Updated October 21, 2026
In brief
Cybersecurity M&A is on a record pace by deal count in 2026 while disclosed value has fallen. Momentum Cyber counted 219 deals in H1 2026, up 3% on H1 2025, with disclosed value of $9.1 billion against $38.3 billion a year earlier, and roughly 90% of the deals were strategic. Google closed its $32 billion Wiz acquisition in March. Capstone Partners puts lower middle market averages at 4.3x revenue and 11.7x EBITDA.
Download
Available exclusively to cybersecurity founders, executives, and investors.
By the end of 2025, the global cybersecurity market changed fundamentally. We moved from an era of buying specific tools to one of aggressive platform consolidation. Fiscal year 2025 broke records for transaction value. It ended with over $84 billion in disclosed deal volume. The pace carried straight into 2026. Momentum Cyber counted 219 cybersecurity M&A deals in the first half of 2026, with $9.1 billion in disclosed value excluding previously announced megadeals, the fastest half on record. Google closed its $32 billion acquisition of Wiz in March and Palo Alto Networks completed its $25 billion acquisition of CyberArk in February. Accenture acquired Dragos, runZero and NetRise for $4.2 billion combined in June, and Cyera acquired Oasis Security for roughly $1 billion in July. In the lower middle market, Capstone Partners pegs sector M&A averages at 4.3x revenue and 11.7x EBITDA across 2025 and 2026 to date. The Cybersecurity M&A Activity Q2 2026 report tracks the quarter’s deals in full. Huge transactions dominated this figure and redrew the competitive map.1
What does this cybersecurity M&A report cover? This report from the Windsor Drake research desk tracks cybersecurity mergers and acquisitions: platform consolidation, acquirer behavior and valuation benchmarks relevant to founder-led security companies. Windsor Drake is a boutique sell-side M&A advisory firm with offices in New York and Toronto. Reviewed August 5, 2026.
We enter the first quarter of 2026 with a split market. Massive deals sit at the top. A high volume of small tech purchases sits at the bottom. The middle market has mostly disappeared. We expect Q1 2026 to stay busy for three reasons. Interest rates stabilized below the key 4% level. Regulators are enforcing strict rules like the EU’s NIS2 Directive. And Generative AI has matured into independent, agentic workflows.
Acquirers in 2026 have a new goal. They are not just buying revenue streams. They want Data Gravity and Autonomous Remediation . Palo Alto Networks bought CyberArk for $25 billion. ServiceNow bought Armis for $7.75 billion. These were not random events. They show that Identity and Asset Visibility are now the main control layers for the AI enterprise.2
Founders and investors face a divided reality. Strategic buyers pay huge premiums for the right tech. Revenue multiples exceed 15x and sometimes hit 50x for AI companies that complete a platform story.4 Vendors without a clear integration plan or AI angle see their values drop. These companies often sell to private equity firms at much lower prices.
A stable economy supports the Q1 2026 outlook. It encourages spending. The US economy landed softly after years of volatility. Global IT spending should reach $5.7 trillion in 2025. CEO confidence is back. That is a strong signal for M&A activity.9
Stable policy rates lowered the cost of borrowing for leveraged deals until the Federal Reserve raised its target range to 3.75% to 4.00% on September 16, 2026. This matters for Private Equity (PE) firms. History shows that when rates stabilize, CEO confidence jumps. Deals follow.5 PE firms sat out when debt was expensive. In H1 2026 private equity pulled back, and Momentum Cyber reported that roughly 90% of first-half deals were strategic, against a typical 60%.
Companies are cautious about the economy, but they protect cybersecurity budgets. Security is no longer optional. It is like insurance or legal compliance.
Goldman Sachs and Morgan Stanley see a good environment for 2026. There is a large backlog of companies that need to merge. Many venture-backed firms raised money at peak 2021 valuations. Now they are out of cash. The IPO market is picky. M&A is the main way out. This creates a buyer’s market for mid-sized assets worth $100M to $500M. These companies have good tech but are too small to go public.5
Forecasting Q1 2026 requires looking at how 2025 ended. The market saw eight acquisitions over $1 billion in 2025. These totaled nearly $75 billion in value. Value concentrated in a few huge deals. This shows a winner-take-all market. The biggest platforms are buying the most critical control points.
| Target Company | Acquirer | Deal Value | Sector Focus | Strategic Reason | Status (Dec 31, 2025) |
| Wiz | $32.0B | Cloud Security (CNAPP) | Securing cloud infrastructure. Competing with AWS and Azure. | DOJ Cleared. Closing 2026 1 | |
| CyberArk | Palo Alto Networks | $25.0B | Identity Security (PAM) | Making Identity the new perimeter. Securing non-human IDs. | Shareholders Approved 2 |
| Armis | ServiceNow | $7.75B | OT/IoT & Exposure Mgmt | Extending automation to physical assets. | Announced Dec 2025 3 |
| SolarWinds | Turn/River Capital | $4.4B | IT Ops/Observability | Private equity purchase for efficiency. | Completed 1 |
| Chronosphere | Palo Alto Networks | $3.35B | Observability/AI Ops | Data for Cortex XSIAM. AI-driven fixes. | Completed 13 |
| Jamf | Francisco Partners | $2.2B | Endpoint (Apple) | Dominating the Apple enterprise niche. | Closing Q1 2026 14 |
| Hornetsecurity | Proofpoint | $1.8B | Email Security | Expanding into European mid-market and Microsoft 365. | Completed 1 |
| Securiti AI | Veeam Software | $1.73B | Data Privacy (DSPM) | Merging data backup with security posture. | Completed 1 |
| Veza | ServiceNow | $1.0B | Identity Governance | Strengthening the AI Control Tower with identity data. | Pending 1 |
Table 1: The big deals of 2025 that shape Q1 2026.1
Total deal value for 2025 passed $84 billion . This is a huge jump from 2024. But the number of deals stayed flat or grew slowly.1 This market values quality over quantity. Acquirers are not buying features to check a box. They are buying market leaders. They want CyberArk for Identity. They want Wiz for Cloud. They want Armis for OT.
Buyers look different in Q1 2026. We see the rise of the “Super-Platform.” These companies want to merge security, IT operations, and engineering into one data structure.
Platform consolidation is the main trend for 2026. Customers are tired of vendor sprawl. They have too many tools. They want to cut down their stacks.
Private Equity sets the floor price in the market. They hold over $1 trillion in uninvested capital.5 Their strategy changed. They care less about pure growth and more about profit.
VC activity is steadying. But funding standards are much higher.
Money in Q1 2026 will go where the threats are. Three areas will dominate deal flow.
Identity is now the central nervous system of security. It is more than just logging in.
ServiceNow bought Armis to secure Operational Technology (OT) and Internet of Things (IoT). This sector is critical.
This segment is growing fast. Momentum Cyber counted 29 AI security acquisitions in H1 2026, against 10 in all of 2025.
North America still leads in deal value. But Europe and Israel will see big moves in Q1 2026.
Israel is the R&D lab for global cybersecurity.
Europe is a battleground because of the NIS2 Directive .
Valuations in Q1 2026 are split. High-growth AI platforms get premium prices. Older growth assets trade lower.
Public companies set the baseline for private deals. As of December 31, 2025, there is a wide gap.
| Company | Ticker | Enterprise Value (EV) | EV/Revenue (LTM) | Growth Status |
| CrowdStrike | CRWD | ~$116 B | 30.0x | High Growth / AI Platform 26 |
| Zscaler | ZS | ~$39 B | 14.5x | High Growth / Cloud 27 |
| Palo Alto Networks | PANW | ~$128 B | 14.0x | Mature Platform 27 |
| Check Point | CHKP | ~$18 B | 6.6x | Value / Profitability 28 |
| SentinelOne | S | ~$4.5 B | 5.5x | Path to Profitability 29 |
| Tenable | TENB | ~$2.9 B | 3.2x | Moderate Growth 30 |
| Rapid7 | RPD | ~$1.6 B | 1.9x | Moderate Growth 31 |
Table 2: Valuation Multiples of Public Cybersecurity Firms (Dec 2025). 26
Forecast for Q1 2026: Median M&A revenue multiples for strong private startups will be 12x to 18x . AI-native startups will get 20x+ . Legacy assets will sell for 3x-6x .
M&A strategy changed. It is less about growth and more about architecture.
Acquirers buy data . In the AI era, the vendor with the best data wins.
2026 is the year of Agentic AI. Systems must reason and act on their own.
Regulation drives the market in Q1 2026. It is not just a background issue.
As of January 2026, the EU’s NIS2 Directive is in full effect. Sweden’s law starts January 15, 2026. 23
Governments want data to stay in their countries. This is called Geopatriation. Global platforms like AWS and Google must buy local vendors to meet these laws. They need to meet standards like SecNumCloud in France. 24
New types of buyers are entering the market. It is not just the big cyber firms anymore.
Google, AWS, and Microsoft are now primary security vendors.
ServiceNow, Atlassian, and Datadog are in the game.
Companies like Mitsubishi Electric and Siemens are buying OT security firms.
Founders have clear ways to sell their companies in Q1 2026.
Acquirers use AI to check companies. They analyze codebases and customer data fast. Founders need their data rooms ready. They must prove their AI moat. They have to show their models are unique and not just wrappers around public LLMs.
The IPO market was quiet for a long time. Now, it is opening up for Q1 2026.
Netskope had an IPO in late 2025. They raised $908M at an ~$8.6B valuation. This proved public investors want high-growth cyber stocks if they show cash flow potential.7 The stock jumped 18% on day one.
Several unicorns are ready next:
Implication: A working IPO market sets a floor for valuations. Founders do not have to sell to PE. They can threaten to go public. This drives up M&A prices.
The outlook for cybersecurity M&A in Q1 2026 is strong. Platform consolidation defines the market. The huge deals of late 2025 set a new pace. Speed, scale, and integration matter most. AI agents now move through enterprise networks on their own. Security stacks must evolve to control them.
Investors see value in platforms that control Identity and Data . Founders have a better exit window than in recent years. But the entry price is high. Companies need growth. They also need to fit into the architecture of an AI-native world.
Disclaimer: This report is a forecast based on market data available as of December 31, 2025. Actual market conditions may vary.
FAQ
Momentum Cyber counted a record 219 cybersecurity M&A transactions in H1 2026, up 3% from H1 2025 and 39% from H1 2024, which puts the year on track to pass 2025’s full-year total of 400 deals. Disclosed value fell to $9.1 billion, less than a quarter of the $38.3 billion recorded in H1 2025.
More deals at smaller sizes, led by strategic buyers. Momentum Cyber found roughly 90% of H1 2026 deals were strategic, against a typical 60%, as private equity pulled back, and AI security acquisitions rose to 29 in the half from 10 in all of 2025. Platform consolidation continued as Google closed Wiz in March and Palo Alto Networks completed CyberArk in February.
It depends on size and growth. Capstone Partners puts lower middle market cybersecurity M&A averages at 4.3x revenue and 11.7x EBITDA across 2025 and 2026 to date. At December 31, 2025, public multiples ranged from 30.0x LTM revenue for CrowdStrike to 1.9x for Rapid7, and private equity paid 5x to 8x revenue in take-privates of non-AI assets.
The two largest recent deals are Google’s $32 billion purchase of Wiz, closed in March 2026, and Palo Alto Networks’ $25 billion purchase of CyberArk, completed in February 2026. ServiceNow agreed to buy Armis for $7.75 billion in December 2025. Accenture’s $4.2 billion combined acquisition of Dragos, runZero and NetRise in June was the first cybersecurity deal of 2026 above $1 billion, per Momentum Cyber.
Windsor Drake advises founder-led companies on sell-side M&A. A first conversation is confidential and starts with your numbers.
Research, not investment advice, a fairness opinion or a valuation of any specific company. Third-party data is cited to its source and remains its owner’s. Windsor Drake is not a registered broker-dealer and does not offer, sell or place securities. When a transaction requires a registered broker-dealer, that work is handled by a registered broker-dealer partner.
