Who Is Buying Cybersecurity Testing Firms? The TIC Groups

If you run a cybersecurity testing, evaluation or certification firm, the testing, inspection and certification (TIC) groups are buying firms like yours. By our count, 23 of them have bought 50 cybersecurity firms since January 2015, SGS more than any other and DNV next.

About half the firms they bought are teams of testers. The rest are mostly labs and certifiers, some holding the accreditations that new security rules for connected products require. In the six deals with a published multiple, the median is 2.9x revenue, against 1.9x across 56 cybersecurity services deals in our wider research.

Applus+ has bought only labs that evaluate products against security standards, Bureau Veritas only testing and assurance firms, and SGS every kind. When one of them writes to you, it knows what it wants your firm for and what it has paid before, while you see only that one buyer. What follows shows who else has a reason to bid.

TIC Cybersecurity Acquisitions by Year and Region

Thirty-four of the 50 deals have come since 2021. The jump in 2021, to nine deals, came from groups buying cyber for the first time, among them SGS, DNV and Bureau Veritas. Applus+ followed in 2022. Those four have made 19 of the 50. After 2022 the pace eased, to four and five deals a year and then two in 2025. The seven of 2026 so far, five of them by SGS, already match 2022, the second busiest year in the count.

Continental Europe had 24 of the 50 targets, North America 11 (nine in the US) and the UK and Ireland nine, with six elsewhere.

Why TIC Groups Are Buying Cybersecurity Firms

A TIC group sells the independent tests and certificates that customers and regulators ask for, and security is joining that list. A testing firm brings testers whose work the group can sell to the manufacturers whose products it already tests and the companies it already certifies. A lab or certifier brings the right to do the checks that new rules require.

The EU’s Cyber Resilience Act, in force since December 2024, will make security a condition of selling most connected products from December 2027. The most security-critical products will need a check by a notified body (a lab or certifier appointed by the authorities). Since February 2025 IT products can also be certified under EUCC, the EU scheme built on Common Criteria, the international product security standard. Winning the right to test under such a scheme takes a lab years, so buying one is quicker than building one.

What they have bought

The targets fall into four kinds. Testing and assurance firms account for 25 of the targets: penetration testers and security consultants, with some forensics teams. Another 13 are evaluation labs, licensed by national schemes to evaluate products under Common Criteria, or accredited to test cryptographic modules under FIPS 140-3, the US standard that Canada also applies.

Nine are certification bodies or audit firms. Seven of them certify companies to ISO 27001 or assess them against PCI DSS (card payments), FedRAMP (US government cloud) or similar schemes. The other two certify security products or security professionals. Certified clients come back every year for a surveillance audit, and that repeat work is the business TIC groups already run. If your firm certifies more than security, see our certification body valuations.

The remaining three work on operational technology (OT) security, protecting the control systems that run factories and ships, under standards such as IEC 62443.

No target ran managed security, the round-the-clock monitoring of clients’ systems, as its main business. It came only alongside testing or inside a broader firm. Owners of managed security providers should expect IT services groups and private equity to bid, as our page on the buyers of cybersecurity services firms shows.

The Most Active TIC Acquirers of Cybersecurity Firms

Fourteen groups have bought two or more cybersecurity firms since 2015.

Group	Owner today	2015-19	2020-22	2023-26	Total
SGS	Listed, SIX Swiss Exchange	0	2	6	8
DNV	Foundation-owned	0	2	3	5
Applus+	I Squared Capital and TDR Capital	0	2	1	3
Bureau Veritas	Listed, Euronext Paris	0	1	2	3
BSI	Royal Charter body	3	0	0	3
Intertek	Listed, London Stock Exchange	3	0	0	3
Amtivo	Charterhouse Capital Partners	0	2	0	2
Apave	Members’ association, PAI Partners minority	0	2	0	2
DEKRA	Registered association	1	0	1	2
Groupe Serma	Management, with Ardian	2	0	0	2
LRQA	Goldman Sachs Alternatives	1	1	0	2
Phenna Group	Oakley Capital	0	1	1	2
Resillion	Stirling Square Capital Partners	1	1	0	2
TÜV Austria	Association-owned	0	2	0	2

What Each Buyer’s Pattern Means for a Seller

SGS

SGS has bought eight cyber firms, from evaluation labs to a forensics firm, for what it calls its Digital Trust portfolio. Four of its five deals in 2026 were in countries where it had no cyber firm before, and none of its eight was in the UK. Because it buys every kind of firm on this page, an approach from SGS tells you little about which other groups want yours.

DNV

DNV bought two of the three OT security firms in the count, one of them a specialist in securing ships, so an OT specialist is the closest match to what it has bought. Its largest cyber deal was a security services firm in 2023. It has also bought an audit firm and a body that certifies security professionals.

Applus+

All three of Applus+’s cyber deals, in Canada, Spain and Australia, were evaluation labs. A lab with a Common Criteria license or FIPS 140-3 accreditation fits that record; a pen-testing or audit firm does not.

Bureau Veritas

Bureau Veritas has bought pen-testing and security assurance firms in three countries, from a Danish firm with about $3M of revenue to a US firm with over $20M. A testing firm of that size fits that record.

Intertek and BSI

Intertek and BSI made all six of their cyber deals from 2015 to 2019 and none since. If either approaches you today, a sale process puts it beside the groups still buying.

Apave, Groupe Serma, Amtivo and TÜV Austria

Apave and Groupe Serma bought French cyber firms, Amtivo two British cyber consultancies, and TÜV Austria small consultancies in Germany and Turkey. Each has started to build cyber services through one or two deals, and a group building a capability can bid for a firm in another country too. In a sale process all four belong on the list, wherever your customers are.

DEKRA and Phenna Group

DEKRA’s two cyber deals were both evaluation labs, in Spain and Taiwan. Phenna Group‘s two deals, a British certification scheme operator and a US consultancy, are too unlike to show a pattern.

Private Equity in TIC Cybersecurity M&A

Private equity owns several of the groups in the table today, among them Applus+, LRQA, Resillion, Amtivo and Phenna Group, though some of their cyber deals were made under earlier owners. Smaller PE-backed groups such as QIMA and Fime have each bought an evaluation lab.

Two TIC groups have sold the units that held their cyber firms to private equity. Lloyd’s Register sold LRQA, owner of the pen-testing firm Nettitude, to the private equity arm of Goldman Sachs in 2021. Eurofins sold its digital testing arm, with the cyber firms it had bought, to Stirling Square in 2022, and the business now trades as Resillion. Since then LRQA has bought one cyber firm, and we found none by Resillion.

The group you join can be sold on in the same way. If you keep shares or stay on, the terms that protect you should bind the next owner.

What Cybersecurity Testing Firms Sell For

Buyers value a firm as a multiple of its revenue or of its EBITDA, which is earnings before interest, tax, depreciation and amortization, adjusted for one-off costs and the owner’s pay. At 10x, $2M of EBITDA gives an enterprise value (EV) of $20M, and you keep what is left after debt.

The six cyber deals by TIC groups with a published revenue multiple have a median of 2.9x. Our cybersecurity services valuation research puts the median across 56 services deals at 1.9x. The middle half of those deals sold between 1.1x and 3.2x, a quarter for less and a quarter for more, so the TIC median sits near the top of that range. Five of the six sold above the services median: three evaluation labs, and two pen-testing firms bought before 2020. The sixth, a broader services firm, sold at the services median.

Six prices are a thin base. Whether 2.9x revenue is a price your firm could see depends on its margin. At a 20 percent EBITDA margin, 2.9x revenue is 14.5x EBITDA, close to the services median of 13.4x. At a 10 percent margin it would be 29x EBITDA, above the top of the services middle half at 24.5x, so a firm with thin margins should not expect 2.9x revenue.

A firm that earns most from its own security software is valued as a software company, as our cybersecurity software valuation research shows. Our TIC company valuations cover the wider sector.

What Drives the Value of a Cybersecurity Testing Firm

In our view, a TIC group pays most for what would take it longest to build, and for revenue it can count on after the sale.

What You Receive and How It Is Paid

Several groups buy a majority and leave the founders with the rest, as Bureau Veritas did in the Netherlands, SGS twice in 2026 and RINA in Italy. RINA bought the remaining shares two years later.

How and when those remaining shares are priced, your firm’s name and your own role all go into the purchase agreement. In a competitive process each group states them in its offer, beside the headline price, so you can compare whole packages.

Who Is Buying Next

Of the seven deals of 2026, SGS made five; the other two were labs, bought by Applus+ and Fime. Nine groups, among them UL Solutions and RINA, have made a single cyber deal, and TÜV SÜD and TÜV Rheinland run cyber services of their own without having bought a cyber firm in our count. Nor have Element and ALS.

For labs and certifiers, the deadlines that create the work are already set. EU security requirements for connected radio equipment have applied since August 2025. In September 2026 the remaining FIPS 140-2 certificates moved to the historical list, so modules bought by US and Canadian government agencies now need FIPS 140-3 validation. Under the Cyber Resilience Act, notified bodies could be designated from June 2026; their checks become mandatory for the most critical products in December 2027.

What This Means If You Are Selling Your Cybersecurity Firm

Each group wants something different, so the right list of buyers depends on what your firm is. We run a competitive process among the TIC groups and private equity investors with a real reason to want your firm, so you choose between the best offers.

Has a TIC group been in touch, or are you weighing a sale in the next year or two? Talk to us in confidence about which of these groups would want your firm and how we would run a sale among them.

About Aventis Advisors

Aventis Advisors is a boutique M&A advisory firm advising on transactions with typical enterprise values between $5M and $100M. We run competitive sale processes for owners of TIC businesses and advise TIC groups on acquisitions: we advised Apave on its acquisitions of ISOCERT and De Duurzame Adviseurs, so we know how TIC buyers build their offers. See our TIC M&A advisory. Our goal is to provide honest, insight-driven advice, clearly laying out all the options for our clients, including the one to keep the status quo. One buyer’s offer tells you what that buyer would like to pay. Offers from several buyers, made at the same time on the same information, tell you what your business is worth. If a buyer has approached you, talk to us before you reply, agree a price or sign a letter of intent: we prepare the business, approach the TIC groups and private equity platforms most likely to pay for it, bring their offers to a single deadline and negotiate the terms through to closing. Write to us at marcin.majewski@aventis-advisors.com. The first conversation is confidential.

Methodology

We counted 50 acquisitions of control of cybersecurity firms by testing, inspection and certification groups, including groups owned by private equity, since January 2015, in the deals we could verify. A target counts when its main business is cybersecurity testing, evaluation, assurance, certification or OT security, and we left out functional-safety firms. The sources are the Aventis Advisors TIC deal database, built on Mergermarket and acquirer announcements, and our own research. Each buyer counts as one group, with its subsidiaries, under its owner today, so deals made by a business since sold count with that business, as with LRQA and Resillion. Majority stakes count as acquisitions, and a stake bought in two steps counts once. Six deals have a published EV/Revenue multiple; two of them are also among the 56 cybersecurity services deals behind the 1.9x services median. They are too few for a range, which we print only from ten deals or more. We quote their 2.9x median because it falls inside the middle half of the 56 cybersecurity services deals. Only 12 of the 50 deals have a known value, too few to give a typical target size. Five of the 50 deals also appear on our certification body pages. Values are in US dollars.