I-TRACING

1.1 Identity and operating model

I-TRACING is legally registered as I - TRACING, a French SAS with SIREN 484 841 127 and headquarters at 25 Quai du Président Paul Doumer in Courbevoie. INPI records the company’s activity start as 14 October 2005 and its principal activity as information-technology and telecommunications consulting, services, and products. The 2024 investor release describes the operating business more specifically as a managed-security-services pure player serving enterprise and midmarket customers, with SOC, CERT, incident-response, and related end-to-end services. That distinction matters: the legal entity description is broad, while the commercial proposition is specialized. The release says the group has subsidiaries across Europe, Asia, and North America, but the exact current consolidated perimeter after later mergers is not fully disclosed in the retained sources.[CO001, CO002, CO003, CO004]

1.2 Leadership, ownership, and governance

The strongest named leadership evidence identifies Théodore-Michel Vrangos as co-founder and president and Laurent Charvériat as co-founder. The 2024 transaction preserved meaningful management ownership: more than 80 managers and employees reinvested alongside Eurazeo, Oakley Capital, Sagard NewGen, Five Arrows Secondary Opportunities, and TPG GP Solutions. French registry evidence records I-Tracing Holding as president of the operating company and identifies two statutory auditors, while Pappers records a president change effective 4 November 2025. These facts show sponsor and management alignment, but they do not establish the full current board, voting rights, preference stack, or the extent to which founder operating authority remains concentrated. Key-person dependence therefore remains a diligence question rather than a quantified conclusion.[CO005, CO006, CO007, CO008]

1.3 Funding, scale, and milestone record

The November 2024 transaction created a €180 million continuation fund with Eurazeo continuing as anchor investor and Oakley Capital joining in co-control; the release also names Sagard NewGen, Five Arrows Secondary Opportunities, and TPG GP Solutions. This is a financing commitment to the continuation vehicle, not a disclosed company valuation or cash balance. The same source reported more than 700 cybersecurity experts, more than 450 blue-chip customers, and approximately €150 million of expected 2024 revenue, while Mandos later reported 682 employees and $537 million of priced equity across two rounds. French company-data records show 2023 revenue of €112 million and EBITDA of €15.4 million for the registered entity, plus a December 2025 merger with I-Tracing Group. The figures are not directly interchangeable because they have different dates, perimeters, and issuers; current consolidated revenue, valuation, leverage, and customer concentration remain open.[CO009, CO010, CO011, CO012, CO013, CO014, CO015, CO016]

1.4 Exhibits

2.1 Market boundary and buyer problem

The relevant market is outsourced managed security services rather than all cybersecurity spending. The boundary includes continuous monitoring, security operations, managed detection and response, identity and data protection, cloud security, risk and compliance, incident response, and related security implementation or consulting when delivered as a managed service. It excludes software sold without an operating service, internal security teams, and general IT consulting that does not manage security outcomes. Oakley describes I-TRACING as a pure-play French MSSP serving blue-chip enterprise and midmarket customers. The investable boundary is therefore the managed-security slice rather than the full universe of security products, project consulting, or internal labor; the available evidence does not disclose I-TRACING's revenue mix across those categories.[CM001, CM002, CM003, CM004]

2.2 Sizing lenses and uncertainty

Three commercial research publishers place the global managed-security market at roughly USD 38.0 billion to USD 39.47 billion for 2025, but their forward endpoints range from USD 66.83 billion in 2030 to USD 86.3 billion in 2033. The difference is not a contradiction that can be averaged away: the reports define segments, geographies, and included services differently and rely on secondary research, interviews, or paid databases. The estimates therefore support direction and order of magnitude, not a precise I-TRACING TAM. A constrained European SAM or I-TRACING SOM cannot be calculated from the assigned evidence because company revenue by service line, geography, addressable customer segment, win rate, and capacity are not disclosed here. Any valuation model should keep those as explicit diligence inputs.[CM005, CM006, CM007, CM008]

2.3 Buyers, drivers, and adoption constraints

Adoption is pulled by rising threat frequency, expanding cloud and hybrid environments, regulatory obligations, and a shortage of cybersecurity expertise. Oakley specifically identifies IT-architecture complexity, threat sophistication, and talent scarcity as long-term demand drivers for I-TRACING's market. ENISA's 2025 guidance gives digital-infrastructure and ICT providers practical evidence expectations for the EU NIS2 regime, while ANSSI describes NIS2 as expanding the regulated perimeter and encourages future essential and important entities to begin securing themselves. These drivers favor providers that can combine monitoring, response, compliance, and specialist labor. Adoption is not frictionless: MarketsandMarkets identifies limited visibility and control over outsourced functions as a restraint, and Grand View Research notes third-party disruption and privacy or compliance concerns. Budget owners therefore need proof of coverage, response quality, governance, and data handling before shifting work from internal or hybrid teams.[CM010, CM011, CM012, CM013, CM014, CM015]

2.4 Implications for I-TRACING and diligence

I-TRACING's stated one-stop-shop model spans CyberDefence, MDR, IAM, cloud security, data protection, and audit, matching several of the market's separately measured service categories. The combination can improve wallet share and make the buyer's outsourcing decision easier, but it also raises execution and comparability questions: a broad capability list is not proof of recurring managed-service revenue, customer retention, or superior unit economics. The company-specific market case should be tested through service line revenue, recurring versus project mix, customer concentration, renewal and expansion data, geographic delivery capacity, competitive win/loss evidence, and compliance-related pipeline. Solganick's Q3 2025 data shows active cybersecurity M&A, but sector transaction activity is not company-level evidence of obtainable share or valuation. The market conclusion is consequently positive on demand, cautious on obtainable share and valuation transfer.[CM008, CM017, CM018]

2.5 Exhibits

3.1 Competitive landscape and strategic position

I-TRACING's closest competitive set is not a single vendor category. It includes specialist MDR and SOC providers such as Arctic Wolf, ReliaQuest, and Rapid7; broad security platforms such as Palo Alto Networks, CrowdStrike, Fortinet, and Check Point; large integrators such as Atos/Eviden; identity specialists such as Okta and CyberArk; cloud-security specialists such as Zscaler, Cloudflare, and Orca Security; and the buyer's status quo of internal security operations, incumbent systems integrators, and multi-vendor procurement. Finro's 2025 review explicitly separates network, endpoint, cloud, IAM, and incident-response/MDR niches, illustrating why a broad MSSP should be compared by workflow and buying criterion rather than by one headline category. I-TRACING's 2024 Eurazeo announcement describes a portfolio spanning proactive protection, incident response, deployment and management, SOC, CERT, and 24/7 incident response for more than 450 blue-chip customers, while identifying IAM and Cloud Security add-ons as adjacency expansion. This breadth is a differentiation opportunity for complex enterprise buyers, but it also places the company against better-capitalized platform vendors and large integrators at different points in the stack.[CP001, CP002, CP003, CP004]

3.2 Capability, distribution, and trust comparison

The defensible comparison is operational rather than feature-count based. I-TRACING can point to more than 700 cybersecurity experts, owned subsidiaries across France, Switzerland, the United Kingdom, Hong Kong, Malaysia, Singapore, Canada, and China, and a fully owned follow-the-sun organization in the Eurazeo description. ENISA's June 2025 publication frames managed security services around usage, compliance, skills certification, threats, requirements, incidents, and market trends, reinforcing that buyer trust depends on operating controls and talent as well as tooling. The company therefore appears strongest where a customer values end-to-end managed accountability, local and cross-border delivery, and response integration. Platform vendors can counter with product telemetry, automation, and installed distribution; integrators can counter with procurement scale and transformation relationships. The prefetched CybersecTools company URL returned only generic directory and operator text, so its search-result description is not treated as proof of I-TRACING's current scale or capability. I-TRACING's own technology depth, certifications, service-level commitments, and customer renewal evidence remain diligence items rather than assumed advantages.[CP005, CP006, CP007, CP008]

3.3 Pricing, switching costs, and moat durability

No assigned source provides a public I-TRACING price card or a like-for-like realized-price comparison with competitors. The relevant commercial model is therefore best expressed as an unknown contract-level variable: managed-service fees may bundle people, monitoring, response, tooling, geography, and service levels, while product vendors may quote seats, workloads, or platform modules. A buyer can multi-home across endpoint, identity, cloud, and SOC providers, but replacing a trusted managed operator also entails migration, telemetry integration, playbook transfer, incident-response readiness, and risk to compliance coverage. That creates practical switching costs without proving contractual lock-in. Eurazeo's announcement says the €180 million continuation-fund vehicle has follow-on financing capabilities for a European buy-and-build roadmap; neither it nor the corroborating Tech Funding News article discloses that amount as cash available to I-TRACING. INPI records show a December 2025 merger involving I-Tracing Group and a September 2026 data update; these support organizational change, not superior execution. Finro reports that public cybersecurity companies averaged 7.8x revenue versus 15.2x for private transactions and 16.3x for M&A in its dataset, but those are sector benchmarks, not an I-TRACING valuation or a direct moat score. Durability therefore depends on evidence of renewal, delivery quality, automation leverage, and successful integration of acquired capabilities. [CP009, CP010, CP011, CP012]

3.4 Displacement risks and diligence priorities

The main adverse case is not that I-TRACING lacks a market; it is that the market's buying center may consolidate around security platforms, hyperscaler ecosystems, or global integrators faster than a services-led provider can preserve differentiation. Clipperton's 2025 monitor describes a polarized software market and says resilience is most pronounced among companies with genuine cyber-platform status and high switching costs. Finro likewise identifies pricing pressure and slower enterprise adoption as risks that vary by niche. Those observations are sector-level, not a direct finding about I-TRACING, but they identify the pressure points: platform consolidation can compress stand-alone service pricing; talent scarcity can constrain delivery; buy-and-build can add integration risk; and undisclosed customer concentration or renewal behavior can weaken bargaining power. The evidence supports a track-and-verify posture rather than a claim that I-TRACING has already lost share. Priority diligence is a customer-level win/loss set against platform and integrator alternatives, realized gross margin by service line, renewal and expansion rates, service-level incidents, acquisition integration outcomes, and competitive pricing by contract scope. [CP014, CP015, CP016, CP017]

3.5 Exhibits

4.1 Revenue model and public traction

I-TRACING monetizes a broad cybersecurity-services portfolio rather than a single software subscription: CyberDefence, managed detection and response, identity and access management, cloud security, data protection, audit, consulting, integration, and 24/7 SOC services are described across investor and company materials. That mix implies a blend of recurring managed-service revenue and project or integration revenue, but the assigned evidence does not disclose the split, contract duration, renewal rate, or realized price by service line. Pappers reports I-TRACING operating company revenue of €112 million in 2023, up from €81.6 million in 2022, while Ardian reports €115 million turnover for 2023. The small difference is not reconciled in the sources and should not be treated as a restatement. Later company material reports consolidated 2024 revenue above €210 million after acquisitions, a changed perimeter.[CI001, CI002, CI003, CI004]

4.2 Economics and cost drivers

The operating-company accounts presented by Pappers show improving profitability through 2023: EBITDA rose from €10.1 million in 2022 to €15.4 million in 2023, while EBITDA margin increased from 12.4% to 13.7%; net margin was 8.6% in 2023. These figures are useful operating evidence, but they are entity-level figures and do not establish current combined-group margins after Bridewell, doIT solutions, and other perimeter changes. The commercial model is labor intensive: Oakley describes around 700 cybersecurity experts in 2024, and the company describes more than 1,000 experts after the doIT combination. Acquisitions can add capability and geographic coverage, but integration, hiring, utilization, and delivery quality can pressure margins. No assigned source supplies CAC, sales cycle, payback, gross-margin bridge, service delivery cost by line, or working-capital detail, so those inputs remain underwriting blockers rather than estimates.[CI005, CI006, CI007, CI008]

4.3 Capital adequacy and underwriting verdict

Financing evidence indicates meaningful sponsor and lender support but does not establish current liquidity. Ardian describes a €60 million 2021 debt financing, comprising €40 million drawn at closing and a committed €20 million acquisition line. The 2023 operating-company profile separately reports €23 million of cash and €3.75 million of financial debt, whereas the group profile reports €2.1 million of cash and €75.2 million of financial debt for 2023; the different entities and perimeters make these figures non-comparable without a group bridge. The 2024 transaction included a €180 million Eurazeo continuation fund, but that is financing raised by the sponsor structure, not disclosed cash available to I-TRACING. Acquisition-led expansion and planned hiring increase the need for a current cash, debt, covenant, and integration bridge. Financially, the evidence supports a growing and historically profitable platform, but not a fully underwritten current cash-generation or valuation case.[CI009, CI010, CI011, CI012, CI013]

4.4 Exhibits

5.1 Product surface and customer workflow

The public product surface is a services portfolio rather than a single software SKU. Oakley describes a one-stop shop spanning cybersecurity, managed detection and response, identity and access management, cloud security, data protection, and audit; Sagard separately describes auditing, consulting, 24/7 monitoring, and software integration. A RevenueBase profile sourced from the company's public LinkedIn description adds SOC, CERT, vulnerability and threat management, network and application security, governance, risk and compliance, and industrial/IoT security. Procurement records provide stronger workflow evidence than marketing taxonomy: they list CIAM for extranets, Active Directory/PKI work, security audits, vulnerability detection, and incident-response services. Together, these sources indicate that I-TRACING participates from assessment and control design through implementation and continuous operations, although no retained source discloses realized performance outcomes for these engagements.[CE001, CE002, CE003, CE009, CE010]

5.2 Operating architecture and delivery model

The disclosed architecture is human-led managed security layered over third-party control and telemetry platforms. TechFundingNews reports that I-TRACING builds programs on Google Security Operations and uses Mandiant threat intelligence, while the broader evidence places consulting and integration ahead of 24/7 SOC, CERT, and MDR operations. The French registry also records an Annecy establishment whose activity includes cloud-application design, development, hosting, maintenance, and systems work following the APALIA merger. This supports technical delivery capability, but it does not prove that I-TRACING owns a proprietary detection engine or unified software platform. Public evidence also omits data-flow diagrams, supported integrations, tenancy boundaries, deployment lead times, and recovery procedures, so the architecture map below is a sourced operating-model synthesis rather than a verified implementation blueprint.[CE002, CE004, CE005, CE011, CE013]

5.3 Maturity, differentiation, and roadmap evidence

Scale and deployment evidence are stronger than product-roadmap evidence. Sagard says the offering is supported across three continents, and Oakley's 2024 annual report identifies 700 cybersecurity experts. The same annual report says I-TRACING acquired more than 70 new customers from a base of about 250 during 2024 and launched a dedicated mid-market sales stream, indicating that the delivery model had moved beyond a narrow large-enterprise posture. Differentiation appears to rest on service breadth, specialist staffing, integration capability, and orchestration of established platforms rather than on publicly demonstrated proprietary software. The December 2025 fusion of I-Tracing Group into I-TRACING and the earlier APALIA absorption may simplify the legal operating perimeter, but the retained evidence does not show a current module roadmap, release cadence, end-of-life policy, or integration plan for acquired capabilities.[CE005, CE011, CE012, CE013, CE014, CE015]

5.4 Trust, compliance, and technical-risk posture

I-TRACING's privacy statement defines the group as a processor when handling client-entrusted personal data and names technical and organizational safeguards including firewalls, network segmentation, physical hosting, named access controls, procedures, and security policies. These are useful control assertions, but they are company-issued and do not substitute for independent certification scope, penetration-test results, SOC reports, availability history, or breach disclosure. NIS2 raises the compliance burden for many target customers through risk-management and significant-incident reporting obligations, which can support demand while also increasing the evidence customers will expect from their MSSP. No retained source exposes a public repository, package, API forum, release history, status page, or practitioner-community signal attributable to I-TRACING; developer adoption and operational reliability therefore remain unverified rather than assumed absent.[CE006, CE007, CE008, CE016]

5.5 Exhibits

6.1 Customer segments and buying centers

I-TRACING serves a broad enterprise-security buying center rather than a single end user. The addressable buyer set includes CISOs, security operations leaders, identity teams, infrastructure and cloud owners, risk functions, and public procurement teams. Its public positioning spans consulting, implementation, managed detection and response, identity and access management, cloud security, and data protection, which supports both project-led and recurring managed-service entry points. Company materials emphasize large enterprises, while Oakley's 2024 report says a dedicated mid-market sales stream was added to the historical large-enterprise focus. Public awards further show demand from transport, housing, media, and regional institutional buyers. These categories establish buyer breadth, but no public source allocates customers or revenue by segment, geography, service line, or contract type.[CU001, CU002, CU003, CU005, CU011, CU012, CU013]

6.2 Adoption trajectory and operating scale

The strongest historical adoption disclosure is Oakley's report that I-TRACING acquired more than 70 new customers during 2024 from a base of approximately 250. The company's current homepage separately claims more than 600 enterprise customers, 2.3 million protected users, 25 terabytes of logs processed per day, and 400 million events processed per day. Together these figures indicate materially larger reach and workload than the historical standalone base. They do not, however, form a clean cohort bridge: the current count may reflect acquisitions, partner combinations, scope changes, and different definitions of an enterprise customer. Workload figures also lack customer-level distributions, so they cannot demonstrate average deployment depth or retention. The trajectory is therefore positive but only directionally comparable.[CU003, CU004, CU006, CU007, CU008]

6.3 Named customer and procurement proof

Public proof goes beyond an undifferentiated logo wall, but its evidentiary strength varies. Matmut's identity leader describes an IAM and cybersecurity relationship built over years, and Motul's CIO describes I-TRACING as raising the company's cybersecurity level; both are customer quotations hosted by I-TRACING and therefore confirm named relationships without independently quantifying outcomes. Public procurement records are firmer on commercial structure: Pappers lists a five-year, EUR13 million COMUTITRES award, a four-year, EUR2.02575 million Action Logement CIAM SaaS award, and a four-year, EUR280,000 CCI Paris Ile-de-France security-audit and incident-response award. Award records still do not prove full deployment, realized value, renewal, or current utilization.[CU009, CU010, CU011, CU012, CU013]

6.4 Durability, expansion, and concentration risk

The evidence supports multi-surface expansion potential: customers can enter through assessment or implementation work and extend into identity, cloud, data protection, or continuous managed detection. External requirements reinforce the mechanism. Swift's Customer Security Programme describes mandatory controls, independent assessment, and attestation workflows, while ENISA's NIS2 guidance maps regulatory requirements to implementation evidence; both can create recurring compliance and assurance work for security providers. Durability remains unverified. No assigned source discloses NRR, GRR, churn, renewals, contract backlog, customer-level revenue, or top-customer concentration. Pappers' reported 112-day client payment period for 2023 also indicates procurement and working-capital friction, not churn. The underwriting case should therefore treat expansion as plausible and retention quality as an open diligence item.[CU014, CU015, CU016]

6.5 Exhibits

7.1 Severity ranking and investment implication

The highest residual exposure is acquisition integration rather than a demonstrated legal breach. Eurazeo describes several identified acquisitions and follow-on financing capacity, while I-TRACING describes a 24/7 operating model spanning nine subsidiaries and more than 1,000 experts. Those facts create a material control-consistency, service-quality, and management-bandwidth test as the perimeter expands. Severity in the exhibits is therefore an evidence-based qualitative judgment: impact reflects the breadth of customer and operating exposure; likelihood reflects an active transaction or regulatory condition; mitigation maturity reflects only controls visible in the allocated public sources, not management's undisclosed internal controls. A clean investment decision requires integration KPIs, incident and SLA history, and current group financials rather than extrapolation from promotional scale claims.[CR001, CR002, CR003, CR004, CR005, CR013, CR015, CR016]

7.2 Regulatory, legal, and security-control exposure

NIS2 expands the population of covered entities and introduces implementation evidence requirements for relevant digital and ICT-service sectors. This can support demand for I-TRACING, but it also raises the standard of proof customers may require from a security-services provider. ANSSI's PAMS page has an important visibility limitation: only qualification projects whose providers consent to publication appear, and suspended projects are removed. Consequently, a public-listing check cannot by itself establish I-TRACING's qualification status. Pappers displays no collective proceeding, litigation, or sanction in its own coverage, but that is not proof that no dispute, enforcement action, incident, or foreign-jurisdiction matter exists. The correct mitigation is document-level verification across operating jurisdictions.[CR008, CR010, CR011, CR012]

7.3 Operational, integration, and partner dependencies

The operating perimeter combines a company-reported global follow-the-sun service with a sponsor-backed acquisition plan. Maintaining common detection, escalation, identity, change-management, and recovery controls across acquired teams is therefore a core execution dependency, not a generic cyber-sector concern. The December 2025 fusion-absorption of I-Tracing Group into I-TRACING and the holding-company presidency add legal-entity and governance changes that should be reconciled to contracts, insurance, customer consents, and accountability maps. Sponsor follow-on capacity is a mitigation, but the EUR180 million figure is capital committed to the continuation vehicle, not cash proven to be available to I-TRACING. Key-person, platform, supplier, and customer concentration remain unquantified in the allocated evidence.[CR001, CR002, CR003, CR004, CR005, CR006, CR009, CR015]

7.4 Financial/model risk and thesis-break triggers

Public financial evidence is not current enough to size downside at the combined group. Pappers reports 2023 standalone I-TRACING revenue, EBITDA, cash, and financial debt, while the current company page reports a much larger consolidated revenue perimeter. Oakley's 4.1x average portfolio net-debt-to-EBITDA ratio is explicitly a portfolio statistic and cannot be assigned to I-TRACING. The resulting gap is material because an acquisition-led strategy can convert integration slippage into covenant, liquidity, or equity-support risk. Thesis-break triggers should include missed acquisition synergy milestones, repeated material SLA failures, a reportable control failure, loss of a required qualification, or leverage and cash conversion outside underwritten limits. Those limits cannot be set responsibly until audited combined-group statements, debt terms, and working-capital data are reviewed.[CR006, CR007, CR014, CR016]

7.5 Exhibits

8.1 Evidence-led recommendation

I-TRACING has credible operating proof, but the evidence is not yet sufficient for a price-sensitive investment call. Its current homepage presents more than EUR230 million of revenue and more than 30% annual growth without stating the measurement period, accounting basis, or consolidation perimeter. Its Google Cloud page adds a company-issued operating signal: a certified MSSP partnership and a 24/7 follow-the-sun CyberSOC across three continents. Historical third-party and sponsor disclosures strengthen the operating case: Pappers displays EUR112 million of revenue and EUR15.4 million of EBITDA for the 2023 French legal entity, while Oakley reported 20% revenue growth and 23% adjusted-EBITDA growth for the 12 months to December 2024. These metrics differ in vintage and perimeter, so they support platform quality rather than a current group valuation. The recommendation is therefore track and research-more, with medium confidence, high underwriting risk, and an unknown valuation stance.[CV001, CV002, CV003, CV006, CV007, CV008, CV009, CV016]

8.2 Financing and price context

The November 2024 sponsor transaction demonstrates capital support but does not disclose I-TRACING's equity value or cash available to the company. Tech Funding News reported that Eurazeo raised a EUR180 million continuation fund and that more than 80 managers and employees reinvested; the EUR180 million amount is the fund size, not company funding or valuation. Oakley Capital Investments' 2024 annual report provides a narrower mark: its look-through Fund V holding in I-TRACING had a GBP35.6 million residual cost and GBP35.6 million fair value at 31 December 2024. That is OCI's attributable investment value, not I-TRACING's enterprise value. The same audited report identifies subjective and complex valuation risk for unquoted investments. INPI then records the absorption of I-Tracing Group into I-TRACING effective 26 December 2025, making a current post-merger perimeter, capitalization table, net-debt bridge, and preference schedule prerequisites to pricing.[CV004, CV005, CV010, CV011, CV012, CV016]

8.3 Benchmark and scenario discipline

Independent references define a broad valuation vocabulary, not a direct comp answer. Aventis reports an approximately 8.9x median EV/EBITDA multiple across 120 disclosed private MSP transactions with a USD38.5 million median transaction size. For selected listed MSPs, it reports H2 2024 medians of 11.4x EV/EBITDA and 1.3x EV/revenue, while explicitly warning that pure-play listed MSPs are rare and diversified revenue streams impair comparison. Greenwich's managed-security precedent table shows three-year medians of 13.7x EV/EBITDA and 1.5x EV/revenue. These datasets vary by deal size, business mix, public/private status, and period; none supplies an I-TRACING transaction price. A bull case can justify testing the upper end only after recurring revenue, retention, normalized combined EBITDA, and low leverage are verified. A base case treats the 8.9x private-MSP median as a cross-check, not an answer. A bear case requires a discount for weak cash conversion, integration risk, customer concentration, or senior claims. No company-value range or return probability is supportable from the assigned public evidence.[CV013, CV014, CV015, CV016]

8.4 Diligence, exit, and thesis breaks

Entry discipline should focus on the variables that convert operating quality into equity returns. Management and sponsors should provide audited post-merger consolidated accounts; normalized EBITDA and cash conversion; net debt and debt maturities; recurring versus project revenue; gross and contribution margins; customer concentration, renewal, and churn cohorts; acquisition purchase-price accounting; and the complete capitalization and preference stack. Exit readiness also requires a credible sponsor-liquidity path, evidence that the combined platform can be separated or sold cleanly, and a buyer set that values services rather than software economics. The thesis improves if current revenue reconciles across entities, retention proves durable, EBITDA converts to cash, and acquired operations integrate without leverage expansion. It breaks if the continuation structure embeds an entry price above supportable service-company multiples, if combined EBITDA materially trails the historical French entity margin, if churn or concentration undermines recurring revenue, or if senior claims absorb plausible exit proceeds. Until those tests clear, target return, hold period, and exit value remain material gaps rather than estimable outputs.[CV006, CV007, CV010, CV011, CV012, CV013, CV014, CV015, CV016]

8.5 Exhibits