
- Scrutinize SOC SLAs: Inspect the fine print of managed detection and response (MDR) contracts. Does a "15-minute SLA" represent true threat containment, or merely an automated ticketing acknowledgement generated by a SIEM rule?
- Audit Data Enclaves: Verify whether data gathered during red teaming, digital forensics, and incident response engagements is segregated across secure sovereign enclaves or stored within shared corporate repositories accessible across disparate business units.
Download our enterprise procurement checklists and negotiation templates from The MSP Playbook Store.
Frequently Asked Questions
What is the CyberCX rollup model backed by BGH Capital?
BGH Capital created CyberCX in 2019-2020 by acquiring and consolidating 12 independent Australian cyber boutiques. The model uses leveraged capital to buy specialized technical firms, centralize corporate overhead, and engineer scale for an eventual high-multiple liquidity exit.
Why do technical staff report wage stagnation at CyberCX?
While senior penetration testers and security analysts are billed to enterprise and government clients at $350 to $550 per hour, base salaries remain compressed between $80,000 and $165,000 to maintain private equity EBITDA margin targets of 14% to 16%.
How has merging 12 distinct boutiques affected engineering culture?
Across 340 Glassdoor reviews, CyberCX holds a 3.2 out of 5 rating. Employees report ongoing friction between legacy boutique units, rigid billable utilization targets exceeding 80%, and the displacement of technical autonomy by corporate reporting layers.
Where can I evaluate CyberCX against other Australian cybersecurity providers?
You can compare CyberCX's operational metrics, ownership structure, and employee sentiment alongside 95 Australian service providers in The MSP Ledger.
Related Dossiers: Compare provider profiles in the CyberCX Directory Profile and evaluate industry buyout trends in Following the Money.
Protect your career, audit your service terms, or benchmark your compensation with our free community tools:
Was this helpful?