Sophos: Yet Another Tough Thoma Bravo Refinancing

Welcome to the 213th Pari Passu Edition.

Much of sponsor-backed software was financed in 2020 and 2021, and much of that debt comes due in 2027 and 2028. In 2026, that maturity wall collided with a market newly worried that AI would erode the value of incumbent software, forcing lenders to decide which businesses deserved more time. Sophos, the cybersecurity company Thoma Bravo took private in 2020, is a useful test case because its problem was largely one of timing. The business kept growing, but its debt had been concentrated on a single date in March 2027. With private credit unwilling to refinance on acceptable terms and the sponsor unwilling to add equity, Sophos had to negotiate for time.

The resulting September 2026 amend-and-extend pushed the maturity to 2029 at a higher cost, paired with a third-party junior PIK note and a substantial tightening of the credit agreement. The deal looks almost backward relative to a typical LME. New money sat below existing lenders rather than priming them, and the syndicated market ultimately offered terms private credit would not. It was also the third Thoma Bravo software maturity solution in a matter of months.

We’ll start with the business and the path to the Thoma Bravo buyout, then follow how the debt was concentrated into a single maturity and why that maturity became difficult to refinance. From there, we’ll turn to the A&E itself and what it tells us about the next wave of software maturities. We'll then cover the mechanics of the transaction and analyze who paid for the extension and why. Lastly, we'll close with broader takeaways on subscription software credit and what the 2026 wave of extensions means for the LME market.

Most companies are large enough to be attractive targets for cyberattacks but far too small to defend themselves. A regional enterprise with a few hundred employees may still run hundreds of laptops, servers, email accounts, and business applications, but the same three-person IT team responsible for securing those systems is also resetting passwords, fixing printers, installing software, and setting up new employees. That leaves a basic problem: the company still needs enterprise-grade security, but it does not have the people or budget to build a dedicated security operation around the clock. Sophos sells cybersecurity software and managed services that protect devices and networks, monitor suspicious activity, and respond to threats on behalf of organizations that cannot realistically build those capabilities themselves. Its core customer is therefore not the largest company with the most sophisticated security team, but the much broader universe of small and mid-sized organizations that still face the same attacks.

Sophos is headquartered in Oxford, England, and protects more than 600,000 organizations worldwide, the large majority of them small and mid-sized businesses. The company does not sell directly to end customers. Every sale runs through a network of roughly 25,000 partners, a group that includes resellers, distributors, and around 7,000 managed service providers (MSPs), outside firms that run IT on behalf of companies too small to run it themselves. Most of what Sophos sells is billed as a recurring subscription rather than a one-time license [1]. The offering spans three lines of business. Endpoint security protects individual devices, network security is anchored by the company's firewall, and security operations is the service in which Sophos analysts monitor customer environments and respond to attacks on their behalf. All three are managed from a single cloud console, which is central to how the company competes. Readers of our SonicWall research will recognize much of this model, since both companies sell firewalls to smaller businesses almost entirely through channel partners, although Sophos pairs its firewall with endpoint software and managed monitoring.

Endpoint Security:

An endpoint is any device a person uses to do their work, typically a laptop, desktop, server, or phone. Because attacks often arrive through one of these devices, protecting them is one of cybersecurity's oldest disciplines. Early antivirus software worked from a list of known malicious files, checking each new file against that list. That approach fails against new threats, and modern attackers change their tools constantly. Current endpoint software instead watches what programs do, flagging suspicious behavior regardless of whether the program has been seen before. Sophos sells this capability as Intercept X. Its best-known feature targets ransomware, detecting the rapid encryption pattern, stopping the process, and restoring the affected files. Gartner, an industry research firm, has placed Sophos among the leaders in endpoint protection for well over a decade, and the product remains the anchor of most customer relationships [1]. 

Network Security:

A firewall is the physical checkpoint at the edge of a company's network, deciding which traffic may pass between the office and the internet. Older firewalls made that decision based on addresses alone, but modern firewalls inspect the traffic itself, identifying which application generated it and whether it carries anything malicious. Sophos Firewall is sold as a physical appliance installed in the customer's office, paired with a recurring subscription that keeps its threat detection up to date. The same device can also connect branch offices over ordinary internet lines, replacing expensive private circuits through what the industry calls SD-WAN (software-defined wide area networking). One of Sophos' longstanding selling points is the coordination between its firewall and endpoint software. When the software on a laptop detects an infection, it signals the firewall, which automatically cuts that laptop off from the rest of the network without waiting for a human to intervene. That pairing was historically central to the company, and during its years as a public company Sophos generated roughly half of its billings from network products [2].

Security Operations and Managed Detection and Response (MDR):

Security software produces alerts, and alerts are only useful if someone reads them. Large companies run a security operations center (SOC), a team of analysts who review alerts around the clock, investigate suspicious activity, and contain attacks in progress. Managed detection and response (MDR) is the outsourced version of that team. Sophos analysts monitor customers' devices and networks continuously and take containment steps such as isolating a machine or disabling a compromised account. Sophos serves more than 30,000 organizations through MDR, and roughly two-thirds have fewer than 250 employees. The company expanded this business materially in 2025 by acquiring Secureworks, whose Taegis platform added extended detection and response (XDR), which pulls signals from devices, networks, email, cloud services, and user accounts into one place, along with next-generation security information and event management (SIEM) for storing and searching those records. Taegis also works with endpoint software from competitors such as CrowdStrike and Microsoft, allowing customers to buy Sophos monitoring without replacing tools they already use. More recently, Sophos has begun using AI agents to handle routine alert review, and the company reports that roughly half of MDR cases are now resolved without an analyst stepping in [1]. 

The three lines are sold and managed through Sophos Central, a single cloud console relaunched in 2026 as Sophos Fusion. For an MSP overseeing security for dozens of small clients, the ability to see every client's devices, firewalls and alerts in one place, and to bill for them monthly, is a large part of why the MSP chooses Sophos over assembling products from several vendors. The company has extended the same logic to cloud marketplaces such as Pax8, where MSPs buy and bill software for their clients.

In endpoint security, the market Sophos is most often measured against, Microsoft holds roughly 29% share and CrowdStrike roughly 17%, while Sophos sits around 5%. CrowdStrike wins large enterprises that run their own security teams and want the most advanced tools for those teams to operate. Microsoft competes differently, bundling its Defender security product into the higher tiers of its Microsoft 365 licensing, so customers already paying for those tiers see little incremental cost in using it. Sophos has responded by selling MDR as a monitoring layer on top of Microsoft's tools rather than only as a replacement for them. In firewalls, Sophos competes with larger network vendors at the upper end and with lower-cost regional providers, such as Securepoint in Germany, in price-driven small business tenders. The niche Sophos occupies sits between these pressures. Its customers are large enough to be worth attacking but too small to staff a security team, and they reach Sophos through a partner rather than a direct sales force [1]. 

Sophos's position ultimately depends on its partners and their small business clients continuing to value a specialist platform over security that larger software suites increasingly include at little added cost. 

Jan Hruska and Peter Lammer founded Sophos in 1985, and the company began life selling encryption and antivirus tools, largely to UK customers [3]. In the late 1990s, it narrowed its focus to antivirus and began expanding abroad, and outside capital followed shortly after. 3i took a minority stake in 1998, which TA Associates bought out in 2002 [4]. The early acquisitions tracked the way attacks were arriving at the time. Sophos bought ActiveState in 2003 to add spam filtering as viruses increasingly spread through email, before selling that business in 2006. The company then acquired Endforce in 2007, adding control over which devices could join a corporate network, and in 2008 Sophos acquired German encryption company Utimaco in a deal that brought Investcorp onto the shareholder register [5]. Sophos attempted to list in 2007 and again in 2009, but neither effort reached the market [6]. Instead, in May 2010, Apax Partners bought a roughly 70% controlling stake in a deal valuing the company at about $830mm. TA exited entirely, while the founders retained a minority position and remained on the board [5].

The Apax years turned Sophos from an antivirus vendor into a two-product company. In 2011 it acquired Astaro, then the fourth-largest vendor of unified threat management appliances, which combined firewall, spam filtering, web filtering and intrusion detection in a single product, and rebranded it as Sophos UTM [3]. Cyberoam, an Indian network security company, followed as the next acquisition in 2014. Kris Hagerman arrived as chief executive in 2012 and sharpened the company's pitch around the mid-market, which the large security vendors had neglected [25]. The listing finally came in June 2015. Sophos priced its shares at £2.25 for a market value of roughly £1bn, the largest software IPO in UK history at the time. The company raised about $125mm of new money for debt reduction, with the remaining proceeds going to selling shareholders. Apax retained roughly 40% after the float, while the founders held about 19%. At listing, Sophos generated roughly $450mm of annual revenue [5].

As a public company, Sophos spent its acquisition budget filling two gaps. The first was endpoint security, where its product still relied on older detection methods. Sophos bought SurfRight, whose software detected exploit behavior rather than known files, in late 2015, and Invincea, a machine learning malware detection company, for up to $120mm in 2017. Both technologies were folded into Intercept X, the company’s endpoint security product [3]. The second gap was services. In 2019, Sophos acquired DarkBytes and Rook Security, two small managed detection and response providers, and used them to launch its own managed threat response offering that year. These deals planted the seed of the services business that would later become central to the company. By the fiscal year ended March 2019, revenue had reached roughly $710mm [1].

In October 2019, Thoma Bravo offered $7.40 per share for Sophos, a roughly 37% premium to the undisturbed share price, implying an enterprise value of about $3.9bn. The price worked out to roughly 5.5x FY’19 revenue [1]. The board recommended the offer unanimously, and the deal closed on March 2, 2020. Next, we turn to how Thoma Bravo financed the purchase and how it funded the acquisitions that followed.

To start, Thoma Bravo funded the $3.9bn purchase with a Goldman Sachs-led 1L term loan of roughly $1.53bn, split across dollar and euro tranches, alongside a $125mm revolver. A club of direct lenders, including Owl Rock, Ares, and PSP Investments, provided a $420mm 2L term loan beneath it [7]. The 1L was a seven-year loan maturing in March 2027 and was covenant-lite. The only financial test sat in the revolver and sprang into force only if Sophos drew more than 35% of the facility [8]. Funded debt at close was therefore roughly $1.95bn, combining the $1.53bn 1L and $420mm second lien. Against a $3.9bn enterprise value, that leaves roughly $2bn of equity, implying Thoma Bravo and any of its co-investors put up about half the purchase price. 

Before we continue, it’s important to note how Sophos measured its earnings, since three EBITDA figures appear throughout this story. Accounting EBITDA is the figure reported in the financials, with rating agency adjustments but without pro forma add-backs. Because Sophos bills customers upfront, often for several years of service at once, cash arrives long before the corresponding revenue is recognized. Cash EBITDA captures that billing timing by adding the change in deferred revenue, so it runs above accounting EBITDA when customer prepayments are growing and below it when they shrink. Marketed/company-adjusted EBITDA is the figure Sophos and its bankers market to lenders, adding projected cost savings, restructuring charges, and other items management considers non-recurring. Each tells a different story about the same business, and the gaps between them will matter throughout.

Sophos reported cash EBITDA of roughly $181mm for the twelve months to September 2019 [24]. Against $1.95bn of funded debt, that implies entry cash leverage of roughly 10.8x. At a $3.9bn enterprise value, Thoma Bravo paid roughly 21.6x cash EBITDA. 

Those multiples look far more aggressive than a 50% equity cushion suggests, and they are unlikely to be the figures the deal was underwritten on. Take-privates of listed software companies are typically financed on pro forma EBITDA that credits the sponsor's planned cost reductions, and rapid margin expansion after closing is central to Thoma Bravo's playbook. The cuts at Sophos arrived quickly. By early 2021, Moody's put leverage at roughly 7.7x cash EBITDA on essentially the same debt, implying cash EBITDA of roughly $250mm [8]. Revenue barely moved over the same period, at roughly $709mm for calendar 2020 against $711mm for fiscal 2019 [8], so almost all of the roughly $70mm increase came from cost. Even then, Moody's put the same debt at close to 10x on an accounting basis, a reminder of how much of the improvement depended on billing timing rather than reported earnings [8]. 

The structure therefore rested on three assumptions. First, cost savings had to arrive quickly and keep coming, lifting cash EBITDA toward the $300mm to $310mm Moody's expected by FY’22. Second, revenue growth had to take over from cost cutting and bring leverage down toward 6.5x to 7x [8]. Lastly, and unstated at the time because it seemed safe in 2020, the syndicated market had to be open to refinance a software credit well before March 2027. As we'll see, the first two largely held. The third did not. 

Before any of that, the first change to the capital structure came less than a year after closing. In February 2021, Sophos raised a $380mm add-on fungible with its existing 1L term loan and used it, together with balance sheet cash, to repay the $420mm 2L in full. The swap saved roughly $20mm of annual interest, since the 2L had carried a much higher spread. The transaction was effectively leverage neutral. More importantly, every dollar of funded debt now sat in a single 1L tranche, and the 1L lost the subordinated cushion that had previously sat beneath it in a downside [8]. That tranche also now carried a single maturity, March 2027. 

Tuck-Ins and the Turn Toward Services:

Next came another run of small acquisitions aimed at the managed services business. In the summer of 2021, Sophos bought Capsule8, which extended its detection to Linux servers and cloud containers; Braintrace, which spotted suspicious patterns in network traffic, and Refactr, which automated the routine steps analysts take when responding to an alert. SOC.OS, a BAE Systems spinout that grouped and prioritized alerts from third-party tools, followed in 2022 [9]. None of these deals disclosed a price or were accompanied by new debt. 

The services pivot also reshaped the cost base. In January 2023, Sophos cut roughly 10% of its workforce as it redirected resources toward managed detection and response [10]. Leadership then turned over, as Kris Hagerman stepped down in early 2024 after twelve years as chief executive, and Joe Levy, who had joined Sophos as chief technology and product officer in 2015 after senior technology positions at Blue Coat and SonicWall, took the role in May 2024 [1]. Levy's first major move would be the most transformational acquisition yet.

In October 2024, Sophos agreed to acquire Secureworks, the Atlanta-based security operations provider in which Dell controlled roughly 79% of the shares and 97% of the voting power. The price was contested. Secureworks' information statement shows that Thoma Bravo and Sophos raised their offer from $7.50 per share to $8.25 and then $8.35 while the board continued a parallel process with a rival bidder, before the parties settled at $8.50 per share. That valued the business at roughly $859mm [11].

The company Sophos was buying had been shrinking. Secureworks' revenue fell 21% in the fiscal year ended February 2024 to roughly $366mm as it wound down legacy managed services contracts, while adjusted EBITDA was a loss of roughly $28mm [12]. Taegis was the growth engine, but even there recurring revenue growth had slowed to 5% by the quarter before signing, reaching roughly $290mm [13]. At $859mm, Sophos paid about 3x recurring revenue for a business that was roughly breakeven by the time of the transaction. 

The financing compounded the 2021 decision. Sophos raised a $650mm incremental term loan at S+3.50% to fund most of the purchase. The new loan matured in March 2027 alongside the existing 1L debt, giving Sophos barely a year before it became current after the deal closed in February 2025. We expect that the company used ~$200mm of balance sheet cash to fund the remainder of the acquisition. Adding the original $1.53bn first lien, the $380mm 2021 add-on, and the $650mm incremental loan produces roughly $2.6bn of gross first-lien issuance, which reconciles to the roughly $2.5bn outstanding in 2026 after amortization and currency movements [14]. The 1L debt load was therefore roughly two-thirds larger than at the original buyout, with essentially the entire capital structure coming due in March 2027.

What Held, and What Broke:

To start, the standalone business largely did what the 2020 structure asked of it. Moody's had projected revenue growth of 5% to 10% a year, and Sophos did better [8]. Revenue rose from roughly $709mm in calendar 2020 to roughly $1bn by 2023, or about 12% a year. By the fiscal year ended March 2025, leverage had fallen to roughly 6.3x from 7.6x after the 2L refinancing on the cash EBITDA basis Moody's had used since the buyout. On an accounting basis, leverage fell to 7.8x from roughly 9.9x over the same period [17]. On roughly $2.5bn of debt, those multiples imply cash EBITDA of about $400mm and accounting EBITDA of about $320mm. The original underwriting largely worked. The trouble came later, first with Secureworks and then with the refinancing market.

On Secureworks, Sophos bought a business whose legacy revenue was shrinking and whose growth product was decelerating. The integration itself went roughly to plan, and most targeted synergies were captured, but retention disappointed. Gross retention on Taegis ran in the mid-80% range since the acquisition [1]. In the first nine months of FY’26 (April to December 2025), renewals came in below expectations, causing Secureworks' recurring revenue to shrink [17]. Channel checks also suggested that many Secureworks accounts were enterprise customers that fit poorly with Sophos' partner-led mid-market model. Sophos cut a further 6% of its workforce in early 2026 as it worked through the combination [1]. Combined recurring revenue still grew 6% in the quarter ended June 2026, but S&P forecast revenue growth of only 3% to 5% for fiscal 2027 and 2028, well below the pace that standalone Sophos had delivered earlier in the Thoma Bravo hold [16].

The more important deterioration showed up in cash rather than earnings. Sophos' results for the first nine months of fiscal 2026 fell short of expectations mainly because billings declined even as recurring revenue continued to grow. Customers that had once prepaid for two or three years of service increasingly paid annually, a shift Sophos accelerated when it reoriented its fiscal 2026 targets around recurring revenue rather than billings. The revenue Sophos ultimately recognized was unchanged, but the cash arrived later [17].

Cash EBITDA captures the benefit of prepaid revenue. As billing duration shortened, Moody's projected cash leverage rising toward 9x in fiscal 2026, implying a decline in cash EBITDA towards $280mm, down from roughly $400mm the year before. Accounting leverage, by contrast, improved to 7.3x, implying EBITDA of roughly $340mm [17]. The metric that had flattered Sophos since the buyout had turned against it. In 2021, multi-year prepayments pushed cash leverage to 7.6x against accounting leverage of 9.9x; by fiscal 2026, the relationship had reversed. Management responded with a cost program built around greater internal use of AI, which Moody's identified as one path to rebuilding margin.

As a result, Sophos looked quite different depending on which EBITDA figure was used. When Goldman later marketed the debt, it used trailing EBITDA of $537mm, implying 1L leverage of roughly 4.6x. That figure was roughly 60% above the approximately $340mm of accounting EBITDA implied by Moody's figures, even though both described substantially the same period. Most of the gap likely came from add-backs for projected cost savings, restructuring charges, exceptional items, and capitalized software development. A gap of that size is not uncommon for sponsor-backed software and is not in itself a warning sign, but it does explain why the EBITDA definition became one of the main areas lenders tightened in the new documents, which we'll cover shortly.

Then the market turned. Software loans sold off early in 2026 on fears that AI would erode the value of incumbent software. The launch of Anthropic's Mythos Preview in April drew fresh short interest into cybersecurity loans, with Sophos quoted in the mid-90s [18]. The loan recovered to around 97 in May before falling as low as 93 in June. By June, the issue was no longer operating performance so much as whether Sophos could cleanly refinance $2.5bn before March 2027. 

A Refinancing Problem, Not a Cash Problem

Sophos held roughly $300mm of cash at the end of 2025 alongside a $92.5mm revolver due in December 2026, giving it nearly $400mm of liquidity [17]. The business was also generating enough free cash flow to service its debt even if refinancing costs rose [19]. Results for the quarter ended June 2026 showed recurring revenue up 6%, billings up 9%, and EBITDA up 10% to $120mm. Against roughly $185mm of annual interest, $537mm of marketed EBITDA covers interest about 2.9x, while the roughly $340mm of implied agency EBITDA covers it about 1.8x. Neither measure suggests an immediate liquidity crisis. The business was growing modestly and paying its bills; the problem was that nearly the entire capital structure had a maturity date the market was increasingly reluctant to refinance.