The synergy is real on the model and fragile in delivery. In a cyber buy-and-build, it leaks in places the integration plan rarely names.
Buy-and-build is a sound thesis in cybersecurity. The sector is fragmented, buyers want fewer vendors, and a platform that can cross-sell across a real customer base is worth more than the sum of its parts. The thesis is rarely the problem. The execution is. Synergy that looks clean in the model leaks in four predictable places, and most of them are people and motion, not spreadsheets.
The model assumes the acquired product gets sold into the platform's base. In practice the two products often serve different buyers with different proof requirements, and the existing reps cannot credibly carry both. Cross-sell that looks automatic on the slide needs enablement, new motion, and time that the value-creation plan did not budget.
Services and implementation are where cyber roll-ups quietly lose margin. Two firms with similar gross margins can have completely different delivery models, and merging them surfaces custom work, key-person dependency, and tooling debt that was invisible at signing. Consolidation that was assumed to be immediate takes quarters.
In a services-heavy cyber business, the asset goes home at night. Founders, lead architects, and the few people who know the hard accounts are exactly the ones an earn-out cannot fully hold. Lose them in the first two quarters and the synergy case loses its engine.
Two product roadmaps rarely merge cleanly. Overlapping capabilities, conflicting platform bets, and customers on incompatible versions create a remediation cost that shows up after close, not before.
None of this means the thesis is wrong. It means the synergy has to be defended, deliberately, in the window where it is most fragile. That is where an operator who has actually integrated cyber businesses earns the fee: naming the leaks before close, and building the first-180-day plan that keeps the value you underwrote from walking out the door.
