Cybersecurity M&A Activity: Q2 2026
Windsor Drake market intelligence on cybersecurity M&A in Q2 2026, covering deal volume and value, the platform-driven megadeal cycle, the buyer landscape and subsector deal flow. Disclosed value of pure-play cybersecurity acquisitions rose from about $28B in 2024 to roughly $84B in 2025, led by Google's $32B purchase of Wiz and Palo Alto Networks' $25B acquisition of CyberArk. Paired deliverables: a 33-slide deck and a long-form written report.
- Sector
- Cybersecurity
- Focus
- M&A Activity
- Published
- May 24, 2026
- Length
- 33 slides
- Reading time
- 8 minutes
Slide deck
33-slide deck. Desktop readers can page through the embedded viewer below. Mobile readers can open the direct PDF link.
Open slide deck PDF Key findings
- Disclosed value of pure-play cybersecurity acquisitions rose from about $28B in 2024 to roughly $84B in 2025, close to a tripling.
- Q1 2026 recorded about $47B of cybersecurity deal value in a single quarter, with 108 transactions logged.
- Google's $32B all-cash acquisition of Wiz closed in March 2026, the largest cybersecurity acquisition ever completed.
- Palo Alto Networks' roughly $25B acquisition of CyberArk closed in February 2026, making identity a core platform pillar.
- Eleven cybersecurity deals exceeded $1B in 2025, together carrying roughly $75B of disclosed value.
- About 426 cybersecurity deals were announced in 2025, up roughly 22% on 2024, while median transaction value climbed above $300M in Q1 2026.
- Global private equity dry powder stands at roughly $3.7T, with specialist sponsors accelerating take-privates of mature security software.
- Windsor Drake's base case forecasts 2026 disclosed cybersecurity M&A value at approximately $96B, with a bull case of $116B.
Methodology
Analysis draws on a proprietary Windsor Drake index of verified and reported cybersecurity transactions from 2019 to 2026, refreshed quarterly, alongside data from S&P Global Market Intelligence, CB Insights, PitchBook, McKinsey & Company, Goldman Sachs, EY-Parthenon and PwC. Deal-count and disclosed-value figures reflect public M&A announcement tracking; comparable transactions are normalised for consideration mix, earn-out weighting and assumed liabilities.
Frequently asked questions
How much is cybersecurity M&A worth in 2025 and 2026?
Disclosed value of pure-play cybersecurity deals reached roughly $84B in 2025, up from about $28B in 2024. Windsor Drake's base case projects approximately $96B for full-year 2026.
What is the largest cybersecurity acquisition ever?
Google's $32B all-cash acquisition of Wiz, which closed in March 2026, is the largest cybersecurity acquisition ever completed. It anchors cloud-native security inside Google Cloud.
Who are the most active buyers of cybersecurity companies in 2026?
Security platform vendors such as Palo Alto Networks, CrowdStrike, Cisco and Microsoft lead by value, alongside hyperscalers including Google and IBM. Private equity sponsors are active in parallel through take-privates and roll-ups.
How long does a cybersecurity M&A process take?
A full sale process runs 12 to 18 months end to end, comprising six to nine months of preparation, three to six months of market engagement, and three or more months for regulatory clearance. Cross-border deals run 30 to 50% longer than domestic transactions.
What cybersecurity subsectors are attracting the most M&A activity?
Cloud security and identity and access management draw the highest strategic buyer activity, with platform vendors and hyperscalers both rated high in those subsectors. Data security, GRC and network security also see strong deal counts, particularly from private equity.
Are earn-outs common in cybersecurity deals?
Earn-outs remain standard for AI-native and early-traction assets, with performance-linked tranches typically paid over 12 to 24 months. All-cash consideration has returned for larger, more established assets where buyers prize certainty.
Companies covered
Public and private companies referenced in this report.