NetSPI

NetSPI's acquisition pipeline is sourced through a combination of management relationships in the cybersecurity testing community, inbound interest from founder-owned firms seeking liquidity, and sponsor networks at Sunstone and KKR. The five add-ons completed between 2021 and 2023 — Silent Break Security, MQTest, NST Assure, Bishop Fox's consulting division, and nVisium — were all small-to-midsize offensive-security boutiques with established client books. Post-KKR acquisition, the firm has access to that sponsor's broader portfolio for cross-referrals and deal introductions.

NetSPI does not make fund commitments — it is a cybersecurity services company, not an investment vehicle. Its capital activity consists entirely of corporate M&A: the firm acquires smaller penetration-testing and security-assessment companies and integrates them into its platform. Any institutional investment in NetSPI itself occurs at the sponsor level through KKR's and Sunstone Partners' respective fund structures.

NetSPI is an operating company, not a fund, and does not co-invest alongside external GPs. The question of co-investment is more relevant to the sponsor level: Sunstone Partners and KKR each made their respective investments in NetSPI through their own institutional fund structures, and both sponsors have historically allowed limited-partner co-investment alongside their fund vehicles on a deal-by-deal basis. NetSPI management itself does not participate in co-investment arrangements.