AppsFlyer

1.1 Identity and business model

AppsFlyer was founded in 2011 and is headquartered in San Francisco according to Forbes' September 2025 company profile. Its core product answers an economically important marketing question: which campaigns, partners, and channels drove an app install or post-install event. AppsFlyer's own materials frame the company as having expanded beyond that mobile-attribution starting point into a Modern Marketing Cloud that also covers deep linking, fraud protection, advanced analytics, data collaboration, and AI-supported workflows. The retained materials support a software measurement and analytics identity, but they do not disclose current pricing architecture, contract duration, or the mix of subscription and usage-based revenue.[CO001, CO002, CO003, CO004]

1.2 Scale, leadership, and organizational visibility

Oren Kaniel is identified as chief executive and co-founder by both AppsFlyer and Forbes, providing strong evidence for the top operating role. Scale indicators are substantial but unevenly dated: AppsFlyer's June 2026 announcement says the company serves more than 15,000 brands, while Forbes' September 2025 profile reports more than 100,000 apps, 1,400 employees, an approximately $2 billion company value, and 60% market share. These are not interchangeable measures and should not be blended into a current valuation or revenue estimate. The assigned evidence does not establish a current executive roster, board composition, governance rights, or succession plan, leaving key-person and oversight diligence open.[CO005, CO006, CO007, CO008, CO009, CO010]

1.3 Capital structure and strategic stakeholders

On June 22, 2026, AppsFlyer announced a definitive investment agreement with Moloco, Google, Meta, and Unity. The company says each investment is minority, non-controlling, non-exclusive, and without preferential access to APIs, measurement signals, attribution logic, or commercial terms. It also says the transaction combines shareholder liquidity with new long-term strategic equity participation. Those protections matter because the investors include major ecosystem participants whose platforms and advertising economics intersect with measurement. However, the retained announcement does not disclose transaction size, security terms, primary versus secondary proceeds, ownership percentages, valuation, or governance rights, so it cannot support a new total-raised or cash-available figure.[CO013, CO014]

1.4 Milestones and risk signals

The operating history combines growth markers with two adverse signals. Forbes reported that AppsFlyer had laid off approximately 100 employees and linked the action to increased AI investment and prioritization of higher-value initiatives. Separately, Reflectiz reported that malicious JavaScript was injected into the AppsFlyer Web SDK on AppsFlyer's CDN between March 9 and March 11, 2026, replacing cryptocurrency wallet addresses while the legitimate analytics functions continued. UpGuard's October 20, 2026 vendor-risk page confirms continuing external monitoring across five risk categories, but the accessible text does not expose a score or prove incident closure. Customer impact, remediation completeness, regulatory follow-through, and retention effects therefore remain unresolved.[CO011, CO012, CO015, CO016]

1.5 Exhibits

2.1 Market boundary and substitutes

The investable category is narrower than digital advertising and broader than install attribution alone. At its core, AppsFlyer links campaigns, partners, and channels to app installs and post-install events so marketers can assess user-acquisition and retargeting performance. The company now positions that measurement layer across mobile, web, CTV, PC, and console, with deep linking, fraud filtering, data collaboration, and governed signal infrastructure as adjacent workflows. Included spend is therefore software and data infrastructure used to measure, route, validate, and optimize marketing outcomes; ad inventory, creative production, general-purpose cybersecurity, CRM, and cloud compute remain outside the boundary. Native ad-platform dashboards, internal analytics, and manual reconciliation are status-quo substitutes rather than additional market segments. This boundary matters because counting media spend or the full martech stack as AppsFlyer's addressable market would materially overstate its commercial opportunity.[CM001, CM002, CM015]

2.2 Evidence-constrained sizing

The assigned evidence provides scale proxies, not a spend-denominated market size. AppsFlyer says it is trusted by 15,000 brands, while a secondary synthesis reports an ecosystem of more than 10,000 technology partners. Its 2025 Performance Index reportedly covered 16.2 billion installs from more than 39,000 apps, 9.6 billion remarketing conversions, and 88 media sources. A separate company fraud study analyzed more than 100 billion installs across more than 246,000 apps. These figures demonstrate a large observable activity surface, but the populations, periods, and denominators differ and cannot be stacked into TAM, SAM, or SOM. None of the retained sources discloses category revenue, customer ACV distribution, eligible advertiser spend, penetration, or a consistent CAGR. The sizing conclusion is therefore deliberately constrained: demand appears broad and data-intensive, while the monetary opportunity remains an underwriting gap.[CM003, CM004, CM005, CM006, CM016]

2.3 Buyers, users, payers, and adoption path

The economic buyer is most plausibly the leader accountable for growth, performance marketing, or marketing analytics; daily users include acquisition managers, analysts, lifecycle teams, and agency operators, while the advertiser generally pays. This role mapping is an inference from the documented workflow rather than disclosed procurement data. WMTips' archived detected-site sample indicates use across online shopping, finance and banking, business, marketing and merchandising, travel, and software and hardware, with the United States representing 31% of observed sites. Adoption should begin when multi-channel spend makes campaign-to-outcome reconciliation valuable, then deepen through SDK or API integration, postbacks, deep links, fraud controls, and cross-platform reporting. Agencies and multi-brand enterprises add account governance requirements. Security, privacy, finance, and procurement stakeholders can veto deployment even when marketing owns the budget, especially where third-party JavaScript reaches transaction or authentication flows.[CM008, CM009, CM011, CM012]

2.4 Growth drivers, constraints, and valuation relevance

The durable demand driver is measurement complexity: more channels, privacy constraints, fraud, and AI-based optimization increase the value of standardized and auditable signals. AppsFlyer's 2025 fraud study says fraud rates were broadly flat while absolute fraudulent-install volume rose as marketing investment grew, illustrating why clean measurement can remain valuable even without a rising fraud rate. The counterweight is trust and switching risk. Independent security vendors reported that the AppsFlyer Web SDK was compromised from March 9 to March 11, 2026, allowing malicious code to propagate through a trusted dependency. That event does not establish customer losses or churn, but it makes vendor-risk review, script integrity, remediation evidence, and contractual assurance more important in adoption timing. Valuation should therefore reward data scale and workflow breadth only after diligence establishes monetization, retention, security recovery, and the portion of observed activity that converts into addressable recurring software revenue.[CM007, CM013, CM014, CM016]

2.5 Exhibits

3.1 Landscape and scale

The competitive set is broader than a two-vendor mobile-attribution comparison. Tracxn classifies 452 active competitors, including 30 funded companies, and names Singular, Branch, and InMarket as leading peers; its ranked list also includes acquired incumbent Adjust and smaller specialist Tenjin. Toolradar reports that visitors most often compare AppsFlyer with Adjust, supporting Adjust as the clearest direct buying alternative in the available evidence. AppsFlyer nevertheless appears unusually well resourced: Tracxn reports $1.3 billion of total funding, versus $667 million for Branch, $256 million for Adjust, $50 million for Singular, and $2.5 million for Tenjin. Forbes separately reported a 60% market share as of September 2025. Those figures indicate scale, not current win rates, retention, or product superiority, and the market-share estimate has not been independently refreshed for the October 2026 run date.[CP004, CP005, CP006, CP008, CP015]

3.2 Capability breadth and distribution

AppsFlyer's differentiation is breadth around the attribution system rather than exclusive ownership of attribution itself. Its official surface markets measurement across app, web, connected TV, PC, and console, while its support documentation defines the core job as linking campaigns, partners, and channels to installs and post-install events. Toolradar and Metacto describe overlapping core attribution among AppsFlyer and Adjust, while Metacto characterizes Adjust around robust anti-fraud and Branch around deep-linking expertise. AppsFlyer's owned publishing also spans privacy regulation, gaming, app-store optimization, programmatic advertising, app metrics, and CTV, showing an effort to own a broader marketer workflow. However, the assigned evidence does not support comparable claims for every competitor or establish that breadth produces better measurement accuracy, so unsupported matrix cells remain unknown.[CP001, CP003, CP009, CP014]

3.3 Pricing, switching cost, and substitutes

AppsFlyer's public entry architecture lowers initial adoption friction but makes cost rise with paid activity. Toolradar and Metacto both report a $0.07-per-conversion Growth tier after a 12,000-conversion welcome allowance, while enterprise pricing is negotiated and premium modules can add undisclosed expense. Comparable current pricing for Adjust, Branch, Singular, and Tenjin was not present in the assigned source pool, so a defensible price ranking is not possible. Once deployed, replacement requires more than changing a dashboard: SDK event definitions, partner integrations, reporting, and raw-data pipelines must be remapped. That creates technical switching cost, but no independent churn, migration duration, multi-homing, or contract-termination data was available. The status-quo substitute is fragmented network reporting and manual reconciliation; internal build can customize measurement, but it assumes the engineering and maintenance burden that a managed platform absorbs.[CP010, CP011, CP012, CP013]

3.4 Moat durability and displacement risk

AppsFlyer's scale, broad channel coverage, installed SDK and data workflows, and brand footprint form a meaningful distribution and switching moat. The official 15,000-brand claim and Forbes' dated market-share estimate reinforce reach, while Toolradar's 917-review aggregate indicates substantial user feedback volume. Yet the same evidence shows no monopoly on the core job: Adjust is a frequent direct comparison, Branch has a focused deep-linking position, and Singular and Tenjin offer attribution alternatives at smaller disclosed funding scale. Toolradar flags expense, pricing complexity, learning curve, privacy changes, and enterprise focus; these pressures create openings for lower-cost specialists and internal stacks. Forbes' September 2025 profile also reported an approximately 100-person layoff tied to prioritizing AI and higher-value initiatives. That may improve focus, but it also makes execution against AI-led platform expansion a diligence item rather than a proven new moat.[CP002, CP007, CP008, CP015, CP016]

3.5 Exhibits

4.1 Revenue model and value delivery

AppsFlyer's public product surfaces describe a broad enterprise platform rather than a single transaction product. The customer value chain begins with campaign, partner, install, and post-install event data; AppsFlyer then attributes outcomes, standardizes and fraud-filters signals, and supports optimization or deep-linked customer journeys. This supports a recurring software or platform-access interpretation, but the retained evidence does not establish contract units, minimum commitments, usage tiers, or whether measurement, fraud protection, deep linking, data collaboration, and AI are separately priced. Those capabilities should therefore be treated as commercialization areas, not verified revenue streams. Their infrastructure, data-processing, governance, fraud-detection, and support requirements are also plausible gross-margin drivers, but the sources provide no cost allocation with which to quantify the effect.[CI001, CI003, CI011, CI012]

4.2 Pricing, go-to-market, and traction proxies

The official experience is sales-led: the homepage asks prospects to request a demo, while the knowledge base directs users into an account-based product workflow. No list price, contract length, discount schedule, or realized price appears in the retained official material. Public outcome examples and AppsFlyer's claim of 15,000 brands indicate reach, but neither proves average contract value, paid-customer count, expansion, or sales efficiency. A third-party estimate of $370.8 million in annual revenue and $200,200 of revenue per employee offers a directional scale proxy only; its methodology, period, and audit status are not disclosed. Forbes' report of roughly 100 layoffs in 2025, framed around AI investment and prioritizing high-value initiatives, is a useful cost-discipline signal but does not reveal CAC, payback, quota attainment, or channel economics.[CI002, CI004, CI005, CI008, CI013]

4.3 Unit economics and capital adequacy

A low-reputation third-party signal reports a $1 billion financing announced on June 22, 2026. If accurate and substantially primary capital, it would reduce near-term financing pressure; however, funding raised is not cash available, and the retained source does not disclose the primary-versus-secondary split, closing terms, cash balance, debt, burn, or use of proceeds. Workforce figures also conflict by vintage and methodology: Forbes reported 1,400 employees as of September 2025, while CompWorth presents more than 1,800 without a clear measurement date. Public evidence therefore cannot support a reliable revenue-per-employee trend, much less gross margin, CAC payback, NRR, free cash flow, or runway. The unit-economics table records these nulls as diligence requests rather than converting financing or headcount estimates into false precision.[CI006, CI007, CI009, CI010, CI014]

4.4 Financial verdict and underwriting blockers

Revenue quality is not publicly underwritable. The product breadth, customer-reach claim, and third-party revenue estimate are compatible with a scaled recurring software franchise, but they do not establish recurring revenue, renewal quality, concentration, or margin durability. The March 2026 Web SDK compromise adds a separate adverse consideration: Rescana reports malicious code distribution through the trusted SDK and an ongoing forensic investigation. That event could create remediation, support, insurance, legal, or retention costs, but no retained source quantifies any financial impact. UpGuard's external monitoring page provides a continuing diligence route, although the actual rating is gated. Investment underwriting should remain conditional on audited financials, cohort retention, customer concentration, incident-related costs, and a fully reconciled post-financing cash and capitalization schedule.[CI014, CI015, CI016]

4.5 Exhibits

5.1 Product surface and customer workflow

AppsFlyer sits between marketing touchpoints, digital properties, advertising networks, and a marketer's decision process. Its core job is to determine which campaign, partner, or channel preceded an install or post-install event, then expose the result for acquisition and retargeting optimization. Public product descriptions extend that foundation into analytics, deep linking, fraud protection, raw data and APIs, audience tooling, and a partner marketplace. The resulting suite is broader than a single mobile attribution dashboard: the company now positions it across app, web, CTV, PC, and console. However, the evidence establishes available surfaces, not adoption or performance for every module, and no public source in the assigned pool discloses module-level usage, attach rates, or realized customer outcomes.[CE001, CE002, CE006, CE008, CE014]

5.2 Attribution and operating architecture

The strongest technical evidence is AppsFlyer's own attribution documentation. It describes deterministic inputs such as install referrers, device-ID matching, preload records, platform frameworks, and deep links alongside probabilistic modeling. The decision rules prioritize clicks over impressions and deterministic evidence over probabilistic evidence when valid engagements overlap. Device-ID matching depends on identifiers supplied through networks and the SDK and, on iOS, ATT consent. The probabilistic path is described as aggregate reporting that does not identify an individual device or user. These disclosures make the logical measurement pipeline inspectable, but they do not disclose the underlying storage topology, model validation, latency, regional processing boundaries, capacity, or failover design.[CE003, CE004, CE005, CE011]

5.3 Maturity, integration, and differentiation

Product maturity is visible through a substantial support surface and coverage of multiple attribution methods, platforms, account modes, and marketing use cases. Forbes reported that the platform worked with more than 100,000 apps from 15,000 brands as of September 2025 and that AppsFlyer had launched an MCP connection between its APIs and large language models. The company also publishes topical guidance spanning privacy regulation, gaming, app marketing, app-store optimization, and CTV. Differentiation therefore appears to rest on breadth of integrations and signals, explicit attribution rules, fraud filtering, and workflow reach rather than a publicly benchmarked algorithmic advantage. No retained source provides SDK release cadence, public repository activity, uptime history, comparative accuracy, or a committed roadmap, so those dimensions remain diligence asks rather than verified strengths.[CE003, CE006, CE009, CE015, CE016]

5.4 Trust, security, and technical risk

AppsFlyer's trust proposition combines privacy-aware measurement, signal lineage, fraud filtering, auditability, and account controls such as SSO, 2FA, roles, and verification when switching advertiser accounts. Those are useful control-plane indicators, but they are company descriptions rather than independent control tests. The principal contrary evidence is Rescana's report that the Web SDK distribution was compromised from March 9 to March 11, 2026 and served crypto-stealing JavaScript through a trusted delivery path. Rescana also stated that no evidence had emerged, at the time of its report, that the Mobile SDK or backend customer data was affected; that statement is bounded and is not proof of absence. The incident turns software supply-chain integrity, customer notification, forensic closure, SRI support, and third-party assurance into material diligence items.[CE007, CE010, CE012, CE013]

5.5 Exhibits

6.1 Customer base and buying center

AppsFlyer's customer proposition is built for marketing and growth teams that need to attribute installs and post-install events across campaigns, partners, and channels. The company says it is trusted by 15,000 brands, a scale point corroborated by Forbes in September 2025, while Forbes also reported coverage of more than 100,000 apps and named CNN, Louis Vuitton, State Farm, and Whataburger as customers. Cuspera's taxonomy indicates reach across enterprise, mid-market, and small-business users and highlights Internet, information technology and services, and financial services. These are evidence of breadth, not a revenue mix: the assigned sources do not disclose customer counts, ACV, or revenue by segment, geography, or vertical.[CU001, CU002, CU003, CU004, CU005]

6.2 Adoption and named-customer proof

Public proof is abundant but uneven. FeaturedCustomers lists a large case-study catalog and surfaces outcome claims for Pixonic, Telefónica, Letgo, Hotstar, and Albertsons; Cuspera carries testimonials and outcome summaries for Fondeadora and other brands. These examples indicate that AppsFlyer can sit inside production marketing workflows, including data warehouse reporting, attribution, deep linking, and reactivation. However, the directories do not consistently identify deployment dates, baselines, denominators, paid-plan status, or whether each result was independently verified. AppsFlyer's own homepage also presents several outcome metrics without enough adjacent text to map every number to a named customer and period, so those figures should be treated as promotional proof rather than a comparable adoption series.[CU006, CU007, CU008, CU009, CU010]

6.3 Durability, renewal, and concentration

The evidence set does not permit a retention-quality conclusion. No public NRR, GRR, logo churn, renewal rate, contract-length distribution, cohort, or customer-concentration metric appears in the assigned sources. The standard MSA instead provides only contractual mechanics: subscriptions generally auto-renew absent notice at least 30 days before term end, and a renewal fee increase above 7% triggers advance notice. Those terms may support commercial continuity, but they are not proof of voluntary product retention or expansion. Likewise, the free package can be changed or discontinued and its support is discretionary, creating a conversion path but also possible onboarding and procurement friction. Diligence therefore requires private cohort and concentration data before underwriting durable expansion.[CU013, CU014, CU016]

6.4 Customer journey and channel dependencies

The customer journey runs from campaign acquisition through attribution, reporting, optimization, deep linking, and cross-channel expansion. Official documentation places campaign, partner, and channel attribution at the entry point, while customer evidence shows data flowing into warehouses and dashboards. The MSA also supports authorized-reseller and agency routes, but agency use requires prior notice and an appropriate subscription package, making channel execution contractually managed rather than frictionless. A LinkedIn recommendation describes responsive cross-functional technical support over a two-year engagement, but the fetched excerpt does not identify the recommender's organization and is weak evidence of representative service quality. UpGuard's continuous vendor-risk monitoring further indicates that enterprise adoption carries a security-review surface, although the assigned text discloses no actual rating.[CU004, CU007, CU011, CU012, CU015]

6.5 Exhibits

7.1 Incident and legal exposure

The clearest high-impact risk is the March 9-11, 2026 compromise of the AppsFlyer Web SDK. Rescana reports that malicious JavaScript was injected through the trusted distribution path and targeted cryptocurrency wallet addresses on downstream sites; it also reports that AppsFlyer remediated the issue and began an ongoing forensic investigation. Rescana found no evidence that the Mobile SDK or backend customer data was affected, but that statement is not equivalent to a completed forensic attestation or proof that no customer suffered loss. The residual legal and regulatory risk therefore turns on evidence not present in the public pool: affected-customer enumeration, regulator notices, claims or litigation, root-cause closure, and independent validation of remediation. Privacy and consent exposure is broader than this incident because device-ID matching on iOS requires ATT consent and the underlying ecosystem applies different attribution rules. The register treats severity as an analyst assessment tied to those facts, not as a disclosed probability.[CR001, CR002, CR003, CR004, CR005]

7.2 Operational, security, and model risk

AppsFlyer's operating model places trusted measurement code and attribution logic inside a complex chain spanning customer properties, AppsFlyer infrastructure, app stores, operating systems, ad networks, and consent controls. The 2026 incident demonstrates that a compromise in one distribution dependency can preserve normal analytics behavior while introducing a harmful payload, making detection and blast-radius assessment difficult. Separately, AppsFlyer's own documentation says ecosystem participants count installs and events differently; customers therefore face reconciliation risk even without a security failure. Official claims of traceable lineage, fraud filtering, auditability, and optional administrator-configured 2FA are relevant controls, but the pool does not establish that browser integrity protections, self-hosting, or comparable controls were universally implemented after the incident. The heatmap ranks residual exposure qualitatively; public evidence does not provide incident-frequency or loss-probability data.[CR001, CR004, CR010, CR011, CR013, CR014, CR016]

7.3 Platform, partner, and financial dependencies

Apple and Google are both indispensable inputs and potential substitutes. Sacra identifies privacy restrictions and platform-native attribution as risks that can reduce observability or disintermediate third-party measurement, while AppsFlyer's documentation confirms that attribution relies on app stores, self-reporting networks, identifiers, referrers, and platform-defined methods. The company is also broadening across mobile, web, CTV, PC, and console, increasing the number of frameworks and integration surfaces that must remain reliable. Execution risk is visible in Forbes' report that roughly 100 employees were laid off in February 2025 while investment shifted toward AI. Financial resilience cannot be independently stress-tested from this pool: FirmSuggest notes that detailed disclosures are limited because AppsFlyer is private, and Sacra's 2025 revenue figure is a model rather than audited company reporting. These constraints make concentration, gross-margin sensitivity, contractual liability, and insurance coverage priority diligence items.[CR004, CR005, CR006, CR007, CR008, CR009, CR013]

7.4 Mitigations, monitors, and thesis-break criteria

The immediate mitigation standard should be evidence-based rather than policy-based. Rescana recommends reviewing logs from the incident window, using known-good or self-hosted SDK builds where feasible, applying Subresource Integrity, and monitoring third-party asset changes. AppsFlyer publicly describes governed signals and publishes DMA and Privacy Sandbox resources, while UpGuard says it continuously runs more than 330 external checks; however, the fetched public UpGuard page withholds the underlying rating and findings. Investors should require the final forensic report, customer-notification scope, control test results, cyber-insurance limits, and evidence that critical browser-delivered assets are integrity controlled. Monitor regulator or court activity, recurrence of unauthorized SDK changes, attribution accuracy by method, platform API restrictions, support complaints, and gross retention after the incident. Thesis-break triggers are a material recurrence, evidence of concealed customer losses, regulatory action that restricts core data flows, or platform changes that make independent attribution uneconomic.[CR002, CR011, CR012, CR014, CR015, CR016]

7.5 Exhibits

8.1 Investment view: scale is credible, price support is incomplete

The investable case rests on a large operating footprint and a product positioned at the measurement layer between advertisers and major platforms. AppsFlyer says 15,000 brands use its platform, while Forbes reported the same brand count and more than 100,000 apps in September 2025. That scale, plus strategic minority investment from Moloco, Google, Meta, and Unity, supports the view that the asset is relevant infrastructure. The anti-thesis is equally material: financial disclosure is unaudited and sparse, approximately 100 layoffs preceded the latest financing, and the March 2026 Web SDK compromise creates a trust and retention risk that public sources do not quantify. The recommendation is therefore track/research-more, with medium-low confidence and high risk, not a price-independent endorsement.[CV003, CV009, CV010, CV011, CV012, CV013, CV014, CV015]

8.2 Financing reference and entry discipline

Crunchbase reported more than $1 billion of Series E financing at a $2.7 billion post-money valuation, and also reported $1.3 billion of known funding since inception. Those figures establish a market-clearing headline, not cash available to the company: the assigned evidence does not disclose how much was primary versus secondary, debt, fees, or preference overhang. GetLatka's $500 million ARR indication would imply a 5.4x post-money valuation-to-ARR ratio, but its page attributes that ARR to another publisher while saying the underlying source was not recorded. The multiple is consequently a screening reference rather than an underwriting conclusion. Entry above $2.7 billion is unsupported without audited ARR, growth, retention, margin, cash, and security-remediation evidence; even entry at that benchmark should remain conditional.[CV001, CV002, CV005, CV006, CV008]

8.3 Scenario framing and comparable evidence

The available comparable set is directionally useful but insufficient for a precise valuation range. GetLatka identifies Branch, Singular, Kochava, Tenjin, and Flurry Analytics as competitors and reports AppsFlyer as the largest by revenue, while Forbes supplied a prior $2 billion company-value marker from September 2025. Neither source provides audited peer growth, margins, retention, enterprise values, transaction terms, or a public-company bridge. Accordingly, the scenarios use $2.7 billion as the latest reported financing reference and make the premium or discount conditional on observable evidence. No numeric probability, target IRR, or defensible exit range can be assigned from the public inputs; doing so would turn missing private-company data into false precision.[CV001, CV005, CV006, CV007, CV008, CV010, CV015]

8.4 Exit readiness, diligence asks, and thesis breakers

Management has signaled public-market intent: Oren Kaniel told Axios, according to Crunchbase, that AppsFlyer was eyeing public markets and called the financing a step on that path. Strategic platform investors could improve commercial alignment, but they also sharpen the diligence question around independence from advertising counterparties. Before an investment, request audited financial statements, ARR and revenue bridges, NRR and GRR, customer concentration, cap-table and preference waterfalls, primary/secondary allocation, cash and debt, and a board-reviewed incident report. Thesis breakers are verified material churn after the SDK event, unresolved control deficiencies, ARR materially below the reported $500 million indication, or financing terms that place new money behind a preference stack inconsistent with the target return. A hold period and exit return should be set only after these private inputs are obtained.[CV003, CV004, CV005, CV015, CV016]

8.5 Exhibits