canonical/modules/M105-cybersecurity-analyst-playbook.md

<!-- Generated loss-aware reference mirror from God_Level_Public_Company_Financial_Analyst_Job_Guide_V6_99_ALL_SUB70_FIXED.docx. Canonical source remains the bundled DOCX. -->

<!-- Module: 105 | Title: Cybersecurity Analyst Playbook -->

## PART XV - SECTOR PLAYBOOKS | MODULE 105

# Cybersecurity Analyst Playbook

> Mission. Build a sector-specific research system for Cybersecurity that converts operating data into financial outcomes, highlights the accounting areas most likely to distort comparability, and selects valuation methods that reflect the sector's economics.

## Economic engine and binding constraints

Model ARR, new ARR, NRR, platform/module adoption, billings/RPO, gross margin, sales productivity, CAC payback, partner channel, SBC, and FCF. Test whether consolidation improves customer economics or simply bundles discounting.

## Primary KPI stack

| KPI | Construction / analyst control |
| --- | --- |
| ARR | Annualized recurring run-rate from active contracts at period end, usually monthly recurring revenue × 12 plus other contractually recurring components; exclude one-time services. Validation: Reconcile beginning balance + additions - revenue/shipments - cancellations/adjustments to ending balance where data allow; verify cancellation rights, timing, and definition changes. |
| NRR | NRR = ending recurring revenue from beginning cohort / beginning cohort recurring revenue |
| RPO | Contracted revenue not yet recognized under ASC 606/IFRS 15-style disclosure scope; separate current RPO from amounts expected beyond 12 months. Validation: Reconcile beginning balance + additions - revenue/shipments - cancellations/adjustments to ending balance where data allow; verify cancellation rights, timing, and definition changes. |
| billings | Revenue plus period-over-period increase in deferred revenue/contract liabilities, adjusted for acquisitions, FX, and contract assets when needed for comparability. Validation: Recalculate independently from cited source data; verify definition, period, units, scope, signs, and any reconciliation to reported financial or operating totals. |
| platform mix | Revenue, bookings, workload, or customer usage attributable to the strategic platform/product family divided by the corresponding total. Validation: Recalculate from same-scope numerator and denominator; confirm period, units, cohort/geography, and issuer definition; reconcile material differences to filings or operating data. |
| seat/usage growth | seat/usage growth = current period / comparable prior period - 1; decompose organic, price, volume, mix, FX, and M&A where material. |
| SBC | Stock-based compensation expense recognized for the period, reconciled to equity awards, cash-flow add-back, and diluted share count. Validation: Tie the dollar measure to filed statements/footnotes; reconcile classification adjustments, one-time items, acquisitions/FX, and period consistency before using it analytically. |
| FCF margin | FCF margin = normalized free cash flow / revenue |



## Sector-specific accounting and comparability traps

- Contract timing: reconcile issuer treatment with peer treatment and quantify the effect on reported growth, margin, cash flow, capital, or valuation before comparing outputs.

- Deferred revenue: reconcile issuer treatment with peer treatment and quantify the effect on reported growth, margin, cash flow, capital, or valuation before comparing outputs.

- Sbc: reconcile issuer treatment with peer treatment and quantify the effect on reported growth, margin, cash flow, capital, or valuation before comparing outputs.

- Capitalized commissions: reconcile issuer treatment with peer treatment and quantify the effect on reported growth, margin, cash flow, capital, or valuation before comparing outputs.

- M&a add-backs: reconcile issuer treatment with peer treatment and quantify the effect on reported growth, margin, cash flow, capital, or valuation before comparing outputs.

## Valuation frameworks

- EV/revenue: enterprise value divided by normalized revenue; use only with an explicit gross-margin, operating-margin, growth, and capital-intensity bridge.

- EV/FCF: enterprise value divided by unlevered free cash flow; ensure interest is excluded from FCF and debt-like claims are included in enterprise value.

- Rule of 40: revenue growth plus a consistently defined profitability metric, normally FCF or operating margin; use to frame quality/growth tradeoffs, not as a direct valuation formula.

- DCF: forecast FCFF from operating drivers, discount at a capital-structure-consistent WACC, model terminal growth/ROIC coherently, and bridge enterprise value to common equity.

## Sector diligence questions

- What is the most important leading indicator for Cybersecurity, and how many months does it lead reported revenue or cash flow?

## Sector stress and falsification

- Stress ARR and NRR together in the direction most likely to break the equity story; flow the result through working capital, capex, liquidity, financing, dilution, and valuation.

- Explicitly test contract timing. Determine whether it can make the reported sector comparison look better or worse without equivalent economic change.

## 99-point standalone execution extension

### Model architecture and forecast chain

Model ARR, new ARR, retention, platform/module adoption, billings, RPO, seats/endpoints/usage, gross margin, sales productivity, and SBC.

### Leading-indicator dashboard

Track breach environment, IT budgets, platform consolidation, sales hiring, renewal commentary, cloud workloads, channel activity, and competitor displacement.

### Primary-source map

SEC filings; issuer ARR/RPO/retention definitions; CISA vulnerability and incident publications; federal IT/security spending; channel/partner disclosures; customer and cloud-platform evidence.

### Accounting normalization test

Contract timing, deferred revenue, capitalized commissions, SBC, M&A add-backs, and usage pricing changes can mask economics.

### Valuation implementation

Use DCF, EV/FCF, and revenue/gross-profit multiples with mature margin and retention. Reverse DCF should test platform consolidation and duration.

### Worked numerical mini-case

> Illustrative ARR case.

Beginning ARR $1.0bn, gross churn 5%, contraction 2%, expansion 15%, and new ARR $220m. Ending ARR = 1.0 x 1.08 + .22 = $1.30bn. Opening-cohort NRR is 108%.

Tie platform/module adoption to retention and sales efficiency, then subtract SBC dilution and capitalized commissions when judging FCF quality.

### Monitoring and falsification cadence

Breaks include retention decline, sales efficiency deterioration, platform commoditization, cloud-provider bundling, product failure/breach, or excessive dilution.

At every quarterly update, rebuild the driver bridge from operating units to revenue, margin, cash flow and valuation; compare leading indicators with the prior forecast; record definition changes; and precommit the threshold that would trigger a thesis reset rather than a cosmetic estimate change.

## Sector exit standard

The Cybersecurity work is complete only when the analyst can explain the business in its native operating units, reproduce the KPI history, identify the binding growth constraint and marginal price setter, normalize sector-specific accounting, quantify a coherent adverse case, and translate the current market price into the operating expectations that must be met or exceeded.