Semperis

1.1 Corporate Identity, Stage, and Operating Model

Semperis is an enterprise cybersecurity vendor specializing in hybrid Active Directory and Entra ID identity threat detection, incident response, and cyber-resilient disaster recovery. Founded in 2013 and headquartered in Hoboken, New Jersey, the company was established by Mickey Bresman, Guy Teverovsky, and Matan Liberman to defend critical identity fabrics from destructive cyberattacks. Operating at a late-stage growth posture, Semperis protects more than 100 million user identities across global enterprises spanning healthcare, finance, transportation, and public sector infrastructure. The company delivers its Directory Services Protection Platform through a dedicated 100% channel partner distribution model, avoiding direct sales conflict while scaling enterprise procurement across global markets.[CO001, CO006, CO008, CO010, CO011, CO013]

1.2 Founders, Executive Leadership, and Governance Architecture

The company is guided by co-founder and Chief Executive Officer Mickey Bresman, who established Semperis's technical architecture around identity-first operational resilience. In June 2024, Semperis significantly bolstered its executive bench with three senior C-suite appointments designed to establish corporate governance and readiness for an eventual initial public offering. Chief Financial Officer Jeff Bray brings extensive public and private market experience from Rapid7, Imprivata, and Invicti Security, having managed over $1 billion in capital markets transactions. Chief Revenue Officer Mike DeGaetano previously led global sales organizations at Broadcom, Forcepoint, and Zscaler both before and after its IPO, while Chief Legal Officer Annabel Lewis contributes two decades of governance, compliance, and M&A leadership across Trustwave and Onapsis. While executive depth is substantially strengthened, day-to-day strategic direction remains heavily dependent on Bresman's founder-market fit.[CO002, CO003, CO004, CO005]

1.3 Capitalization Structure, Valuation, and Investor Syndicate

Semperis has raised over $325 million in total cumulative capital across its institutional financing history, supported by leading technology sponsors and growth equity funds. Following a pivotal $200 million Series C financing in 2022 led by global investment firm KKR, the company secured an additional $125 million growth financing facility in June 2024. Structured as a balanced blend of growth equity and venture debt from J.P. Morgan and Hercules Capital, the 2024 transaction confirmed Semperis's post-money valuation above the $1 billion unicorn benchmark. This capitalization strategy minimized equity dilution for founders and employees while expanding balance-sheet reserves for product development, global sales channel enablement, and strategic research and development across North America and Israel.[CO006, CO007, CO008]

1.4 Operational Scale, Strategic Milestones, and Architectural Risks

Since its commercial service launch in 2015, Semperis has expanded its operational footprint to safeguard mission-critical enterprise environments, serving landmark customers including Lenovo, Starbucks, United Airlines, and the Michigan state government. Beyond commercial platform deployments, the company earned widespread community goodwill through its free Purple Knight directory assessment tool, which evaluates Active Directory security posture across thousands of global practitioners. However, independent cybersecurity analysis underscores that over-reliance on legacy Active Directory architectures creates an acute systemic blast radius: because directory infrastructure was architected for administrative trust rather than sustained nation-state pressure, any compromise of core directory authorities threatens to invalidate downstream Zero Trust controls across the entire enterprise.[CO009, CO010, CO011, CO014]

1.5 Exhibits

2.1 A Narrow Identity-Resilience Boundary

The investable market boundary is narrower than identity and access management as a whole. Semperis positions its platform around preventing, detecting, responding to, and recovering from attacks on Active Directory, Entra ID, Okta, and Ping, while independent reporting describes Active Directory as the directory backbone for more than 90% of Fortune 1000 companies. Included spend therefore covers directory threat detection, cyber-first forest recovery, cloud-identity object and policy recovery, and crisis response. Generic single sign-on, routine identity provisioning, endpoint detection, SIEM, and ordinary infrastructure backup are adjacencies or substitutes, not part of a supportable core-market estimate. This boundary matters because broad IAM totals would materially overstate Semperis-addressable spend.[CM001, CM002, CM011, CM016]

2.2 Sizing Through Adoption Proxies, Not an Invented TAM

The assigned evidence supports several demand and deployment lenses but no independent market-spend series. TechCrunch and SiliconANGLE reported in 2024 that Semperis protected about or more than 100 million identities, while a May 2026 company release said more than 1,200 organizations relied on the platform. A June 2026 company-issued release used the looser wording “more than 1,000,” so both are best treated as lower-bound disclosures rather than an exact customer count. The Entra recovery product page separately reports 260 million users protected, but its denominator and overlap with company-wide identity counts are not explained. These figures establish scale and relevance; they cannot be converted into revenue, market share, or TAM without pricing, contract-value, deployment-overlap, and addressable-organization data.[CM001, CM003, CM004, CM005, CM006, CM012]

2.3 Buyer, User, Payer, and Adoption Path

The buying path crosses security, identity administration, infrastructure, and continuity functions. TechCrunch reports that CISOs are shifting attention toward identity resilience, while Semperis describes IT and security administrators as the operational users of Entra object and policy recovery. This implies a security-led purchase that must be validated by directory operators and justified through recovery readiness, outage exposure, or a failed control assessment. Semperis also describes an entirely channel-focused sales approach, making partners an important route into enterprise budgets and implementation workflows. Large hybrid estates and cloud-only Entra environments share the recovery problem, but procurement ownership, average contract value, renewal economics, and the split between security and disaster-recovery budgets remain undisclosed.[CM011, CM013, CM014]

2.4 Growth Drivers, Constraints, and Valuation Relevance

AI adoption is a plausible demand catalyst, but the available measurements are company-issued survey results rather than independent market forecasts. In a Semperis-reported Censuswide survey of 1,100 organizations across eight countries, 74% expected AI to increase attacks on identity infrastructure, 93% already used or planned to use AI agents for sensitive security tasks, only 32% were very confident they could regain control after administrator credentials were exposed, and 83% made AI identity governance a near-term priority. The gap between adoption and recovery confidence strengthens the case for dedicated resilience controls. Constraints are equally material: buyers may rely on native recovery assumptions, TechnologyAdvice flags limited automation for offloading recovery data, specialized tools compete with broader platform budgets, and no assigned source quantifies category spending or willingness to pay.[CM007, CM008, CM009, CM010, CM011, CM015]

2.5 Exhibits

3.1 Identity Security and Cyber Resilience Competitive Landscape

The identity resilience landscape spans distinct vendor categories that address enterprise directory security through divergent technical architectures. As enterprise directory infrastructure remains the primary attack surface across more than 90% of Global Fortune 1000 organizations, security leaders navigate four primary alternative classes: native directory provider tooling from Microsoft, legacy directory backup tools from vendors like Quest Software, enterprise data protection appliances such as Rubrik, Veeam, and Cohesity, and specialized identity threat detection and response (ITDR) vendors including CrowdStrike, Tenable, and Silverfort. Industry tracking from Tracxn identifies over 1,000 active competitors across the broader data protection and cybersecurity sector, yet true direct peers capable of automated Active Directory forest recovery remain exceptionally limited. Microsoft Defender for Identity and Entra ID represent the most prevalent baseline deployed across enterprise environments, yet their architecture emphasizes runtime telemetry and authentication monitoring rather than automated bare-metal or forest-wide disaster reconstruction. Consequently, Semperis competes less as a direct replacement for directory services and more as an indispensable cyber-resilience layer that enterprise security architects purchase to insure against catastrophic domain controller corruption.[CP001, CP002, CP003, CP004, CP005]

3.2 Core Architectural Capabilities and Threat Detection Differentiation

Technical differentiation in the identity security domain centers on the architectural separation between operational backup, runtime detection, and post-attack state restoration. Traditional enterprise backup solutions like Veeam, Rubrik, and Commvault capture entire operating system disk images or virtual machine snapshots; however, restoring a contaminated OS image frequently reintroduces dormant rootkits and malware payloads implanted by adversaries during persistent Active Directory intrusions. In contrast, Semperis pioneered an automated Active Directory Forest Recovery (ADFR) mechanism that isolates pure directory state data and reconstitutes forest topology onto clean, hardware-independent target instances, reducing average disaster recovery downtime by up to 90%. On the threat detection side, Semperis Directory Services Protector (DSP) monitors Active Directory replication streams directly, bypassing Windows Event Log auditing where sophisticated threat actors routinely conceal persistence mechanisms. While endpoint detection platforms like CrowdStrike Falcon Identity Protection excel at credential theft telemetry and real-time conditional access enforcement, they do not attempt forest disaster recovery. Similarly, free community tools developed by Semperis, notably Purple Knight and Forest Druid, serve as powerful top-of-funnel customer acquisition mechanisms, uncovering hidden directory attack paths and credential delegation risks that commercial suites frequently miss.[CP004, CP006, CP007, CP008]

3.3 Commercial Models, Pricing Structures, and Channel Distribution Dynamics

Semperis executes a 100% channel-driven go-to-market motion, collaborating closely with value-added resellers, systems integrators, and major public sector aggregators including Carahsoft. Commercial pricing is structured on a per-user, annual subscription model covering the Directory Services Protector (DSP) and Active Directory Forest Recovery (ADFR) modules, typically scaling with directory object complexity and total protected identities across hybrid environments. In government contracting, Semperis expanded its reach across defense and civilian agencies by adding its Identity Resilience Platform to Carahsoft's SEWP V and ITES-SW2 procurement vehicles. This channel alignment presents a direct contrast to Microsoft, which monetizes identity capabilities through broad Microsoft 365 E5 enterprise licensing bundles. For enterprise CISOs, the apparent zero incremental cost of bundled Microsoft Defender features exerts severe downward pricing pressure on Semperis for standalone detection capabilities. To defend pricing power and maintain gross margins, Semperis bundles disaster recovery and incident response guarantees that native platform licensing does not address, positioning the platform as operational resilience insurance rather than routine security monitoring.[CP009, CP010, CP011, CP012]

3.4 Switching Costs, Platform Bundling, and Displacement Vulnerabilities

The durability of Semperis's competitive moat is heavily anchored in high enterprise switching costs and deep integration into disaster recovery runbooks. Once an enterprise integrates Semperis for Active Directory forest recovery, migrating to an alternative vendor requires re-architecting air-gapped backup storage, validating new recovery automation scripts, and re-certifying compliance against NIST SP 800-207 and cyber insurance underwriting criteria. Furthermore, strategic storage partnerships with vendors like Cohesity establish immutable, air-gapped identity vaults that prevent malicious encryption during ransomware attacks. Despite these technical moats, displacement risks persist along two vectors: vendor consolidation and cloud migration. In economic environments where CFOs mandate tool rationalization, security executives face organizational incentives to accept 'good enough' security from incumbent endpoint platforms like CrowdStrike or Palo Alto Networks rather than maintaining dedicated point solutions. Concurrently, as enterprises gradually shift legacy Active Directory workloads to cloud-native Entra ID, Microsoft continuously enhances native tenant resilience features, threatening to compress Semperis's addressable on-premises recovery advantage over a multi-year horizon.[CP003, CP013, CP014, CP015]

3.5 Exhibits

4.1 Revenue Model, Pricing Mechanics, and Product Monetization Streams

Semperis generates the substantial majority of its revenue through multi-year enterprise software subscriptions protecting critical identity directory infrastructure. The core commercial engine is anchored by Directory Services Protector (DSP) for threat detection and posture management, and Active Directory Forest Recovery (ADFR) for automated bare-metal disaster recovery across hybrid Active Directory and Entra ID environments. These software licenses are priced on a recurring annual per-enabled-user subscription basis, with tiered pricing schedules that scale with enterprise identity counts. Customer deployments span more than 1,000 enterprise organizations and protect over 100 million user identities globally. Official pricing remains strictly list-based, with enterprise contract pricing realized through volume discounting, multi-year commitments, and enterprise license agreements (ELAs). Beyond core Active Directory protection, Semperis has expanded its monetization footprint into adjacent SaaS tenant recovery for Entra ID, Okta, and Ping Identity, diversifying subscription streams while preserving high recurring revenue quality.[CI001, CI004, CI011, CI014]

4.2 Go-to-Market Economics, Channel Leverage, and Sales Efficiency

Semperis executes an indirect go-to-market motion utilizing a 100% two-tier channel partner distribution architecture worldwide. Rather than fielding an exclusively direct enterprise sales force with high fixed customer acquisition costs (CAC), the company leverages global systems integrators, value-added resellers (VARs), and specialized security distributors to deliver its platform. In the public sector and federal defense market, Semperis partners with master government aggregator Carahsoft, securing placement on foundational contract vehicles including NASA SEWP V and Army ITES-SW2. While this channel strategy substantially compresses sales cycles, scales procurement velocity, and enables access to federal agencies, independent industry analysis indicates that procurement expansion alone does not resolve the operational governance and accountability gap required for directory resilience and crisis recovery. Furthermore, Semperis is pursuing FedRAMP authorization in 2026 through a 3PAO gap remediation plan to accelerate civilian federal adoption.[CI005, CI006, CI007, CI009]

4.3 Cost Structure, Unit Economics Proxies, and Private Metric Gaps

The cost structure of Semperis exhibits the typical operating leverage of high-margin enterprise infrastructure software, tempered by specialized hybrid deployment requirements. Cost of goods sold (COGS) comprises cloud hosting for SaaS telemetry and Entra ID tenant recovery, dedicated customer success engineering, and specialized incident response personnel who assist customers during catastrophic directory outages. Based on enterprise security peer benchmarks, core software gross margins are estimated in the 75% to 80% range, though professional services for complex forest recovery tabletop exercises and incident response carry lower margins. While commercial data aggregator CompWorth projects annualized revenue at $151 million with over 500 personnel, official company disclosures confirm only the $100M+ ARR milestone. Critical SaaS unit economics—specifically Net Revenue Retention (NRR), gross revenue retention, customer acquisition payback periods, and top-customer ARR concentration—remain tightly held private data, posing significant underwriting challenges.[CI001, CI008, CI012, CI013]

4.4 Capital Adequacy, Financing Dependency, and Underwriting Verdict

Semperis demonstrates robust capital adequacy following its $125 million strategic growth financing in June 2024 from J.P. Morgan and Hercules Capital. Notably, this round combined equity and non-dilutive debt financing, allowing the company to fortify its balance sheet, invest in R&D, and expand global distribution while minimizing equity dilution ahead of an anticipated initial public offering. TechCrunch confirmed the financing valued Semperis at over $1 billion, establishing unicorn status. To prepare for public company governance, Semperis recruited experienced public-market executives including CFO Jeff Bray, CRO Mike DeGaetano, and CLO Annabel Lewis. From an investment underwriting perspective, Semperis represents high revenue quality given its mission-critical Active Directory lock-in and 100% channel leverage, but opacity surrounding ongoing monthly cash burn, debt covenant structures, and organic ARR acceleration makes the financial profile a diligence priority prior to underwriting.[CI002, CI003, CI010, CI012]

4.5 Exhibits

5.1 Product Platform and Core Delivery Architecture

Semperis delivers a specialized hybrid identity resilience platform focused on securing, defending, and recovering Microsoft Active Directory and Microsoft Entra ID environments alongside Okta. Because Active Directory was originally architected for centralized enterprise administration rather than continuous nation-state cyberattacks, modern ransomware operators routinely compromise domain controllers to establish persistence, move laterally, and seize administrative control across enterprise systems. Semperis provides a comprehensive defense-in-depth platform that spans the entire attack lifecycle, dividing capabilities into pre-attack posture assessment, real-time threat detection and auto-remediation, post-breach forest recovery, and crisis coordination. By decoupling directory backup metadata from vulnerable operating system states and maintaining immutable storage options, the platform addresses systemic directory vulnerabilities that legacy backup tools cannot resolve.[CE001, CE002, CE012, CE013]

5.2 Modular Capabilities and Enterprise Migration Tooling

The commercial product suite is anchored by Directory Services Protector (DSP) for continuous threat detection and Active Directory Forest Recovery (ADFR) for automated disaster reconstitution. In September 2026, Semperis expanded its modular footprint with Migrator for Active Directory 2.0, a ground-up architectural rebuild designed to treat cross-forest migrations as high-risk security boundaries rather than routine data copy tasks. Built natively on Kubernetes, Migrator 2.0 introduces wave-based Directory Synchronization Sets, comprehensive change-staging reports, and in-place endpoint cutover agents that eliminate costly device reimaging during corporate consolidations and M&A integrations. Furthermore, Semperis supports practitioner adoption through community tools like Purple Knight and Forest Druid, enabling security teams to audit directory exposure across hundreds of vulnerability indicators before deploying commercial runtime defense.[CE003, CE004, CE005, CE014]

5.3 Operational Workflows, Zero Trust, and Deployment Dynamics

Under conventional operational models, enterprise recovery following a domain-wide ransomware incident requires manual server re-imaging, forest schema reconstruction, and trust re-establishment, taking an average of twenty-one days and incurring massive business interruption costs. Semperis replaces this manual sequence with orchestrated, cyber-first forest restoration that restores directory databases to pristine environments in hours, delivering an estimated ninety percent reduction in downtime. In threat prevention workflows, Directory Services Protector inspects replication streams to intercept suspicious attribute changes, privilege escalations, and rogue credential creation, executing automated rollbacks without taking domain controllers offline. These workflows align closely with zero-trust mandates and regulatory frameworks such as SEC Regulation S-P, which compel organizations to maintain rigorously tested disaster recovery mechanisms capable of resuming operations within strict reporting windows.[CE002, CE006, CE007, CE008]

5.4 Technical Differentiation, Security Controls, and Architecture Risks

Semperis's core technological defensibility stems from its proprietary understanding of Active Directory internals and its patent-backed recovery engine that restores directory state without restoring underlying operating system binaries that may harbor persistent malware. However, this specialized architecture creates inherent platform risks. Semperis is tightly coupled to Microsoft's directory protocols, Kerberos implementation choices, and Entra ID Graph APIs. As Microsoft enforces security deprecations—such as the phased elimination of legacy RC4 Kerberos encryption—enterprises face complex migration blockers and coexistence failures that require proactive configuration. Additionally, running deep privileged monitoring agents across mission-critical domain controllers creates potential blast-radius concerns, demanding rigorous change governance and reliable third-party validation to ensure automated remediation routines never inadvertently disrupt legitimate administrative access.[CE009, CE010, CE011]

5.5 Exhibits

6.1 Customer Segmentation and Enterprise Buyer Personas

Semperis targets enterprise organizations that operate mission-critical, hybrid identity infrastructure where Active Directory and Entra ID represent single points of operational failure. Primary buyers are Chief Information Security Officers (CISOs), Identity and Access Management (IAM) infrastructure leaders, and enterprise disaster recovery architects across regulated sectors. Customer segmentation divides into four primary tiers: Global 1000 enterprises facing complex multi-forest environments, healthcare systems safeguarding clinical availability, public sector institutions defending citizen services, and mid-market enterprises modernizing legacy directory architectures. Enterprise adoption is characterized by high operational switching costs, as Semperis integrates deeply into directory replication engines, backup storage vaults, and security operations workflows. Buyers prioritize automated, non-destructive recovery over traditional manual rebuilds to prevent prolonged enterprise downtime during ransomware extortion events.[CU001, CU003, CU006, CU007]

6.2 Adoption Trajectory, Identity Scale, and Market Penetration

Semperis' commercial adoption trajectory reflects rapid enterprise expansion following its 2020 Series B financing. The company scaled its customer base from approximately 50 enterprise customers in 2019 to over 1,200 organizations by 2026, while expanding protected user identities beyond 100 million across North America, Europe, and Asia-Pacific. Market penetration is particularly pronounced among elite global enterprises, with more than 25 percent of the 100 largest U.S. corporations deploying Semperis solutions to defend critical directory tiers. This customer expansion underpinned Semperis crossing the $100 million annual recurring revenue (ARR) milestone in January 2025. Customer adoption is typically initiated through free community assessment tools like Purple Knight before procurement teams commit to enterprise-wide Directory Services Protector and Active Directory Forest Recovery platform licenses. Independent economic analyses confirm substantial operational return on investment, highlighted by a 90 percent reduction in post-attack directory downtime.[CU001, CU002, CU004, CU010, CU011]

6.3 Production Case Studies and Sector Reference Validation

Verified production deployments substantiate Semperis' capabilities across diverse commercial, healthcare, and industrial operating environments. Notable public commercial references include Lenovo Group Ltd., Starbucks Corp., Sanofi, Hertz Global Holdings Inc., and United Airlines Holdings Inc., each relying on Semperis to protect core directory services from operational disruptions. In the healthcare sector, where ransomware attacks directly threaten patient care, deployments at Sharp Healthcare, Prime Healthcare, and Independence Blue Cross highlight the vendor's focus on clinical resilience. For instance, Sharp Healthcare leveraged Semperis Migrator for AD during complex hospital acquisition integrations to synchronize directory contacts and maintain unbroken clinical provisioning without compromising Kerberos authentication protocols. Similarly, industrial manufacturing conglomerate Dürr Group adopted Semperis following a subsidiary security breach to eliminate blind spots across hybrid Active Directory and Entra ID environments, establishing resilient forensics and rapid recovery readiness.[CU003, CU005, CU006, CU007, CU008, CU009]

6.4 Durability, Land-and-Expand Dynamics, and Concentration Risks

Customer retention durability is structurally supported by the architectural lock-in of Active Directory backup architectures and the specialized expertise required to safely restore compromised directory forests without reinfecting clean domain controllers. Third-party review aggregators record high customer sentiment, evidenced by a 4.8 out of 5.0 score across more than 1,200 reference evaluations on FeaturedCustomers. Platform expansion follows an identifiable land-and-expand trajectory, where initial forest recovery contracts expand into continuous threat monitoring, automated migration management, and multi-cloud identity defense across Okta and Ping Identity. However, Semperis maintains private disclosure regarding net revenue retention (NRR), gross churn cohorts, and top-customer ARR concentration. Furthermore, aggressive competition from comprehensive platform providers like CrowdStrike and Microsoft poses ongoing renewal friction, making explicit visibility into customer retention cohorts a mandatory diligence requirement for prospective investors.[CU011, CU012, CU013, CU014]

6.5 Exhibits

7.1 Risk prioritization and residual exposure

The most investable risk is strategic concentration, not a demonstrated product failure. An independent review characterizes Semperis as strongest where Active Directory is the critical identity tier, but says the value proposition weakens when Active Directory or Entra ID is not central and that broad multi-identity-provider detection requires another tool. Semperis counters that boundary with coverage of Active Directory, Entra ID, Okta, and Ping Identity, yet that statement is company-issued and does not establish equivalent depth across platforms. The residual exposure is therefore a narrowing standalone role if customers favor broader suites. A thesis break would be repeated losses in directory-led recovery deals, declining attachment outside Microsoft estates, or evidence that native platform recovery meets the same operational need at materially lower total cost.[CR001, CR002, CR003, CR015]

7.2 Operational, quality, and security execution

Semperis sells into failure scenarios where weak implementation can itself create material disruption. Its migration release identifies RC4-dependent service-account failures, cross-forest authentication breakdowns, and coexistence disruption as migration-window hazards, while describing staging, change previews, searchable logs, and deployment validation as mitigations. A separate company-issued release says legacy service accounts can accumulate excessive privileges and static credentials; the product response is inventory, monitoring, exposure detection, and automated rollback. Those controls are directionally relevant but are not independently benchmarked in the assigned evidence. The diligence standard should therefore be measured recovery exercises, failed-change and rollback logs, false-positive rates, time-to-clean-restore distributions, and reference calls from complex multi-forest customers rather than product descriptions alone.[CR004, CR005, CR006, CR010, CR015]

7.3 Regulatory, legal, and assurance gaps

The evidence supports customer compliance use cases, not a conclusion that Semperis itself has cleared every relevant authorization or legal risk. Company material explains that stale users and loose administrative controls can place customers at risk of non-compliance, and an independent profile reports public-sector availability through Carahsoft contract listings. The assigned pool does not establish current FedRAMP status, certification scope, privacy assessments, litigation, enforcement, intellectual-property disputes, or a complete incident record. Absence from this bounded source set is not evidence of absence. Before investment, counsel should review regulatory correspondence, material claims and disputes, security attestations, privacy impact assessments, incident notifications, and the precise representations and liability caps used in regulated-customer contracts.[CR009, CR010, CR016]

7.4 Partner, financing, and monitoring implications

Delivery and capital structure add execution risks that public disclosures do not quantify. Semperis describes Migrator for Active Directory as partner-first, with enablement and certification for delivery partners that retain the customer relationship, and says availability depends on regional ordering, support, and deployment requirements. That model expands reach but places implementation quality, capacity, and escalation discipline partly outside Semperis. Separately, TechCrunch reported that the June 2024 financing mixed equity and debt at a valuation above $1 billion, while two publications identified J.P. Morgan and Hercules Capital as financing providers. Funding raised is not cash available: covenants, amortization, burn, gross margin, retention, and current liquidity remain gaps. Monthly monitoring should cover partner-led deployment slippage, recovery-test outcomes, platform mix, renewals, cash consumption, covenant headroom, and material security events.[CR011, CR012, CR013, CR014, CR016]

7.5 Exhibits

8.1 Investment Thesis and Anti-Thesis

The central investment thesis for Semperis centers on the critical vulnerability of enterprise directory infrastructure. Because Microsoft Active Directory remains the core authentication backbone for approximately 90% of enterprise environments, it represents an inescapable single point of failure during modern ransomware campaigns. Semperis provides specialized cyber resilience and rapid forest recovery technology that minimizes catastrophic enterprise downtime. With more than 1,000 enterprise organizations relying on its platform, including over 25% of the 100 largest United States corporations, Semperis has established significant operational validation. Furthermore, its February 2026 acquisition of MightyID expands this defensive perimeter into multi-cloud Okta and Ping architectures. Conversely, the anti-thesis highlights long-term platform consolidation risk. Dominant cybersecurity platforms including Palo Alto Networks and CrowdStrike are aggressively building out identity protection capabilities, while Microsoft continues enhancing native Entra ID recovery tooling. If enterprise chief information security officers choose to consolidate point solutions into broader enterprise license agreements, Semperis could experience elongated sales cycles and pricing compression.[CV004, CV005, CV006, CV008, CV009]

8.2 Valuation and Capital Structure Context

Semperis has raised a cumulative total of $373 million in capital through June 2024, reflecting steady investor support across its development lifecycle. After closing a $40 million Series B funding round in 2020 that brought total funding to $54 million, the company secured a $200 million Series C financing led by KKR in 2022, which initially pushed its valuation past the $1 billion milestone. In June 2024, Semperis secured an additional $125 million in growth financing from J.P. Morgan and Hercules Capital. Critically, this latest round was structured as a combination of equity and growth debt rather than a pure equity round. Taking structured debt financing allowed leadership to fund accelerated research, development, and international channel expansion while minimizing equity dilution and avoiding an aggressive equity valuation repricing in a selective private software market. Commercial tracking data indicates a workforce of approximately 690 employees in 2026, indicating disciplined headcount scaling relative to its capital base.[CV001, CV002, CV003, CV007, CV010]

8.3 Scenario Modeling and Valuation Multiples

Evaluating Semperis across probabilistic operational scenarios provides a grounded framework for entry discipline and return expectations. In the base case scenario, Semperis compounds annual recurring revenue at a steady 18% to 22% rate while maintaining high renewal rates among its Global 2000 customer base. Assuming a public enterprise multiple between 8.0x and 10.0x annual recurring revenue, the company supports a justified enterprise valuation between $1.2 billion and $1.5 billion. The bull case scenario envisions accelerated international expansion, successful cross-selling of MightyID cloud resilience across its channel partner network, and market share gains from legacy backup tools, achieving ARR growth above 30% and supporting an exit valuation between $1.8 billion and $2.2 billion at 12.0x to 14.0x ARR. Conversely, the bear case scenario accounts for aggressive bundling by Microsoft and endpoint security platforms, which could slow annual growth below 10% and compress terminal valuation multiples to 4.5x to 6.0x ARR, yielding an enterprise valuation between $600 million and $850 million.[CV001, CV002, CV003, CV012, CV013]

8.4 Recommendation, Exit Readiness, and Diligence Asks

We conclude with an explicit investment recommendation of research-more with medium confidence and a medium risk rating. While Semperis possesses high technical defensibility and proven enterprise traction, the prevailing valuation exceeding $1 billion leaves little margin of safety given that critical financial indicators remain undisclosed. The company does not publicly disclose GAAP gross margins, cash burn velocity, or net revenue retention cohorts. However, governance actions signal active preparation for a future liquidity event. In conjunction with its growth financing, Semperis appointed seasoned C-suite executives including Chief Financial Officer Jeff Bray, Chief Revenue Officer Mike DeGaetano, and Chief Legal Officer Annabel Lewis, each possessing direct cybersecurity public company and initial public offering execution experience. Prior to committing growth capital or acquiring secondary shares, prospective investors must complete targeted diligence verifying unit economics, contract renewal waterfalls, and customer displacement rates against native cloud directory alternatives.[CV003, CV004, CV011, CV014]

8.5 Exhibits