A deep cybersecurity pipeline could be the spark to ignite a more robust technology IPO market, with sponsor-backed candidates potentially testing markets in 2027, according to industry advisors and investors.

Sponsor-backed companies including Cohesity and Proofpoint are among the potential candidates in 2027, while venture-backed Illumio, Cyera, and Veeam are drawing attention as longer-term IPO prospects, the advisors and investors said.

The pipeline depends on public-market appetite for software, the performance of major AI listings, and companies’ ability to show AI will strengthen rather than commoditize their products, they said.

“High-quality cyber has as good a shot of any enterprise software company to have an IPO,” a private equity executive said last week at the Mergermarket Private Equity Forum US in Austin, Texas. “It’s hard right now to go and get mindshare from big accounts like Fidelity and T Rowe” because they were previously focused on SpaceX and are now focusing on how much they’ll invest in Anthropic and OpenAI.

Before listing, these companies will need to figure out how to explain how they will respond to AI or use it as an opportunity, making them more probable candidates for 2027; still, their owners still need liquidity, so they are likely to test the market once those questions have been answered.

Proofpoint illustrates the tension. Thoma Bravo took the cybersecurity company private in 2021 in a USD 12.3bn transaction. It has since expanded through acquisitions, including its USD 1.8bn purchase of Hornetsecurity, while continuing to position itself for a potential return to public markets. This month it announced a USD 6.3bn acquisition of Varonis, which should push out its timeline to go public, the private equity executive said.

Cohesity presents a similar trade-off following its combination with Veritas’ data protection business. Growth has moderated, according to an investment banker, while profitability has improved.

The double-digit earnings threshold

Cybersecurity vendors that help organizations manage AI-related risks could attract premium valuations. The growing capabilities of AI systems may increase the frequency and sophistication of attacks, creating demand for stronger defenses and faster recovery, the banker said. For potential issuers, the implication is that AI exposure alone will not secure an IPO premium. Investors will want evidence of durable growth, product differentiation, and a credible path to profitability, the advisors said.

“You have to have steady, consistent, double-digit earnings growth, like close to 20% earnings growth, unassailably,” the private equity executive said.

Illumio, Cyera, Island, and Ping Identity are attracting attention from advisors and investors. Armis, which was acquired by Insight Partners, is another company being watched.

If sponsor-backed issuers are being scrutinized for balancing growth and profitability, venture-backed cybersecurity firms are being tested on whether their growth stories can justify lofty valuations.

Identity security firms 1Password, ID.me, and Socure are also planning for IPOs, as this news service has reported. Cloud security provider Cato Networks recently denied a report it is selling to Crowdstrike and said it is planning to go public instead.

Illumio CEO Andrew Rubin declined to predict the timing of his company’s potential IPO when speaking with Mergermarket earlier this year, saying management is focused on execution rather than market conditions beyond its control.

Illumio’s microsegmentation technology is designed to contain breaches after an attacker enters a network. Microsegmentation divides networks into smaller, isolated segments, limiting an attacker’s ability to move laterally once a breach occurs. Rubin argued that increasingly capable AI systems strengthen the case for resilience alongside conventional prevention.

The company’s potential listing will depend partly on whether public investors reward that proposition and whether the IPO market opens sufficiently for cybersecurity issuers beyond the largest AI companies, the CEO said.

Verkada is another potential candidate, with one industry consultant suggesting a possible listing around mid-2027. The consultant said the physical security systems provider was approaching or had exceeded USD 1bn in revenue and was positioning itself as an integrated platform rather than simply a video-surveillance vendor.

Vanta, meanwhile, was described as having lost momentum as a potential IPO candidate, while Vercel’s listing timeline had slowed amid uncertainty over the market’s response to major AI companies, the consultant said.

Even if the IPO market reopens, cybersecurity companies may have several potential exit routes. Strategic acquisitions remain an important alternative, particularly where buyers can justify valuations through technology, talent, and product synergies that public investors may not fully value.

The advisors said the result is likely to be a selective IPO market in which listings are reserved for companies that can demonstrate durable growth, clear differentiation, and AI resilience.

“I don’t think there’s quite an IPO market yet for software, although maybe we’re getting there,” one investor said. “If anything, the opportunity would be in security.”