Cybersecurity M&A Activity: Q3 2026
Cybersecurity announced 40 transactions between 1 July and 25 August 2026, roughly one every 1.4 days, and the four that carried a published US dollar price total $3.29 billion. All four buyers sit outside the cybersecurity industry: Visa paid $2.4 billion for BioCatch, Munich Re $575 million for At-Bay, ScanSource $220.5 million for MicroAge and Datavault AI $94.5 million for CyberCatch. The sector's own acquirers bought capability and said so: CrowdStrike acquired XM Cyber's patents and source code and stated it acquires no revenue or customers, Fortinet called the Virtue AI consideration immaterial to its business, and Okta stated Permiso has no impact on guidance. Windsor Drake calls the structure The Outside Bid.
- Sector
- Cybersecurity
- Focus
- M&A Activity
- Published
- August 25, 2026
- Length
- 25 slides
- Reading time
- 13 minutes
Slide deck
25-slide deck. Desktop readers can page through the embedded viewer below. Mobile readers can open the direct PDF link.
Open slide deck PDF Key findings
- Windsor Drake recorded 40 cybersecurity transactions announced between 1 July and 25 August 2026, 19 in July and 21 in the first 25 days of August, an average of one every 1.4 days.
- Four transactions carried a published US dollar price and together total $3.29 billion; all four buyers are a payments network, a reinsurer, a technology distributor and a data and AI platform.
- Visa agreed to acquire BioCatch for $2.4 billion in cash on 3 August 2026, the largest published price in the sector during the period.
- Munich Re agreed to acquire At-Bay at a $575 million enterprise value on 19 August 2026, placing it under Hartford Steam Boiler.
- ScanSource agreed to acquire MicroAge for $220.5 million in cash at closing plus $3 million and $6.8 million of escrows, per the Form 8-K filed 20 August 2026.
- CrowdStrike acquired XM Cyber's intellectual property on 16 July 2026, more than 45 patents and source code, and stated it will not acquire any revenue or customers.
- Fortinet stated the consideration paid for Virtue AI on 17 August 2026 is immaterial to its business, and Okta stated its Permiso agreement has no impact on guidance issued 27 May 2026.
- Identity accounted for eight of the period's transactions, including Okta and Permiso, Keyfactor and Cofide, Cyera and Oasis Security, and Barracuda and Evo Security.
- Services and managed providers accounted for fifteen transactions, with Bank of America, AXA XL and LG Uplus each acquiring security services capacity for their own use.
- ENISA found that 70% of surveyed organisations name regulatory compliance with NIS2, DORA and the Cyber Resilience Act as the main driver of cybersecurity investment.
Methodology
Framework: The Outside Bid. Transaction counts are a Windsor Drake compilation of 40 cybersecurity transactions announced between 1 July and 25 August 2026, each taken from the buyer's own announcement or an SEC filing and each carrying named parties, a date and a stated purpose; Q3 is a partial quarter and is labelled as one throughout. The $3.29 billion of published consideration is the firm's own addition of four figures as each buyer published them. Market-level figures carry a named institution and a date. The Windsor Drake transaction index held 528 records on 25 August 2026 and is fintech-weighted; no market-level figure here is drawn from it.
Frequently asked questions
Which buyers set the price in cybersecurity M&A right now?
Buyers from outside the sector. Every published US dollar price between 1 July and 25 August 2026 came from a payments network, a reinsurer, a technology distributor or a data platform. Security vendors transacted at a similar cadence but bought capability, and three of them characterised the consideration as immaterial or guidance-neutral in their own releases.
How active was cybersecurity M&A in Q3 2026?
Windsor Drake recorded **40 transactions** announced between 1 July and 25 August 2026, **19** in July and **21** in the first 25 days of August. That is roughly one announcement every 1.4 days.
What was the largest cybersecurity deal of the quarter?
**Visa's $2.4 billion all-cash agreement to acquire BioCatch**, announced 3 August 2026. BioCatch protects more than 760 million users across 1.8 billion devices for more than 350 financial institutions.
What are buyers actually paying for?
Identity, above all machine and agent identity; AI security operations; exposure validation; and regulated services capacity. Four of the sector's own acquisitions in the period were identity transactions.
Should a founder expect a security vendor to pay the best price?
Not automatically. In this period the vendors bought technology and characterised the consideration as immaterial to their businesses, while the published prices came from buyers outside the sector who were acquiring a business rather than a product gap.
Does regulation affect who buys and what they pay?
Directly. ENISA found **70%** of surveyed organisations name compliance with NIS2, DORA and the Cyber Resilience Act as their main investment driver, and CRA reporting obligations apply from **11 September 2026**. Accreditation and jurisdiction transfer with the asset.
How long does a cybersecurity sale process take?
Plan **12 to 18 months** end to end. Announced transactions in the period carried stated closing timelines running from September 2026 to Visa's fiscal second quarter of 2027, so regulatory clearance should be modelled into runway from the outset.
Companies covered
Public and private companies referenced in this report.
Download the deliverables
If you are evaluating a sale
Windsor Drake is a sell-side only M&A advisory firm for founder-led software, fintech, and technology companies with enterprise values between $5 million and $300 million. This research comes from the same desk that runs our sale processes. If you are weighing an exit in this market, a confidential valuation is the place to start: no obligation, senior attention, and a view grounded in the transactions this report tracks.
Cite this report
Cybersecurity M&A Activity: Q3 2026. Windsor Drake Market Intelligence, 2026. windsordrake.com/market-intelligence/reports/cybersecurity-manda-activity-q3-2026. Windsor Drake Market Intelligence data is free to use with attribution to Windsor Drake (windsordrake.com).