Business

Darktrace paid Thoma Bravo $840m, helped by $750m of new debt

Darktrace paid owner Thoma Bravo about $840m, helped by $750m of new debt, as growth slowed to 12.4%. What it means for UK customers.

Rising chart graphic with the headline Darktrace paid owner $840m with new debt

Darktrace, the Cambridge AI security firm, paid its private equity owner Thoma Bravo roughly $840m in November 2025, helped by $750m of new borrowing. The payout comes as the company’s revenue growth slows, and customers relying on its detection platform should be paying attention.

What happened

Darktrace paid about $840m (£627m) to Thoma Bravo, the Chicago-based investment firm that took the company private in 2024, according to group accounts lodged at Companies House on 29 October and reported by The Telegraph on 9 November 2026. The sum was a $459m dividend and $381m spent buying back preference shares, paid to the group’s parent company on 20 November 2025.

To help pay for it, Darktrace added $750m to its existing first lien term loan; The Telegraph says the debt was arranged by Goldman Sachs, which the accounts name as agent. In the City this is called a dividend recapitalisation, or dividend recap: the owner pockets a return ahead of any eventual exit, and the company services the new loan from its own operating profits. The accounts say the extra borrowing carries the original terms: interest at 3.25 percentage points over Term SOFR and final maturity in October 2031.

Those accounts put revenue up 12.4% to $922.8m in the year to June, compared with pro-forma revenue of $820.8m a year earlier. The Telegraph contrasts that with 18% growth the previous year and 27% in 2023, the last full year Darktrace spent on the London Stock Exchange. Darktrace declined to comment to the newspaper.

Thoma Bravo completed its all-cash takeover on 1 October 2024 at $7.75 a share, valuing the business at around $5.3bn (about £4.3bn), and Darktrace left the FTSE 100 as a result. Jill Popelka stepped down as chief executive in January after 16 months in the job, and Ed Jennings took over in March. The accounts record an average of 2,346 staff, and 9,729 customers at 30 June, 2.3% fewer than a year earlier.

The detail

We have checked the headline figures against the 113-page group accounts filed by Darktrace Holdings Limited, and they match. The register also shows the groundwork. On 19 November 2025, the day before the payout, Darktrace Midco I Limited filed a directors’ solvency statement and a resolution to cut its share premium. Under UK company law, a reduction of capital backed by a solvency statement is a standard route to creating distributable reserves, the accounting headroom a private company needs before it can pay a large dividend or buy back shares. Further capital reductions followed across group companies in June 2026. The accounts add that Darktrace does not expect to pay more dividends in the foreseeable future.

None of this is unusual in a buyout. Recaps are common on subscription software businesses, where recurring revenue reassures lenders. Thoma Bravo knows the UK security market well: it bought Sophos in 2020 before moving on Darktrace. The trade-off is simple. Equity holders take money off the table now, and the operating company carries a heavier interest bill for years to come.

That interest has to come from somewhere. With top-line growth now in the low teens, the room for absorbing a larger debt service charge without trimming costs, slowing hiring or pushing prices up is narrower than it would have been at the growth rates of 2023.

Key figures: $840m payout to Thoma Bravo, $459m dividend, $381m buybacks, $750m new debt and 12.4% revenue growth to $922.8m

Why it matters for UK organisations

Darktrace is not just another vendor on a procurement list. It remains one of the best-known British cyber success stories, and its network detection and response technology is used by organisations across UK sectors. For many of them, its sensors are a primary source of visibility on internal traffic and anomalous behaviour.

When a security supplier becomes more leveraged, three practical questions follow. First, will investment in research and detection content keep pace with attackers, particularly as AI-assisted intrusions speed up? Second, will renewal pricing harden as the business looks to protect margin? Third, what happens to the product if the owner later sells or merges it?

There is also a wider market signal. The UK has produced relatively few cyber companies of Darktrace’s scale, and several have ended up under overseas private equity ownership. How these businesses are financed now shapes how much they reinvest in UK engineering jobs and research, which matters to a government that wants a strong domestic cyber sector.

Expert view

I want to be careful here. A dividend recap is a financing decision, not a judgement on product quality, and there is no evidence in the reporting that Darktrace’s technology or support has suffered. Plenty of heavily geared software firms continue to ship good products for years.

But in my experience, supplier finances are one of the most neglected parts of third-party risk management. Organisations will spend weeks scoring a vendor’s ISO 27001 certificate and penetration test summary, then barely glance at its balance sheet. When we review security architectures, the tools that cause the biggest problems are rarely the ones that failed technically; they are the ones nobody planned to replace when the commercial picture changed.

Detection tooling is particularly sensitive to this. NDR products depend on a continuous stream of model tuning, threat research and integration work. If spending on that slows, the decline is gradual and easy to miss: alerts become noisier, coverage of new protocols lags, and analysts quietly lose confidence. The right response is not panic but measurement. If you rely on a single detection platform for a large share of your visibility, you should already be testing whether it catches what it claims to.

It is also worth remembering that ownership-driven change is now normal across the industry. Building that reality into vendor governance is simply good practice.

What to do now

  1. Check your contract position. Note renewal dates, notice periods, price-increase caps and any change-of-control clauses. Negotiate multi-year price protection if renewal is close.
  2. Ask direct questions at renewal. Request the product roadmap, research headcount trends and support service levels in writing.
  3. Add financial health to supplier assurance. Review filed accounts and credit information for critical security vendors annually, alongside their certifications. The forthcoming Cyber Security and Resilience Bill puts more weight on supply chain resilience for in-scope organisations.
  4. Validate detection, do not assume it. Run purple-team exercises or breach and attack simulation against your NDR and EDR tooling to confirm real coverage, and track the results over time.
  5. Keep the fundamentals strong. Detection is a safety net, not a substitute for the Cyber Essentials controls: secure configuration, timely patching, least-privilege access, malware protection and firewalls reduce what any tool has to catch.
  6. Plan an exit route. Make sure logs and telemetry can be exported to your SIEM in open formats, so that switching provider would not leave you blind.

Bottom line

Thoma Bravo has taken roughly $840m out of Darktrace, helped by new borrowing, at a time when the company’s growth has cooled to around 12%. That is a normal private equity move, and nothing in the reporting suggests customers are at immediate risk. It is, however, a timely reminder for UK security teams to treat vendor finances as part of their risk picture, keep contracts flexible and keep proving that their detection tools work.

Sources

Related Posts