NEVERHACK | AI Transformation Index

Overview

NEVERHACK is a French cybersecurity services group that generates revenue by delivering managed detection and response (MDR) through a SOC 3.0 operation, cybersecurity crisis simulation training via its Cyber Jumanji platform, and security consulting/advisory services to enterprise clients across 10 countries.

Executive Summary

NEVERHACK is a cybersecurity services roll-up with a genuine AI opportunity in SOC automation — its analyst-heavy MDR operation represents meaningful compressible cognitive labor — but faces structural durability risk from the same force: as AI-native security platforms absorb the automated detection and response layer, the intermediary position NEVERHACK occupies in managed services compresses. The consulting, training (Cyber Jumanji), and compliance advisory lines are more durable and should be the strategic emphasis, as they sit closer to the trust-based, judgment-required end of the cybersecurity value chain that AI platforms cannot easily commoditize. For Carlyle, the strategic question is whether NEVERHACK can use AI to transform its SOC economics before platform vendors disintermediate the function — and whether the consulting/advisory layer is large enough to anchor valuation if MDR margins compress.

Durability Rationale

NEVERHACK's durability is real but structurally constrained: demand for cybersecurity services is expanding and AI-amplified threats directly feed that demand, but the company's primary MDR/SOC function is exposed to profit pool migration as platform-native security (CrowdStrike, Microsoft, Palo Alto) absorbs the automated detection and response layer that mid-market MSSPs have historically monetized. The consulting, compliance advisory, and training lines are more durable — they involve regulatory judgment, enterprise trust, and contextual advisory that resist both AI substitution and platform commoditization — but these are currently a smaller share of the business. The post-acquisition scale and European regulatory tailwinds (NIS2, DORA) provide meaningful protection, but the structural threat to the SOC intermediary role is genuine and not solved by scale alone.

Opportunity Rationale

The AI opportunity for NEVERHACK is substantial and most concentrated in the SOC and MDR function: a business built on analyst-hours of alert triage, log correlation, and threat synthesis is precisely the kind of cognitive labor compression play where AI delivers step-change economics — fewer analysts covering more clients at higher throughput. The domain intelligence dimension is credible in cybersecurity, where adversary evolution genuinely outpaces public knowledge and where multi-client telemetry creates proprietary signal that applied AI can amplify. The transformation upside is real but bounded by NEVERHACK's services-led model — the path to platform-like economics exists but requires deliberate structural shift, not just tooling adoption.

Key Risks