Thoma Bravo, the Chicago-based private equity firm, is exploring exit options for its healthcare IT security provider Imprivata, targeting a valuation around $7 billion, according to sources familiar with the matter. The potential sale, which could materialize through a strategic buyer or renewed IPO process, underscores private equity exit strategies in SaaS amid 2026’s elevated multiples for cybersecurity assets.
Set and exceed synergy goals with benchmarks and actionable operational initiative level data from similar deals from your sector:
đź’Ľ Actionable Synergies Data from 1,000+ Deals!
Deal Background and Financial Terms
Thoma Bravo acquired Imprivata in 2016 for $625 million from Tyco International. Since then, the Waltham, Massachusetts-based company has expanded its single sign-on and identity management platform, serving over 2,500 healthcare organizations including major systems like Cleveland Clinic and Kaiser Permanente. Annual recurring revenue has grown to approximately $400 million as of late 2025, with EBITDA margins exceeding 40%, per PitchBook data and firm disclosures.
The targeted $7 billion enterprise value reflects a 17x revenue multiple and over 30x EBITDA, aligning with Bain & Company’s 2025 Private Equity Report, which notes cybersecurity SaaS commanding premiums due to 25%+ CAGR in healthcare digital identity demand. Sources indicate Thoma Bravo has engaged Goldman Sachs to solicit bids from strategics like CrowdStrike, Palo Alto Networks, and Okta, alongside potential financial buyers such as Vista Equity Partners.
| Year | ARR ($M) | EBITDA Margin | Valuation Multiple (Entry/Est. Exit) |
|---|---|---|---|
| 2016 (Entry) | ~150 | 35% | 4x Rev |
| 2022 | 280 | 38% | N/A |
| 2025 (Est.) | 400 | 42% | 17x Rev / 30x EBITDA |
Synergies and Strategic Rationale
Imprivata’s platform addresses HIPAA-compliant access for electronic health records, a market McKinsey projects to reach $15 billion by 2028 driven by ransomware threats—up 300% in healthcare since 2023 per FBI data. Acquirers eye synergies in bundling Imprivata’s zero-trust authentication with broader endpoint security stacks. Thoma Bravo’s playbook mirrors its $12.5 billion Darktrace exit in 2024 and $4.3 billion Ping Identity IPO in 2022, both yielding 4-5x returns.
Leadership under CEO Wayne Morris, appointed in 2023, has prioritized AI-driven multifactor authentication, contributing to 25% YoY growth in 2025. No major layoffs are anticipated in a sale, though integration could trim 5-10% of back-office roles, consistent with Kirkland & Ellis-reviewed PE exits in tech services.
Industry Implications and Comparable Deals
This potential transaction signals resilience in healthcare cybersecurity M&A despite 2025’s high interest rates. BCG’s 2026 M&A Outlook highlights a 15% uptick in cross-border deals for healthtech security, with regulatory scrutiny from FTC and EU GDPR minimal for pure-play SaaS. Comparable exits include GTY Technology’s $1.2 billion ForgeRock acquisition by Thoma Bravo in 2021 (sold to private buyer at 12x revenue) and KKR’s $2.8 billion Optiv stake sale in 2025.
- Regulatory Risks: Low, given Imprivata’s U.S.-centric focus; contrasts with blocked $18 billion Broadcom-VMware antitrust saga.
- Market Trends: Private equity dry powder at $2.7 trillion (per Preqin) favors defensive SaaS with 90%+ gross margins.
- Valuation Shift: Multiples expanded 20% in Q4 2025 on AI tailwinds, per Goldman Sachs indices.
Thoma Bravo and Imprivata declined comment. A deal could close by mid-2026, offering a benchmark for private equity exit strategies in healthcare IT amid sector consolidation.
Sources
Â
