Optiv: Pre-Wiring the Downside

Welcome to the 206th Pari Passu newsletter.

Optiv is the largest pure-play cybersecurity integrator in North America. Blackstone assembled the business through the 2015 merger of Accuvant and FishNet Security, and KKR bought it in February 2017 for nearly $2bn. KKR’s thesis was to move Optiv up the value chain, from thin-margin reselling into managed detection, but after nine years the company’s revenue mix had barely moved. By the end of 2025, the company had over $1bn coming due inside two years against a deteriorating liquidity position.

In March 2026, Optiv announced a near-unanimous, comprehensive amendment and extension, extending every facility two years, pro rata and at par, with no new money. What makes the transaction interesting is the second document signed alongside it. The parties pre-negotiated three restructuring pathways: a mandated sale, a refinancing, and an equitization on splits fixed in advance, and then attached a milestone calendar to the sale that runs inside the extended maturity. The transaction shouldn’t be viewed as a two-year extension, but as a bridge to a sale process with attached dates. 

In today's writeup, we'll start by overviewing Optiv's two business lines and why one is worth more than the other. From there, we'll trace the corporate history from two competing regional resellers through Blackstone's roll-up to KKR's 2017 buyout. We'll then walk through the path to distress, where an entry structure that looked conservative met a rate environment it could not carry. From there, we'll break down the 2026 transaction mechanically before covering why this was not an LME, the concessions the out-of-the-money 2L extracted, and what a successful sale process would need to clear. We'll end with key takeaways and what comes next for Optiv.

Every large organization buys security software from many different vendors. A regional bank, for example, might use one product for laptops and desktops, another for employee logins and passwords, a third for watching network traffic, and a fourth for monitoring whatever the company keeps in the cloud. Each product was likely purchased at a different time, for a different reason, and arrives with its own dashboard, alerts, and renewal date. A dozen cybersecurity tools don't naturally cooperate under one roof, and most internal security teams are staffed to respond to threats, not to run a procurement operation. That gap is where Optiv comes in.

Optiv is a cybersecurity solutions company headquartered in Denver, Colorado, formed in 2015 through the merger of Accuvant and FishNet Security. The combination created the largest pure-play cybersecurity integrator in North America. Optiv builds no products of its own. Instead, its role is to help enterprises choose among everyone else's products, install them, and then run those products on the client's behalf, staffing the analysts who sit in front of the consoles day to day. The company calls the approach Advise, Deploy, Operate. Roughly 6,000 corporate and government clients sit on the other side of that relationship, and Optiv's revenue is currently split roughly 55/45 between reselling technology and delivering security services [1]. Those two halves behave very differently, and understanding how each works, along with the federal business that sits alongside them, explains both the company's position in the market and the pressure it eventually came under.

Technology Sourcing:

The larger half of Optiv's revenue comes from selling other companies' products. For example, if a client decides it needs endpoint protection, rather than negotiating directly with the vendor, it can buy through Optiv, which handles licensing, renewals, hardware maintenance, and the paperwork that accumulates across dozens of vendor relationships. This is the value-added reseller (VAR) model. Optiv's engineers know which products actually work together and how to size a deployment, and the client gets one purchase order and one point of contact instead of thirty.

VAR economics are structurally thin. Optiv buys at one price and sells at another, and the spread is narrow because the underlying product belongs to someone else. Volume is what makes it work, and the relationships behind that volume are substantial, with Optiv having crossed a billion dollars in joint sales with each of CrowdStrike and Proofpoint (a name you’ll soon see us cover), after years of selling alongside those vendors [1]. 

Security Services:

The other half of the business is work that Optiv's own people perform. The centerpiece is managed detection and response (MDR), under which Optiv watches a client's systems around the clock and investigates anything suspicious. Most companies cannot justify staffing a security operations center on their own. Instead, Optiv runs that function on their behalf, spreading the cost of continuous coverage across many clients. This side of the business is where Optiv's position becomes difficult to dislodge, as standing up managed detection inside a client's environment means learning a security stack assembled over years, deciding what counts as an alert worth notifying someone for, and building the response procedures the client's own staff will actually follow. That work takes months, and replacing it means doing it all again with someone new [1].

Additionally, a meaningful portion of Optiv's business sits with government entities. In March 2023, the company acquired ClearShark, a Maryland-based reseller and advisor focused on government customers, in a transaction Optiv said would more than double its federal presence [2]. The combined unit operates as Optiv + ClearShark and serves civilian agencies including Homeland Security and Veterans Affairs alongside defense and intelligence customers. Federal work carries certification requirements that commercial work does not, which makes the position defensible, though government budgets bring shutdowns and appropriations delays with them [1] 

Global cybersecurity spending sits around $230bn and continues to grow at double digits, but the same conditions are working against the VAR half of the business. Buyers increasingly skip the intermediary, purchasing either directly from the vendor or from whoever will manage the tool for them, and reseller-style procurement has been losing share of enterprise technology spending. Cloud providers are accelerating this, as Amazon, Microsoft, and Google increasingly offer enterprise customers arrangements that let them apply committed cloud spending directly to third-party software, removing the reseller from the transaction entirely [1]. More recently, artificial intelligence is beginning to press on both halves at once. AI-native security vendors are building direct distribution from day one rather than through channel partners, and agentic tooling is starting to automate the alert triage and investigation work that determines how many analysts an MDR contract actually requires. 

In summary, Optiv's franchise encompasses thousands of enterprise and government relationships, deeply embedded services, and a federal position competitors cannot easily replicate. However, that franchise rests on the company remaining the party clients route their security spending through. When that role comes under pressure, as we will see, the effects are far-reaching.

Corporate History

Optiv's two halves were built the same way, six years apart. FishNet Security started in 1996 in the basement of founder Gary Fish's home in Missouri, selling and installing network security products back when that was a small and unglamorous corner of enterprise IT. Accuvant was founded in Denver in 2002 by Dan Burns on essentially the same premise [3]. Both grew into regional security resellers with consulting practices bolted on, and both eventually attracted lower-middle-market private equity, the natural owner for a fragmented services business that can be consolidated. Sverica International took majority control of Accuvant in July 2008 [4]. Investcorp bought FishNet Security four years later, closing a majority stake in January 2013 [5]. By 2014, the two were the largest independent security resellers in North America and each other's closest competitor.

In March 2014, Blackstone agreed to acquire a majority stake in Accuvant from Sverica, with Sverica and Accuvant management rolling equity alongside [6]. Eight months later, in November 2014, Accuvant and FishNet announced they would merge, and the transaction closed in January 2015, with consideration for FishNet totaling roughly $378mm [3]. Blackstone held majority control of the combined company, with Investcorp, Sverica, and management retaining minority positions. The business ran under both legacy brands for another six months before launching the Optiv name in August 2015 [5]. By this point, the company had pro forma 2014 revenue of $783mm, adj. EBITDA of roughly $72mm, more than 1,400 employees, and over 300 vendor partnerships. Notably, the revenue mix looked very different from the one we described above. VAR accounted for roughly 80% of the total, with services comprising the remainder [3]. The shift toward services that management would spend the next decade chasing had not yet started.

In May 2015, less than four months after the merger closed, Optiv incurred additional debt to fund a $242mm dividend to its owners [3]. Following this dividend, the company carried roughly $629mm of debt, against adj. EBITDA of $98mm, implying ~6.5x leverage, a meaningful figure for a business that had been a pair of regional resellers eighteen months earlier [3]. Blackstone then looked to exit, running a dual-track IPO and sale process, and filed confidentially with the SEC in October 2015 [3].

However, the sale track won, and KKR announced its acquisition of a majority stake in December 2016, closing on February 1st, 2017 [7]. The transaction valued Optiv at ~$1.9bn against LTM adj. EBITDA of $155mm, a ~12x multiple [8]. Investcorp and Sverica exited entirely, while Blackstone and management rolled minority stakes forward [9]. KKR funded the purchase with $1.03bn of debt and a ~$900mm equity check, resulting in a ~54% LTV and pro forma total leverage of 6.6x. The debt comprised an $800mm 1L term loan due January 2024, a $230mm 2L term loan due January 2025, and an undrawn $100mm revolver. KKR's thesis was a structural pivot towards the higher-margin service and solution capability, along with deeper geographic reach [7]. 

Following the buyout, remarkably, little happened in terms of continued add-on acquisitions. During KKR’s hold, Optiv made no notable acquisitions for six years. For a sponsor that had just paid up for what Blackstone described as the first national acquisition platform in cybersecurity, the absence of add-ons was odd. It meant the growth thesis had to be delivered organically, and it was. Client count climbed toward 6,000, Fortune 100 penetration rose from 57 accounts to 73, and the company moved into a new Denver headquarters in 2018 [1]. However, the mix problem stayed, and in April 2020, KKR replaced CEO and co-founder Dan Burns, who had been with the company since its 2002 inception as Accuvant, with Kevin Lynch, a longtime Deloitte senior partner, signaling a continued push toward higher-margin services [10]. 

The one acquisition KKR did make arrived in March 2023, when Optiv acquired ClearShark, the federal reseller and advisor discussed above. Roughly $95mm of proceeds from a new financing, which we’ll detail below shortly, went to fund it [11]. Moody's treated the acquisition itself as leverage-neutral given ClearShark's EBITDA contribution [12]. By the spring of 2023, the platform Optiv would carry into distress was fully assembled, comprising two segments, a federal arm, roughly 6,000 clients, and more than 450 vendors. 

Path to Distress

Optiv's entry capital structure did not look like one that would end up in a restructuring. The equity check covered nearly half the purchase price, so KKR had real money underneath the debt. At the roughly 1% base rates prevailing in January 2017, the 1L cost about 4.25% and the 2L about 8.25%, putting cash interest near $53mm against $155mm of adj. EBITDA, or coverage close to 3x with the nearest maturity seven years out. On the surface, this was a fairly financed business.

Six years after the buyout, Optiv entered 2023 marketing a refinancing to raise a $725mm first lien term loan due August 2026, a $185mm second lien due August 2027, and upsize the asset-based revolver to $300mm due May 2026 [13]. Importantly, the second lien included a PIK toggle and was never broadly syndicated, going instead to a small group of private credit holders [11]. It’s worth noting that what actually closed was not quite what was initially marketed. By mid-2023, the first lien term loan was described as $650mm and the second lien as $260mm, which implies the same $910mm of term loan debt included a smaller 1L and a 2L upsized to fill the hole [14]. 

Optiv marketed the deal at ~6x net leverage on $165.6mm of pro forma adj. EBITDA. However, Moody’s total leverage number sat at 7.6x, with the gap reflecting differing views on acquisition EBITDA and unrealized synergies. More importantly, Moody’s expected EBITDA margins to remain around 4%, well below the 7-8% adj. EBITDA margins Optiv had reported around the time of its IPO filing nearly a decade earlier [3][12]. These slim margins, characteristic of the VAR model, left little room for error, as modest slippage in gross margin could translate to outsized swings in EBITDA. 

The more consequential change of the refinancing was the cost of the debt. The 2017 structure was priced at L + 3.25% on the 1L and L + 7.25% on the 2L against base rates of roughly 1%, producing all-in coupons near 4.25% and 8.25%. By 2023, the 1L had repriced to S + 5.25% and the 2L to S + 10.50%, while base rates had risen to roughly 5%. Some of the widening reflected deterioration in the credit, with Moody’s leverage increasing from 6.6x at the LBO to 7.6x pro forma, but Optiv was also refinancing into a much tougher market for B- technology issuers and against a near-term maturity deadline. On roughly $910mm of term debt, higher base rates alone added approximately $36mm of annual interest, while wider spreads added another ~$22mm. Including the drawn ABL, annual interest expense rose from roughly $53mm at the LBO to approximately $114mm after the refinancing, even though funded debt had barely changed. Interest coverage fell from nearly 3x to roughly 1.45x on the EBITDA the deal was marketed on, before any operating underperformance. Notably, Optiv did elect to PIK the 2L right away, which eased the near-term cash interest burden, but allowed the junior balance to compound rapidly.

Before we move on, it is worth stating what the April 2023 structure required in order to work. First, EBITDA had to grow from the marketed base, with true deleveraging to the low-to-mid 6x area assuming continued EBITDA expansion. Second, the add-backs had to be real, meaning ClearShark had to contribute its share of EBITDA and the synergies had to take effect. 

These assumptions did not hold, and the deterioration was actually already underway. Optiv's EBITDA fell roughly 60% year over year in the first quarter of 2023 and roughly 30% in the second, leaving the first half down about 40% [14]. Organic revenue declined in the high single digits despite strong demand for security software, as clients stretched implementation cycles and deferred discretionary consulting projects. Compounding the revenue declines, costs moved the other way. Second quarter SG&A rose almost 12% on sales headcount growth and on acquisition and integration expense tied to ClearShark. In response, management actioned roughly $30mm of headcount reductions in the middle of 2023, aimed at underutilized and underperforming staff. Despite the cost-cutting, full-year EBITDA was still on track to finish down about 20%, or at roughly $130mm against the $165.6mm the deal was sold on, and leverage reached 10x by year-end, after being marketed at 6x just months earlier. Cash flow moved the same way, roughly breaking even for 2023, despite projections of ~$20-50mm [14]. 

Nevertheless, 2024 opened the door for a recovery. S&P had forecast EBITDA growth north of 20% coming off the 2023 cost reductions, with free operating cash flow turning positive, helped by the roughly $40mm of annual cash interest the 2L PIK toggle was saving [14]. However, neither the EBITDA nor cash flow improvements arrived. H1 2024 revenue fell 2% against the prior year with reported EBITDA down 13%, the fifth revenue decline in seven quarters, and the full year forecast was revised to a 10% to 15% EBITDA decline. The 2023 savings had been absorbed by higher personnel expense from a rebuilt leadership bench and by continuing ClearShark integration costs [15]. By the end of 2024, leverage reached approximately 16x, or about 11x pro forma for cost actions then underway [16]. Against roughly $1bn of funded debt, 16x implies adj. EBITDA near $65mm, less than half the marketed figure twenty months earlier. FCF for the year was modestly negative, even with the roughly $50mm of PIK interest accruing on the 2L [16]. 

Optiv’s deterioration continued in 2025. First quarter revenue continued to fall roughly 3%, with Security Services off approximately 6% while VAR grew modestly, as the half Optiv was trying to grow was the half that was shrinking [17]. Managed services bookings grew, but low single-digit declines in commercial services bookings and high single-digit declines in consulting canceled the gain, and deferred revenue kept contracting. EBITDA margins held roughly flat year over year on a smaller base, so absolute EBITDA fell again, and the company continued burning cash. Leverage passed ~15x by March and kept climbing from there. For the full year, leverage reached ~20x, which implies adj. EBITDA of roughly $55mm against $1.15bn of funded debt. 

The operating problems underneath the numbers were identifiable, the largest of which was the company’s sales force. Optiv lost sales staff through 2023 and hired to backfill, then restructured commissions and sales support again across 2024 and 2025. Each sales force restructuring reset the clock on people who take several quarters to become productive [18]. Over the years, Optiv had historically struggled to right-size its sales force, with headcount growth repeatedly outpacing profit growth. During Pari Passu channel checks, former employees described the churn as self-reinforcing, with quota changes prompting departures that the company then backfilled with reps who needed another year to ramp. Additionally, the company was also winning business on price. A meaningful share of the company’s margin recovery plan consisted of nothing more than discounting less aggressively, which helps to illustrate what the prior years' business had cost to win [18]. Channel checks pointed to similar issues on the consulting side, where former directors and industry observers described persistent middle management turnover and inconsistent project delivery as structural issues, which made the practice harder to scale back up once demand returned. 

As we noted above, the one lever that kept free cash flow near breakeven was the PIK toggle. Electing to PIK the 2L saved roughly $40-50mm of cash per year. The company was, in effect, financing its senior cash interest by issuing more junior debt. The second lien went from roughly $260mm at closing to about $330mm at the end of 2024, and to nearly $400mm by the time an eventual deal was negotiated. The PIK toggle preserved near-term liquidity but simply capitalized the burden, progressively increasing the amount Optiv would eventually need to refinance, repay, or equitize. 

In terms of liquidity, at the April 2023 closing, Optiv had an estimated $25mm of cash and roughly $200mm of availability under the new $300mm ABL, totaling ~$225mm of total liquidity. Nearly three years later, by Q1 2026, ABL availability had dropped to $89mm, with $19mm of cash on hand, totaling ~$108mm [19]. The roughly $120mm decline in liquidity likely reflected a combination of cash burn, incremental ABL usage, and a shrinking borrowing base as receivables declined alongside the business. By late 2025, the company began looking to address the broader issue. Optiv explored an asset sale of its managed services business to help address upcoming maturities, but it ended up fizzling out [20]. Notably, managed services was the highest-margin, stickiest, most defensible thing Optiv owned, the piece the entire strategic pivot had been organized around, and the company was prepared to sell it to add a toolkit to the restructuring negotiations. 

With enough liquidity to carry the business for another year or two, the maturity wall itself was the primary catalyst for distress. The ABL, with $124mm outstanding, came due in May 2026. The first lien term loan, with roughly $640mm outstanding, followed three months later in August 2026. More than half of a roughly $1bn debt load was due inside twelve months at a company that was burning cash with a chronically shrinking top line. The company was, in 9fin's words, effectively “un-refinanceable” [21].

The debt markets also took notice, and Optiv's first lien traded from the low 80s in August 2025 to the low 70s by the end of the year. By early 2026, debt traded as low as the 40s [20]. Translated into enterprise value, with the ABL taken out ahead of the term loans, the 1L trading in the low 70s implies a business worth roughly $570mm, while the 50s implies closer to $450mm. This illustrates a stark deterioration in value, as KKR’s buyout, nearly a decade earlier, valued the business at nearly $2bn. 

During late 2025, Optiv retained Kirkland & Ellis as legal counsel and Perella Weinberg Partners as financial advisor. Eventually, the creditor body had fragmented into three distinct groups. First lien lenders holding a majority of the term loan, led by Canyon Partners and Silver Point, organized with Sullivan & Cromwell. Charlesbank, holding positions in both tranches, retained Ropes & Gray separately. The remaining second lien holders retained Willkie Farr [21]. The junior facility's concentration, a function of the 2023 decision not to broadly syndicate it, meant a handful of sophisticated holders controlled a tranche that had been quietly compounding, with no cash return, for three years, meaning the group had every reason to fight rather than accept a wipeout.

The 2026 Transaction