Exiger

1.1 Identity, Roots, and Platform Shift

Exiger’s company-overview story is strongest when read as a progression, not as a clean-sheet AI startup. Older official releases and partner case studies show a company built around regulatory, financial-crime, and due-diligence workflows for banks, corporations, and government agencies. DDIQ, Insight 3PM, and adjacent risk products created the data-ingestion, entity-resolution, and analyst-guided operating muscle that later made a supply-chain pivot believable. By September 2023, management had consolidated the public narrative around 1Exiger, and by 2026 the current website framed the business even more explicitly as an AI-native operating system for supply-chain execution, procurement acceleration, and compliance automation. That repositioning does not erase the company’s roots; it repackages them. The supportable through-line is that Exiger used compliance-grade information handling and risk judgment as the foundation for a broader platform that now promises multi-tier visibility, decision support, and workflow orchestration across supplier, product, and part data. The result is a business that still carries regtech DNA, but whose present-day go-to-market language is centered on supply-chain AI.[CO001, CO005, CO006, CO007, CO008, CO009]

1.2 Leadership, Founder Attribution, and Governance

Leadership is clearer than founder attribution, and that distinction matters. Current public materials plainly identify Brandon Daniels as CEO and the main public voice for Exiger’s AI, defense, and growth agenda. But reviewed sources do not support the idea that Daniels co-founded the business in 2013. Instead, the strongest official record shows Michael Cherkasky and Michael Beber as founders, with Daniels joining in 2017 and taking the CEO role in 2022. That transition is important because it explains why current brand messaging can feel founder-light even though founder influence still appears to matter. Publicly visible operators such as Carrie Wibben, Cameron Holt, and Eli Cherkasky show that Exiger now runs with a more mature bench across product integration, federal delivery, and operations. What remains conspicuously thin is the current post-2023 governance file: public materials do not provide a full board roster, voting-right summary, or detailed control map after Carlyle and Insight’s majority investment. For diligence purposes, management quality looks strong, but the control structure behind that management team is still only partially visible.[CO002, CO003, CO004, CO010, CO011, CO015]

1.3 Capital Base, Scale Signals, and Customer Proof

Exiger’s capital and scale story is credible, but it is not equally transparent on every point. Public disclosures confirm an $80 million Carrick growth investment in 2018 and a Carlyle/Insight majority investment in December 2023. Independent coverage later described the latter transaction at roughly a $1.2 billion valuation, which is directionally consistent with Exiger’s current “unicorn” framing even though the company itself did not publicly spell out the exact valuation or investment amount. Customer traction is more supportable than economic detail. Current official materials repeatedly cite roughly 550-plus customers, 150 Fortune 500 relationships, and 60-plus government or Defense Industrial Base organizations. Named proof is also available: Oshkosh appears in supply-chain case work, SMBC is a documented bank customer for DDIQ, and the U.S. Army provides marquee federal validation. Scale metrics still require caution. Employee count lands in an 850-to-1000 range across official and independent sources, while a Forbes interview supplied a greater-than-$150 million revenue estimate for 2024 but not ARR. That means scale is real, but the economic precision still falls short of what a full underwriting process should demand.[CO012, CO013, CO014, CO016, CO017, CO018]

1.4 Milestones, Acquisitions, and Risk Signals

The milestone sequence is one of the clearest ways to understand Exiger’s current identity. After building its early compliance and diligence footprint, the company spent 2022 through 2024 stitching together a broader operating stack: Daniels’ CEO elevation in 2022, the 1Exiger launch in 2023, and the Versed AI and XSB acquisitions in 2024 all pushed the business toward deeper product-aware supply-chain intelligence. The 2025 Army award and 2026 Platform One marketplace status then reinforced that Exiger had crossed from compliance-adjacent tooling into mission-grade government supply-chain infrastructure. Those are real positives, but this chapter should not treat the public file as spotless. The most visible negative signal in the reviewed set is a 2026 Gartner Peer Insights review that praised visibility yet criticized workflow tuning, which implies implementation complexity at least some users feel. More importantly, the public file still leaves unresolved questions around ARR, board structure, exact 2023 economics, and whether legacy brands such as ORCA and WorldCompliance remain active products or are simply absorbed into broader platform messaging. That is not thesis-breaking opacity, but it is enough to keep diligence pressure on product clarity and governance.[CO023, CO024, CO025, CO026, CO027, CO036]

1.5 Exhibits

2.1 Market boundary and included spend

The cleanest way to define Exiger’s market is not “all compliance software” or “all supply chain software,” but the narrower set of workflows where an organization must know who a supplier, counterparty, product, part, component, or software dependency really is; what legal or operational risk it creates; and what action should follow. Exiger’s own platform positioning is unusually broad across that problem set: it joins supplier, product, part, component, and risk data; explicitly spans both physical and software supply chains; and sells risk-and-compliance modules for trade compliance, supplier risk management, enhanced due diligence, third-party risk management, and know-your-customer work. That means the included spend starts with third-party and supplier diligence, sanctions and trade screening, multi-tier supply-chain mapping, and software provenance or SBOM-informed visibility. It does not extend to generic ERP, payments processing, standalone cybersecurity point tools, or logistics execution software when those tools are not resolving supplier, ownership, provenance, or compliance risk. The serviceable wedge is therefore the overlap between regulated compliance work and high-stakes procurement visibility, not every dollar touching procurement or risk.[CM001, CM002, CM004, CM005, CM007, CM008]

2.2 Buyers, workflows, and budget owners

Exiger’s buyer map is broader than a classic bank-compliance story, but the spending logic is still concentrated in teams that own procurement, compliance, legal exposure, supply continuity, and mission assurance. In financial institutions, the relevant buyers are compliance, financial-crime, legal, and risk teams that need KYC, sanctions screening, investigations, and third-party controls in one auditable workflow. In large industrials and critical-infrastructure companies, the economic buyer shifts toward procurement, supply-chain risk, supplier-quality, and trade-compliance leaders who need visibility below tier-one suppliers and across parts, materials, and jurisdictions. In defense, acquisition, program, cyber, and industrial-base teams are buying against contract eligibility, adversarial supplier exposure, and provenance risk rather than only against generic efficiency goals. The adoption path is therefore workflow-led: onboarding and screening first, then continuous monitoring, then remediation, re-sourcing, and resilience management. This multi-function ownership matters for valuation because it makes Exiger’s revenue opportunity depend on whether risk tools can embed into operational decision-making, not just whether a compliance department budgets for another watchlist feed.[CM003, CM006, CM007, CM041, CM042, CM043]

2.3 Sizing lenses and contradictory estimates

The public evidence supports a real and growing market around Exiger’s workflows, but not a clean single-number TAM. The third-party risk management category alone ranges from about $8.09 billion to $9.34 billion in retained 2026 estimates, while a broader Grand View lens emphasizes North American concentration and long-run growth rather than a directly comparable 2026 point. Supply-chain risk management is even more dispersed: retained 2026 values run from $3.73 billion to $6.91 billion depending on whether the publisher emphasizes core software-and-services spend or a wider solution perimeter. Sanctions screening is the clearest warning against false precision, because the retained 2026 market can be as small as roughly $587 million for software-only screening or as large as $4.2 billion for broader screening solutions. Those numbers are useful only if they stay separate. They should not be summed into a single Exiger TAM because categories overlap in buyer, workflow, and product scope. The most defensible conclusion is that Exiger sits at the intersection of several mid-sized and fast-growing categories, with the defense-industrial visibility wedge especially important strategically but not cleanly isolated in public market-size data.[CM011, CM012, CM013, CM015, CM016, CM017]

2.4 Regulatory drivers, constraints, and diligence gaps

Exiger’s market is being pulled forward by hard regulation, industrial policy, and the availability of AI-based automation. In defense, CMMC and DFARS contract clauses turn cybersecurity assurance into a contract-gating requirement, while the DoD’s industrial strategy and proposed ownership-disclosure expansion deepen demand for sub-tier visibility. In trade and human-rights compliance, UFLPA enforcement has become more transaction-specific and data-intensive, and OFAC plus BIS rules keep sanctions and export-control screening continuously current rather than episodic. EO 14017 and CHIPS-related policy extend the logic beyond compliance into national-security resilience and upstream component traceability. The constraints are just as real. Buyers still face integration and data-quality burdens, false-positive review load, slow budget cycles, and incumbent workflows that are hard to replace. Defense use cases add sensitive-data and auditability constraints that limit simple plug-and-play deployment assumptions. The practical takeaway is that Exiger’s market has strong external drivers, but monetization depends on whether customers can operationalize the data with acceptable implementation effort and enough precision to avoid drowning analysts in noise.[CM009, CM022, CM023, CM024, CM025, CM026]

2.5 Exhibits

3.1 Landscape and Solution Classes

Exiger does not compete in one neat software box. Buyers can solve overlapping pieces of the job with data-led screening vendors, workflow-first TPRM suites, or graph-driven supply-chain intelligence platforms. Dun & Bradstreet, LSEG, LexisNexis Risk Solutions, Sayari, and K2 Integrity matter when the buying center wants sanctions, KYC, AML, or due-diligence intelligence. Coupa, ProcessUnity, Aravo, Ivalua, and Supply Wisdom matter when the buyer primarily needs onboarding, questionnaires, approvals, and continuous supplier monitoring inside an operating workflow. Sayari and Interos matter most when the buyer believes the real risk sits below tier 1 and wants network mapping, ownership resolution, or critical-node visibility. That split is why Exiger's pitch is broader than classic vendor-risk software. Its public materials frame one platform that mixes supply-chain intelligence with workflow execution and a federal or defense-grade deployment story. The competing substitute is not only another standalone vendor. It is also a composable stack where a buyer pairs a screening dataset with a procurement suite and accepts a narrower, but cheaper, operating model.[CP023, CP024, CP025, CP026, CP027, CP029]

3.2 Capability Overlap by Job

The overlap changes materially by capability. D&B and LSEG are strongest where verified entities, sanctions coverage, PEPs, adverse media, onboarding efficiency, and structured screening data matter more than deep supplier-network context. LexisNexis and K2 Integrity extend that same financial-crime lane, though K2 stays more services-led than platform-led in the retained set. Workflow specialists attack from another angle. Coupa, ProcessUnity, Aravo, and Ivalua all promise to speed onboarding, centralize risk decisions, and keep teams inside familiar approval paths. Supply Wisdom narrows further into continuous monitoring and location risk. Exiger looks most differentiated when the buyer wants those workflow benefits plus supply-chain graphing, critical-node analysis, and public federal credibility in one stack. Sayari and Interos are the most serious challenges to that graph side. Sayari argues questionnaires miss sub-tier sanctioned or forced-labor exposure and replaces them with trade and ownership evidence. Interos attacks the same blind spot through resilience mapping, automated monitoring, and ERP-linked suggestions. Hackett's public description of Exiger's component, hardware, and software-level analysis supports a real wedge, but not a monopoly wedge.[CP006, CP007, CP008, CP009, CP010, CP011]

3.3 Packaging, Win-Loss Logic, and Bundle Pressure

Packaging is where the incumbent threat becomes concrete. LSEG publicly offers the easiest low-friction entry in the retained set through API-first World-Check On Demand and points-based World-Check One packages. D&B is more sales-led, but its 2026 agentic release shows the same strategic direction: wrap proprietary data in workflow automation rather than sell raw records alone. Coupa and Ivalua increase the pressure from the opposite side by selling supplier-risk functionality from inside an existing spend platform, which can let a procurement team satisfy a risk mandate without sponsoring another standalone purchase. ProcessUnity and Aravo are harder to dismiss in workflow-led evaluations because they specialize in configurable third-party programs, not just generic supplier master data. The win-loss logic therefore is fairly crisp. Exiger is advantaged when buyers care about federal or defense readiness, component-level supply-chain analysis, or multi-tier mapping with action workflows. It is disadvantaged when the account only needs a screening feed, only needs a procurement-native module, or is comfortable composing a narrower stack from multiple vendors.[CP009, CP016, CP017, CP019, CP020, CP030]

3.4 Moat Durability and Adverse View

The durable part of Exiger's moat is the unusual combination of graph-driven supply-chain intelligence, workflow execution, and public federal credibility. Very few public peers market all three together. The adverse case is that each piece can still be attacked separately. D&B, LSEG, and Lexis can deepen workflow around data franchises that already sit inside compliance budgets. Coupa and Ivalua can deepen monitoring and decisioning from inside procurement suites that already own the user and approval layer. Sayari and Interos can outflank Exiger on the graph side by making sub-tier visibility or resilience mapping the main buying event rather than an add-on to TPRM. Public materials do not show decisive independent win-rate or precision benchmarks that would prove Exiger consistently displaces all of those alternatives. That leaves Exiger with a strong, but execution-dependent, moat: credible in regulated and defense-heavy accounts, more vulnerable when buyers want only one slice of the stack or can bundle the slices they need elsewhere.[CP027, CP028, CP029, CP037, CP038, CP039]

3.5 Exhibits

4.1 Revenue Model, Pricing Opacity, and Distribution

The public evidence supports a software-led enterprise revenue model, but not a transparent pricing model. Exiger's homepage, products surface, and public-sector materials all describe a unified platform that maps supplier, product, part, component, and risk data for enterprise and government buyers. The company also describes itself in multiple releases as a SaaS or supply chain AI company rather than a consulting-led outsourcer, and the 2023 Capgemini divestiture sharpened that positioning by separating the legacy FCC advisory division from the core third-party risk and supply-chain technology business. At the same time, every reviewed commercial surface remains sales-led. There is no public list price, self-serve seat model, or disclosed usage meter for the core platform. The March 2026 AWS Marketplace launch matters because it shortens procurement friction and could widen channel-driven expansion, but it still does not reveal actual SKU pricing or realized contract terms. So the right financial reading is not that Exiger lacks monetization discipline; it is that the public file only shows the shape of the revenue engine—enterprise contracts, government procurement, and module expansion—not the realized economics that convert those motions into durable revenue quality.[CI001, CI002, CI003, CI013, CI024, CI030]

4.2 Growth Signals and Unit-Economics Proxies

Exiger's public traction signals are substantial for a private company, but still proxy-level. The cleanest 2026 scale claims come from the company's own Gartner and Hackett announcements, which say Exiger serves 550+ global customers, including 150 Fortune 500 and 60+ government and Defense Industrial Base organizations. The World Economic Forum organization profile broadly corroborates that scale, while the 1ExigerAI page adds quantified operational outcomes such as 20,000+ hidden entities found, 45% signal-noise reduction, 40,000+ parts normalized, 10-20% forecasting accuracy improvement, and 80%+ country-of-origin coverage in a federal use case. The single most important top-line signal is still third-party rather than audited: Forbes reported management expected revenue to exceed $150 million by the end of 2024 and claimed a five-year CAGR above 80%. Those numbers are directionally strong and consistent with high-800s employee scale, but they are not substitutes for ARR, gross margin, CAC payback, or retention. Underwriting should therefore treat Exiger as a company with unusually visible customer-density and proof-of-value signals, yet still an opaque unit-economics file.[CI004, CI005, CI006, CI007, CI008, CI009]

4.3 Capital Stack, Acquisitions, and Government Mix

Exiger's capital story is visible in milestones but not in current balance-sheet detail. The earliest clearly disclosed financing marker in the reviewed set is the July 2018 $80 million minority growth-capital investment from Carrick Capital Partners. Public sources then jump to the December 2023 majority investment agreement with Carlyle and Insight Partners, plus Carrick's reinvestment, but the company and Carlyle do not publicly disclose the size or valuation of that transaction in the retained materials. That opacity matters because Exiger was simultaneously reshaping its platform. Between 2022 and 2024 it acquired Supply Dynamics, XSB, and Versed AI, while selling the FCC advisory division to Capgemini to focus the business on technology. Strategically, that looks coherent: Supply Dynamics added item-level mapping, XSB added 100 million parts and 400 million federal-government attributes, and Versed AI added multi-tier visibility. Financially, however, the public file says nothing about acquired revenue, integration cost, overlap, or synergy capture. Government footprint is another dual-use fact. Exiger's 2026 materials emphasize 60+ government and Defense Industrial Base organizations plus FedRAMP authorization and federal leadership, which is commercially attractive but also raises concentration risk because no public source breaks out how much revenue actually comes from the public sector.[CI016, CI017, CI018, CI022, CI023, CI024]

4.4 Valuation Support, Investor Return Expectations, and Diligence Blockers

Public valuation support for Exiger exists only as a range anchored on incomplete inputs. On the positive side, the company has real scale claims, repeated product recognition, major-sponsor backing, and a software-led positioning that could justify a premium analytics multiple if margins and retention are strong. Public comps show the spread investors should keep in mind. Dun & Bradstreet's public data implies a much lower-growth data-and-analytics floor at roughly 3.2x revenue based on the reported Clearlake take-private, while Verisk's public market profile implies roughly 7.6x trailing revenue for a scaled, higher-quality analytics platform. Applying that public comp frame to Forbes's reported >$150 million revenue floor yields a rough implied support band of about $480 million to $1.14 billion. That is directionally useful but not conclusive because Exiger does not disclose margin profile, net retention, segment mix, burn, runway, or the entry valuation for Carlyle and Insight. Investor return expectations are therefore conditional, not verified: upside requires Exiger to look economically more like a software/analytics platform than a services-heavy compliance roll-up, while downside remains plausible if government concentration or acquisition integration prove more material than the public file currently reveals.[CI031, CI032, CI034, CI035, CI036, CI037]

4.5 Exhibits

5.1 Platform Surface, Modules, and Workflow

Exiger’s product file now reads as a platform family rather than a single diligence database. The public packaging clusters around 1Exiger and 1ExigerAI for supply-chain execution, DDIQ for due diligence and compliance, and adjacent surfaces such as software supply chain security. DDIQ is still the cleanest evidence-backed workflow: it ingests watchlists, premium news, open web, and proprietary lists, then organizes the result with configurable risk rules and audit-ready profiles. 1ExigerAI pushes the story from analysis toward action by claiming human-plus-AI workflow routing, centralized case activity, and quantified operating outcomes such as signal-noise reduction, parts normalization, and country-of-origin mapping. OpenCorporates and WorldCompliance matter here because they show that Exiger is not only surfacing proprietary graphs; it also plugs external verification and sanctions data into the same motion. What the public file does not cleanly do is explain ORCA as a standalone surface, which leaves one branding thread unresolved for outside buyers.[CE001, CE002, CE003, CE004, CE005, CE006]

5.2 Data Engine, Integrations, and Operating Architecture

Exiger’s clearest technical differentiation is the combination of graph-scale data assets with enterprise workflow integration. The supply-chain product page says the company is API-first and combines open APIs, AI-driven ETL, and bidirectional ERP and PLM interoperability with a product-aware knowledge graph spanning 10 billion records, 400 million part attributes, and 6.5 million mapped relationships. The acquisition trail makes that claim more believable. Supply Dynamics added item-level and tier-n visibility, XSB added parts intelligence plus a knowledge-graph and API lineage, and Versed AI added automated n-tier mapping and BOM-generation language for customers that do not already have clean technical packages. Snowflake embedding and AWS marketplace distribution add another important clue: Exiger wants to sit inside existing enterprise data foundations rather than remain a disconnected dashboard. The technical picture is therefore of a data-heavy orchestration layer, not a simple screening feed, but one whose performance still depends on data quality, connector coverage, and explainable decisioning.[CE014, CE015, CE016, CE017, CE018, CE019]

5.3 Deployment, Trust, and Developer Signal

Exiger’s deployment evidence is stronger than its public model-governance evidence. The company has concrete channel and control markers: 1Exiger is generally available in AWS Marketplace, Exiger Federal Cloud appears as FedRAMP Certified Class C (Moderate) in the FedRAMP Marketplace, and Exiger says regulated integrations run in that authorized environment alongside ISO 27001 and SOC 2 Type II controls. Carahsoft gives additional public-sector distribution support. The developer signal is not open-source in the usual sense, but the hiring surface is still informative. Current roles point to Snowflake architecture, AWS, APIs and data pipelines, CI/CD, Kubernetes, AI and ML analytics, and implementation managers who coordinate complex client deployments. A Built In role tied to Exiger’s XSB surface adds Java web apps, RESTful services, relational databases, Docker, and NIST or FedRAMP experience. Taken together, that suggests a real secure SaaS and data-platform footprint—but also a product that is unlikely to be frictionless for buyers to deploy, tune, and govern without meaningful services and customer-operating alignment.[CE026, CE027, CE028, CE029, CE030, CE031]

5.4 Differentiation, Maturity, and Technical Risks

The moat case is strongest where incumbents stop at entity screening or generic supplier scores. Exiger now has a more granular story: engineering-document extraction, part-attribute intelligence, multi-tier mapping, embedded Snowflake workflows, and procurement-oriented execution paths such as alternative sourcing or directed-buy. That is a materially different technical proposition from a sanctions database or adverse-media feed alone. The risk is that Exiger’s public ambition around agentic and explainable AI outpaces the level of public engineering proof available for underwriting. The reviewed file does not publish precision and recall, false-negative rates, drift monitoring, fairness testing, or detailed override and audit logs for AI decisions. Pricing remains opaque, ORCA nomenclature is unresolved in public packaging, and the company does not publish the kind of reference architecture or SLA history that would simplify diligence on deployment effort. Exiger therefore looks like a differentiated, data-rich workflow platform, but one that still needs deeper diligence on black-box risk, upstream data quality, and implementation complexity before buyers should assume low-friction adoption.[CE013, CE025, CE033, CE034, CE036, CE037]

5.5 Exhibits

6.1 Customer footprint and segment mix

Exiger’s customer base is broad in category but uneven in proof quality. Official and independent profile surfaces consistently describe a business that serves corporations, government agencies, and banks, with the sharpest documented use cases in procurement-led supply-chain intelligence, federal mission assurance, compliance, and third-party risk. The company’s repeated 2026 scale claims—550+ customers, 150+ Fortune 500 customers, and 60+ government or Defense Industrial Base organizations—show that Exiger is not a niche pilot vendor. But those counts say little about mix. Publicly named proof is strongest in defense, government, healthcare, and industrial manufacturing. Financial-services coverage is strategically important, yet the visible case studies stay anonymous, which weakens referenceability for marquee-bank claims. The practical read is that Exiger likely has a meaningful regulated-enterprise and government installed base, but the buyer surfaces most clearly where procurement, compliance, and mission readiness intersect.[CU001, CU002, CU003, CU004, CU005, CU006]

6.2 Named proof and procurement path

The strongest customer proof is public-sector procurement, not generic logo placement. Exiger’s retained corpus includes direct, operationally specific evidence for Army Materiel Command, CBP, Northwell Health, and Oshkosh/JLG. The Army and CBP wins matter because they are not just “strategic partnerships”; they are described as multi-million-dollar software or AI contracts with mission-specific workflows, while the Northwell and Oshkosh cases show enterprise deployments that touched ERP flows, supplier-monitoring processes, technical data packages, and large supplier networks. Procurement access is also unusually visible. Exiger has an OUSD-linked DDIQ contract history, the SCRIPTS BPA, Platform One marketplace exposure, and an AWS Marketplace route meant to reduce commercial friction. That combination suggests a company that can sell through both bespoke federal procurement and workflow-heavy enterprise evaluations. It also implies that customer acquisition is often tied to implementation depth and procurement infrastructure rather than lightweight self-serve software motion.[CU007, CU008, CU009, CU010, CU011, CU012]

6.3 Durability, switching costs, and referenceability

Public durability evidence is directionally positive but incomplete. The best retention proxies are structural: Oshkosh expanded from one business unit into another, the regional-bank client extended Exiger’s engagement beyond the original alert lookback, and Northwell replaced a multi-tool setup with a single Exiger-led ecosystem. Independent sentiment is also better than average for a private vendor. Gartner’s accessible product page shows a meaningful visible review corpus and a favorable manufacturing review that praised implementation support and reduced false positives. But the same page also surfaces a critical review that says the platform can be complex to tune and heavier than needed for simple use cases. That combination matters: Exiger appears most durable when customers need deep workflow integration, not when they want a light monitoring overlay. Public satisfaction and switching-cost signals are therefore real, yet still weaker than a disclosed NRR or renewal cohort. Referenceability is similarly mixed because large sectors, especially financial services, are represented more by anonymous cases than by named customer champions.[CU023, CU024, CU025, CU027, CU029, CU030]

6.4 Concentration and diligence risks

The customer-risk picture is less about whether Exiger has customers and more about where the economic weight sits. Public proof strongly suggests defense and government matter disproportionately: the company highlights Army, CBP, federal contract vehicles, Platform One, SCRIPTS, and 60+ government/DIB organizations far more than it discloses enterprise renewal cohorts or top-bank references. That asymmetry creates two diligence risks. First, concentration could be higher than investors expect if public-sector bookings and renewals are a large share of the business. Second, reference inflation is possible because headline customer counts are supported by only a small set of named external accounts in the retained corpus. Financial-services concentration is plausible, but without named Goldman Sachs or JPMorgan proof, it is not underwritten. The sales-cycle implication is also important: long, regulated procurement paths can be sticky once won, but they can also slow net-new growth and make implementations resource intensive. Exiger therefore looks more like a high-touch, workflow-embedded platform vendor than a low-friction horizontal SaaS subscription.[CU026, CU027, CU028, CU033, CU037, CU038]

6.5 Exhibits

7.1 Risk Overview and Prioritization

Exiger’s public risk stack is not dominated by a single existential problem but by a cluster of linked exposures that can compound. The highest-probability commercial risks are competitive bundle pressure from larger platforms, procurement slippage in government and regulated enterprise accounts, and integration drag as multiple acquired data or mapping assets are absorbed into one operating platform. The highest-severity risks are different: a material error in sanctions, export-control, forced-labor, or privacy-sensitive screening can create direct customer liability and reputational damage, while hidden government concentration could make growth look more diversified than it really is. The retained sources also show real mitigation. FedRAMP authorization, a public DPA, contract-vehicle access, AWS Marketplace availability, and sponsor capital all indicate Exiger is not improvising its way through regulated markets. But those same signals show why the file needs caution: federal channels lengthen sales cycles, AI-led claims raise precision expectations, and sponsor ownership makes timing and exit conditions relevant before public metrics are fully disclosed.[CR001, CR003, CR005, CR007, CR012, CR020]

7.2 Government Concentration, Procurement, and Dependency Risks

Exiger’s public-sector credibility is simultaneously a moat and a concentration risk. The evidence set shows a meaningful federal footprint: FedRAMP Moderate authorization, contract-vehicle access, Carahsoft channel distribution, and a multi-million Army Materiel Command deployment. That profile should help Exiger win in defense, public-sector, and critical-supply-chain use cases, but it also means a non-trivial portion of pipeline quality is likely tied to budget timing, task-order mechanics, contracting officers, reseller throughput, and compliance sign-off. AWS Marketplace improves discoverability and may shorten some buying steps, yet it does not convert Exiger into a frictionless self-serve product. SAM.gov and USAspending both reinforce that federal procurement remains a formal, searchable, multi-step process. The underwriting problem is that none of the retained public sources disclose what share of revenue, bookings, or retention comes from public-sector or government-adjacent customers. That pushes the probability of concentration risk into the medium-to-high range even without proof of a current problem, because investors can verify footprint but not revenue mix. Any slowdown in agency budgets, reseller execution, or contracting throughput would transmit first into bookings timing and then into valuation.[CR001, CR002, CR005, CR006, CR007, CR009]

7.3 AI/Data Accuracy, Compliance, Cyber, and Geopolitical Risks

This is the chapter’s core skeptical lens. Exiger markets predictive, AI-enabled mapping and risk detection, which is commercially powerful but also raises the cost of being wrong. The public DPA allocates some responsibility back to customers by requiring them to provide accurate data, yet Exiger still accepts processor, security, sub-processor, and breach-response obligations. That means contractual drafting does not eliminate operational liability. The regulatory stack that customers rely on is also dynamic rather than static. OFAC distributes continuously updated sanctions datasets, BIS pushes exporters toward EAR and screening resources while warning users to confirm legal research against official publications, and CBP’s UFLPA regime can detain shipments based on entity-list and origin evidence. In other words, Exiger’s value proposition depends on handling data that changes, crosses jurisdictions, and can become legally consequential when stale or incomplete. Add FTC privacy expectations, GDPR obligations, the AI Act’s staged compliance timeline, and rising cyber or product-assurance scrutiny, and the result is a business where model quality, entity resolution, source provenance, and security controls deserve the same diligence weight as top-line growth.[CR013, CR014, CR015, CR016, CR017, CR018]

7.4 Acquisition Integration, Sponsor Ownership, and Exit Risks

Exiger’s acquisition history strengthens the product story but complicates execution. Supply Dynamics added item-level visibility and multi-tier mapping, XSB added large parts and attributes data sets, and Versed AI added product-breakdown and multi-tier visibility tooling. Each asset helps the platform become more defensible, but each also creates integration, roadmap, and go-to-market harmonization work that the public file does not quantify. Sponsor ownership adds another layer. Carlyle and Insight’s majority investment is strategically supportive, yet it also means exit discipline matters before investors have public visibility into concentration, margins, or quality metrics. The SEC’s 2026 offering-reform proposal is useful context here: if regulators are still trying to simplify the path to public-market issuance, the practical message is that exit windows remain sensitive to disclosure quality and market structure. Legal diligence has a similar shape. No adverse federal case surfaced in the free-web search pack, but PACER and clerk-office checks remain the authoritative route. The right mitigation posture is therefore escalation-driven: treat concentration, accuracy, cyber, integration, and sponsor-timing signals as board-level or investment-committee triggers rather than background noise.[CR012, CR024, CR025, CR026, CR027, CR028]

8.1 Price Support Versus Disclosure Quality

The public record establishes that Carlyle and Insight bought into Exiger in late 2023 and that independent deal coverage put the valuation at about $1.2 billion, but the official sponsor and company releases still do not disclose the price, ownership split, leverage, or preference structure. That matters because the most important denominator is still a third-party-reported management claim: Forbes wrote in March 2024 that Exiger expected revenue to exceed $150 million by the end of 2024 and had compounded above 80% annually over the prior five years. Against that floor, the reported $1.2 billion value implies about 8.0x revenue, which is not obviously unreasonable for a differentiated risk-data platform but is clearly not cheap either. The 2026 AWS and Hackett materials strengthen the quality story by showing 550+ customers, 150 Fortune 500 relationships, 60+ government and Defense Industrial Base organizations, and procurement relevance. But they still leave ARR, gross margin, retention, services mix, cash-flow profile, and public-sector concentration unreported. So the core valuation judgment is evidence-sensitive rather than company-quality-sensitive: Exiger may deserve a premium mark, but the current public file does not prove it.[CV001, CV003, CV004, CV005, CV006, CV007]

8.2 Public and Private Comparable Frame

Public comps provide a usable range, but they are imperfect and should be read as valuation anchors rather than literal peers. Dun & Bradstreet, NICE, and TransUnion sit in the lower band of adjacent data or workflow vendors at roughly 1.7x to 3.0x trailing revenue on public market-cap-to-revenue proxies. Verisk and Moody's occupy the premium end at roughly 7.8x and 10.1x respectively, reflecting stronger disclosure, high-margin analytics economics, and more mature data-network advantages. Exiger's implied 8.0x floor multiple therefore lands much closer to premium analytics names than to the lower-growth or workflow-heavy names. That can be defensible only if current revenue is already comfortably above the 2024 floor and if Exiger's economics look more like scaled software and analytics than like a services-heavy compliance platform. Private and M&A references reinforce strategic appetite for intelligence assets, but they do not cleanly solve valuation support. Chainalysis reached an $8.6 billion valuation, Interos crossed $1 billion, Sayari attracted a $235 million strategic majority investment, and Mastercard agreed to buy Recorded Future for $2.65 billion. Those examples show sponsor and strategic demand for networked risk-data assets, but each sits in a different end market, disclosure regime, and margin profile. The comp set is therefore helpful, but only with explicit caveats.[CV016, CV017, CV018, CV019, CV020, CV021]

8.3 Bull, Base, Bear, and Exit Math

The scenario work argues for discipline. In the bull case, Exiger is already materially above the reported 2024 revenue floor, sustains software-led growth, shows strong retention, and exits into a market that still pays premium analytics multiples for defensible risk data. That can produce a sponsor-acceptable 2x-plus outcome. In the base case, however, Exiger grows well enough to be valuable but not well enough to overcome today's entry price with robust excess return; a mid-single-digit exit multiple on a sub-$300 million revenue base only produces a modest uplift over the reported mark. In the bear case, a combination of public-sector concentration, acquisition-integration drag, services mix, or multiple compression can leave the company worth below cost. The 2026 private-equity exit backdrop raises the hurdle further, because buyers are more selective, software multiples have compressed versus peak years, and longer hold periods reduce sponsor IRR even when gross MOIC remains positive. Put simply, Exiger does not need to be a bad business for the valuation to disappoint; it only needs to be a good business that is not quite premium enough.[CV031, CV032, CV033, CV034, CV039, CV042]

8.4 Decision, Kill Triggers, and Final Diligence

The right call on the public record is research-more rather than buy. Exiger has enough scale, sponsor quality, and category relevance to stay investable, but not enough disclosed economics to underwrite a $1.2 billion entry with conviction. The cleanest anti-thesis is not that demand is fake; it is that valuation support depends on opaque private revenue, unknown software-versus- services mix, unclear government concentration, and sponsor ownership dynamics that remain hidden from the public file. That means the diligence plan should focus less on broad market validation and more on denominator proof: current TTM revenue, ARR, growth by segment, gross margin, NRR, federal concentration, customer concentration, and exact sponsor terms. Kill triggers are also concrete. If current revenue is still near the 2024 floor, if public-sector revenue is highly concentrated, if services make up a meaningful share of gross profit, or if the capital structure gives new money limited upside, the valuation quickly looks stretched. If the company can instead prove materially higher current revenue, premium software-like economics, and a credible strategic or IPO path, the same public evidence can move from stretched to fair.[CV040, CV041, CV042, CV043, CV044, CV045]

8.5 Exhibits