Tech Industry Acquisitions

25 billion. Let that land. That’s the price Palo Alto Networks is paying to acquire CyberArk, not just a company, but a massive chunk of the identity-security market. This isn’t innovation. This is buying the market. From a business perspective? A clever move by Palo Alto. Expanding dominance, consolidating power, and tightening their position as the world’s largest cybersecurity vendor by market cap. But from a customer perspective? I see a different story. I’ve worked at Palo Alto myself. I know how the machine operates. It’s not about delivering the best security. It’s about extracting maximum value per customer. And when everything is pushed under one vendor and one strategy, the squeeze becomes very real. This acquisition means one thing for CyberArk customers: You will be squeezed out. Like a lemon. Because while it might look attractive, “one vendor for everything, easy integrations, simplified procurement”. The real outcome is vendor lock-in at a scale we’ve never seen before. All your eggs in one massive, shareholder-driven basket. And that’s the part many organizations underestimate. Ask yourself: Do you really want your entire security stack controlled by a single vendor whose primary obligation is to Wall Street, not your threat landscape? Consolidation may sound efficient. But in cybersecurity, diversity is resilience. Putting everything in one place doesn’t make you safer, it makes you dependent. This $25B deal should be a wake-up call. Not a convenience. Not a shortcut. A moment to rethink whether “one vendor to rule them all” is truly in your best interest.

Is tech M&A back? Google announced its intention to buy Wiz for $32b today. If approved by regulators, it would be the 6th largest technology M&A ever. This transaction would make Wiz the 5th most valuable pure-play security company. For Google, this would be its largest acquisition ever second to Motorola for about $12b. Notably two of the top three acquisitions are security. Mandiant sold for $5.4b. Why should Google be so interested in security? Microsoft’s Security Business generates $20b per year in revenue, so the market is large. A similarly sized business for Google, which trades at about 6x forward would create $120b in market cap. According to press, Wiz is between $500-1b in ARR. Assume revenue is 2/3 of ARR & it’s growing about 70%, which would imply about $850m in forward revenues. A premium 30x forward revenue multiple would suggest an acquisition price of about $25.5b. Google is paying a 25% premium for an extremely fast growing business in a core strategic cloud segment. A recent WSJ post highlighted the new FTC chair, Andrew Ferguson’s stance toward anti-trust may be more of the same for hyperscalers, which suggests a regulatory review is likely & a significant break-up fee likely in the terms. Does this suggest M&A is back in full swing? Without a doubt it shows major acquirors aren’t dissuaded by the public markets or the potential regulatory hurdles imposed by regulators. And startups are open to receiving premium offers, both of which are key ingredients to a vibrant M&A market. CrowdStrike, growing at 30%, trades at 18x forward.

𝐆𝐨𝐨𝐠𝐥𝐞'𝐬 𝐁𝐢𝐠 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐌𝐨𝐯𝐞: 𝐓𝐡𝐞 $32 𝐁𝐢𝐥𝐥𝐢𝐨𝐧 𝐖𝐢𝐳 𝐀𝐜𝐪𝐮𝐢𝐬𝐢𝐭𝐢𝐨𝐧 𝐄𝐱𝐩𝐥𝐚𝐢𝐧𝐞𝐝 Google is acquiring Wiz, for $32 billion, with plans to integrate it into Google Cloud by 2026. To put that price tag in perspective, it's roughly equivalent to what Microsoft paid for LinkedIn or what Salesforce paid for Slack. 𝐖𝐡𝐲 𝐖𝐢𝐳 𝐈𝐬 𝐖𝐨𝐫𝐭𝐡 $32 𝐁𝐢𝐥𝐥𝐢𝐨𝐧 𝐭𝐨 𝐆𝐨𝐨𝐠𝐥𝐞 Wiz has developed something special: an AI-powered security platform that gives organizations unprecedented visibility into their cloud environments. Think of it as having X-ray vision for your digital infrastructure—it spots vulnerabilities and threats that traditional tools often miss. What makes Wiz particularly valuable is its approach to multi-cloud security. Most large organizations today don't just use one cloud provider—they might use Google Cloud for some operations, AWS for others, and Azure for yet more. Managing security across all these environments has become increasingly complex, and Wiz offers a unified solution to this growing headache. 𝐓𝐡𝐞 𝐅𝐚𝐬𝐜𝐢𝐧𝐚𝐭𝐢𝐧𝐠 𝐃𝐞𝐚𝐥 𝐒𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞 Here's where things get interesting. Even though Google is buying Wiz, the company's products will continue to work on competing cloud platforms like AWS, Microsoft Azure, and Oracle Cloud. This is unusual but strategically brilliant for several reasons: - Customer retention: Wiz's existing customers won't need to switch cloud providers, preventing a mass exodus that would devalue the acquisition. - Regulatory smartness: By keeping Wiz operating across all major cloud platforms, Google avoids raising red flags with antitrust regulators who might otherwise worry about Google limiting a critical security tool to its own ecosystem. - Market expansion: Google can now earn revenue even from customers primarily using competing cloud services—essentially collecting "security rent" from its competitors' customer bases. The Price Negotiation Story What's particularly fascinating is that Wiz initially turned down an offer of about $23 billion last year. This confidence prompted Alphabet to increase its bid by nearly 40% to $32 billion. 𝐖𝐡𝐚𝐭 𝐓𝐡𝐢𝐬 𝐌𝐞𝐚𝐧𝐬 𝐟𝐨𝐫 𝐭𝐡𝐞 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲 While previous competition focused primarily on computing power, storage, and services, security has now emerged as a critical battleground. Microsoft and Amazon will likely respond with their own security-focused acquisitions. For enterprise customers, this is mostly good news. Google's resources will likely accelerate Wiz's product development, while the multi-cloud approach ensures continued choice and flexibility. However, this consolidation could eventually lead to higher prices if competition in the cloud security space diminishes. Early investors in Wiz are seeing exceptional returns, and this 𝐝𝐞𝐚𝐥 𝐰𝐢𝐥𝐥 𝐥𝐢𝐤𝐞𝐥𝐲 𝐭𝐫𝐢𝐠𝐠𝐞𝐫 𝐫𝐞𝐯𝐚𝐥𝐮𝐚𝐭𝐢𝐨𝐧𝐬 𝐚𝐜𝐫𝐨𝐬𝐬 𝐭𝐡𝐞 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐬𝐞𝐜𝐭𝐨𝐫.

Alphabet is buying Wiz for one of the highest (disclosed) revenue multiples in the history of large cybersecurity M&A. This deal is basically in a class of its own. Wiz falls somewhere between a 45-65x revenue multiple based on current estimates. (Note: ~$700M current revenue is estimated. Their most recent public disclosure was $500M). There's only one other cybersecurity-related transaction with a relatively similar profile: Okta's acquisition of Auth0 in 2021. I say *relatively* similar because Wiz's ARR is much higher than Auth0 had at the time of acquisition. The Okta-Auth0 deal had a 42.7x revenue multiple, which is easily the highest among large ($2.5B+) cybersecurity acquisitions that have actually closed. Leading the CIAM market was one of Okta's highest strategic priorities — so they paid a 42.7x multiple to buy the emerging market leader. Sound familiar? Leading the cloud security market is one of Alphabet's highest strategic priorities — so they're willing to pay an unprecedented multiple to buy a market leader while it's still private. No matter what it costs. --- A situation like Alphabet's acquisition of Wiz is comparable to CrowdStrike or Okta being taken off the board right before they went public. Alphabet is betting they are acquiring a future CrowdStrike or Okta. They know it takes a heavy premium to do it, and they clearly weren't willing to take "no" for an answer the first time.

The next major #cybersecurity platform isn’t coming from a security company. Last month, ServiceNow made two acquisition announcements that make its ambitions clear: 1) Veza - announced December 2nd for $1B+, bringing identity governance across human, machine, and AI identities. 2) Armis - announced December 23rd for $7.75B, entering exposure management across IT, OT, and connected devices. This is ServiceNow’s largest acquisition ever. These weren’t opportunistic bets. Even before the deals, ServiceNow’s security and risk business had crossed $1B in ACV, driven by workflow automation across security operations, incident response, vulnerability management, threat intelligence, and third-party risk. With Veza and Armis, ServiceNow has now tripled its security opportunity from ~$30B to ~$100B, adding $400M+ in ARR growing 50%+ YoY, and assembling the pieces of an end-to-end security platform. This mirrors a broader shift we’re seeing across the industry. In November, Palo Alto Networks - a security-native company - moved up the stack into CIO/CTO territory with its Chronosphere #acquisition. Now, ServiceNow, an infrastructure workflow leader, is moving into the CISO budget. The takeaway is clear: the era of pure-play cyber or pure-play #IT is coming to an end. What’s emerging instead is a converged infrastructure software market - one platform serving CISOs, CIOs, and CTOs from a shared control plane. This convergence will shape how products are built, how budgets are allocated, and where the next generation of infrastructure leaders emerge.

$740M for a category most security teams aren't monitoring yet. CrowdStrike is acquiring SGNL - identity security for AI agents. Most security teams have zero visibility into what AI agents can access inside their infrastructure. No governance. No controls. No monitoring. CrowdStrike just put a price tag on that blind spot. Same pattern I've watched for 20 years: New tech → new attack surface → ignored → breach → category explodes → big player overpays. Every. Single. Time. SASE. Zero trust. CSPM. XDR. Now AI agent identity. The CISOs who spotted these categories early bought smart. Everyone else paid the acquisition premium. Right now there are vendors building AI agent security. In 3 years there will be 3-4, owned by CrowdStrike, Palo Alto, and Microsoft. The buying window is open. It won't be for long. I've been tracking cybersecurity vendors since 2005. That's why I built IT-Harvest - 3,000+ vendors, 400+ categories, updated daily. The next $740M category is forming right now.

10 years from now, every large B2B company will be a security company, whether it wants it or not. This is already happening: > Accenture just bought a majority stake in Dragos, alongside full acquisitions of runZero and NetRise, for a combined value of approximately $4.2 billion, an absolutely massive amount for them. > Google’s largest-ever acquisition is a cybersecurity player (Wiz). Even more shocking, if you look across the transactions where they’ve disclosed pricing, Google spent $37.9 billion on just three cybersecurity companies - Siemplify, Mandiant, and Wiz - compared with roughly $41 billion on the other 62 acquisitions combined. That is an insane number if you consider that Google is not really a security company. > ServiceNow’s largest-ever acquisition is also a cybersecurity player (Armis). Not only that, but in a single month ServiceNow acquired more than one billion-dollar security company (Veza). > Mastercard’s second-largest acquisition ever is also a cybersecurity company (Recorded Future). Before doing that deal worth almost $3 billion, Mastercard did a bunch of smaller M&As like Ethoca in 2019, RiskRecon in 2019, and Baffin Bay Networks in 2023. > Cisco’s largest-ever acquisition is also a security company. Splunk is not a pure-play cybersecurity vendor, but security represents a major part of its business. What people don’t know is that Cisco is actually the most active cybersecurity acquirer, having absorbed more than 40 security companies over the past two decades. > Mitsubishi Electric, Apple, HP, HPE, and many other major technology and industrial companies have also spent a lot of money to acquire cybersecurity startups and integrate their capabilities into broader offerings. In the next decade, I think we’ll see more of this. Ecommerce companies will be buying fraud detection, AI coding platforms will be buying code security platforms, and so on. As all B2B companies become security companies, we’ll see a big shift in the market. 

Five recent mergers and acquisitions highlight how cybersecurity vendors are converging technology with services to capitalize on the US$10 billion MDR opportunity, which Canalys (now part of Omdia) is forecasting to grow 16% in 2025: • Sophos’ US$849 million purchase of Secureworks, which closed in February, giving it 2,000 enterprise accounts, and expanding MDR with XDR and SIEM assets, and DFIR and advisory services. • Arctic Wolf’s US$160 million purchase of Cylance Inc., which also closed in February, giving the MDR provider EDR and AI assets, and a customer base to migrate. • The merger between Cybereason and Trustwave, announced in November, bringing together Cybereason’s EDR with Trustwave’s MDR, DFIR and consulting. • WatchGuard Technologies’s purchase of ActZero for an undisclosed sum in December, which expands its existing MDR offering with automated threat response and third-party integrations. • N-able’s US$266 million acquisition of its XDR/MDR tech partner Adlumin in November. This is a highly competitive market with others like Alert Logic (acquired by Fortra), Bitdefender, Check Point Software (aquired rmsource), CrowdStrike, eSentire, OpenText (acquired Pillr), ReliaQuest, SonicWall (acquired Solutions Granted), ThreatLocker and Trend Micro and many more scaling offerings. The path to MDR emerging as a category has been gradual, yet inevitable. On the demand side of the equation is the threat landscape. More attackers are targeting smaller and midsized organizations that have less cybersecurity resources. On the cybersecurity supply side of the equation, the widening skills gap and growing complexity. Moreover, businesses need help securing their environments, and technology alone cannot fill the gap. The recent acquisitions highlight the direction of MDR services. For SMBs, scalable, low-touch, and automated services that go beyond managed EDR with poorly defined response services to managed XDR and risk management services, compliant with cyber insurance. For larger customers, more tailored offerings, with broader integrations, custom playbooks, threat hunting, and extensive DFIR. As a result, there will be more M&A between cybersecurity vendors and MDR providers. However, more than 90% of cybersecurity spending is to, through and with partners. Invariably, vendors will increasingly find themselves competing with their partners. The most successful vendors will be those that take a partner-first approach, enabling those that just want to resell or refer to do so without friction, and enabling more service-led partner to co-sell and co-deliver.

Oasis Security raised $120 million 131 days ago. Cyera just agreed to buy them for $1 billion. That is $6.3 million per employee, across 158 people. Cyera paid $50 million for Genie in May. Five people. Ten million a head. Same buyer, thirty times the headcount, roughly the same price per person. Third acquisition of 2026. Ryft in April, Genie in May, Oasis in July, on a $12 billion valuation and a fresh $600 million round. Here's what the numbers say. Three weeks ago we published the Q2 momentum board. Cyera topped Data Protection. Oasis topped IAM. Adjacent categories, adjacent boxes. Cyera did not buy a leaderboard entry. It bought the company pulling away from everyone else in the category it needed next. So what's happening? Non-human identity stopped being an identity problem. Every AI agent is a credential with read access to your data. Data security and machine identity have been two separate buying centers, and the agent wave just collapsed them into one. Momentum in isolation is a vanity metric, but read it across adjacent categories and you could have an acquisition map. The playbook for founders is simple, yet difficult to pull off: 1. Find the category next to yours where a funded buyer has a hole. 2. Accelerate visibly enough that they cannot model their roadmap without you. Oasis did both in under four years. Watch who tops Cloud Security next.

Breaking: Accenture just pulled off a $4.2 billion power move we've not seen from a consulting firm in years. While everyone else is busy talking about AI copilots, Accenture quietly spent billions buying the three companies that many OT security professionals would put at the top of their wishlist: Dragos, Inc., runZero, and NetRise. That's not just an acquisition strategy. That's a shopping spree across Infrastructure Defense and Cybersecurity. And it should make every consulting rival a little uncomfortable. Think about what just happened: →  Dragos, Inc. is arguably the biggest name in OT threat detection. →  runZero was founded by HD Moore, the creator of Metasploit. →  NetRise gives deep firmware and supply chain visibility. →  Accenture now gets to wrap all of that with consulting, managed services, and global client relationships. The interesting part? This doesn't feel like Accenture buying cybersecurity. It feels like Accenture buying leverage. Because when a client is running a power grid, water utility, manufacturing plant, or data center... Who has the stronger position? The firm giving advice? Or the firm that owns the platform helping defend the operation? That's why I think Deloitte, PwC, IBM, Capgemini, and every major consulting player will be watching this deal very closely. The OT security market may be worth $27B today and projected to approach $59B by 2031. But the bigger story is who gets to control the customer relationship when critical infrastructure becomes the most important cybersecurity battleground on the planet. Accenture just made its move.Who moves next? #Cybersecurity #Consulting #AI #OTSecurity #DigitalTransformation #Technology #Leadership