Cybersecurity M&A · 2026
Cybersecurity consolidates.
The mid-market decides.
The 2025 M&A cycle, worldwide and across Europe, and what it sets up for 2026.
Edition 01 · 2026 · © Nevon GmbH
The spending is structural.
The deals are concentrated.
Cybersecurity spending is structural and still compounding. Global information security spending reached $213 billion in 2025, up from $193 billion in 2024, and is forecast to reach about $244 billion in 2026 and $322 billion by 2029 (Gartner)1. Europe accounts for roughly a quarter of that market, about $56 billion in 20252.
The accelerant is AI, on both sides of the line: as a threat that widens the attack surface, and as a product that is redrawing what security software is. Spending growth is steady rather than spectacular. The drama of this cycle sits in dealmaking.
2025 was a record year for cybersecurity M&A by value: about $96 billion of disclosed value across roughly 400 deals (Momentum Cyber)3. But that value is concentrated in a few mega-deals, while the deal flow a mid-market advisor sees sits well below the billion-dollar line. This report reads both markets.
Nevon Partners advises founders, owners and investors across the European mid-market. This report is our read of where the capital is going, what it is paying, and where the next transactions will originate.
1Gartner public figures.
2Europe market size is a secondary market-research estimate (Fortune Business Insights), not Gartner.
3Cybersecurity M&A trackers diverge by universe, disclosed-only basis and window. 2025 disclosed value was reported between about $84bn (SecurityWeek) and $96bn (Momentum Cyber). This report anchors on Momentum Cyber.
Sources: Gartner (2025); Momentum Cyber, Cybersecurity Almanac (2026); Fortune Business Insights.
nevonpartners.com
Four numbers that frame the year.
$213bn
Global information security spending in 2025, up from $193 billion in 2024 and forecast to keep compounding.
Source · Gartner
$96bn1
Disclosed cybersecurity M&A value in 2025, up 270 percent year on year, a record by value.
Source · Momentum Cyber
~4001
Cybersecurity M&A transactions in 2025, up 22 percent by volume.
Source · Momentum Cyber
$20.7bn
Venture and growth financing in 2025, up 52 percent, with AI security the most financed sector.
Source · Momentum Cyber
1Cybersecurity M&A trackers diverge by universe, disclosed-only basis and window. 2025 disclosed value was reported between about $84bn (SecurityWeek) and $96bn (Momentum Cyber); deal-count growth was reported between about 7 percent (Solganick count) and 22 percent (Momentum). This report anchors on Momentum Cyber and treats value as concentrated in a few mega-deals.
Sources: Gartner (2025); Momentum Cyber, Cybersecurity Almanac (2026).
nevonpartners.com
Steady growth, not a spike.
Europe is about a quarter of the global market, roughly $56bn in 20252.
Breadth
Security software is the fastest-growing segment of the market.
Duration
A decade of double-digit growth, on track for $322 billion by 2029, a CAGR of about 10 percent.
Velocity
About plus 10 percent in 2025, and plus 12 to 13 percent forecast for 2026.
The AI layer
The AI-amplified security market is projected to grow from $49 billion in 2025 to $160 billion by 2029, embedded in the total, not additive to it.
The honest read
Budgets are climbing steadily, not spiking. The decisive movement in this cycle is in dealmaking, not in spending.
1Gartner restates each forecast vintage. The chart uses recent public figures; a consistent annual series requires Gartner client documents.
2Europe market size is a secondary market-research estimate (Fortune Business Insights), not Gartner.
Sources: Gartner (2025, including the 4Q25 AI-amplified security forecast); Fortune Business Insights.
nevonpartners.com
A record year, carried by a few deals.
$96bn1
Disclosed M&A value in 2025, up 270 percent year on year.
~4001
Deals in 2025, up 22 percent by volume.
$20.7bn
Venture and growth financing, up 52 percent.
Eight deals exceeded $1bn and 38 exceeded $100m in 2025.
Buyers
Strategic buyers retook the lead with 92 percent of disclosed value and 59 percent of deal count. Private equity completed 165 deals.
Targets
Cloud-native and SaaS targets were 59 percent of volume and 97 percent of capital.
Geography
Cross-border activity hit an all-time high at about 45 percent of deals, with Israel the largest source. Europe is a minority of activity, roughly 8 to 14 percent depending on the cut.
The honest read
Value is a mega-cap story. Volume rose only 22 percent, so the value increase is concentration, not breadth.
1Cybersecurity M&A trackers diverge by universe, disclosed-only basis and window. 2025 disclosed value was reported between about $84bn (SecurityWeek) and $96bn (Momentum Cyber); deal-count growth between about 7 percent (Solganick) and 22 percent (Momentum). This report anchors on Momentum Cyber.
Momentum Cyber, Cybersecurity Almanac (2026); concentration basis Google, Palo Alto Networks, Kroll, SecurityWeek.
nevonpartners.com
The middle has thinned.
The $100 million to $999 million band was the primary growth band in 2025, with acquirers buying mature firms rather than early-stage startups (SecurityWeek).
At the same time, the market has bifurcated. Mega-deals sit at the top, a high volume of sub-$200 million tuck-ins at the bottom, and the middle between $200 million and $1 billion has thinned. Mid-size exits of $300 million to $700 million face the thinnest liquidity in several years (Finro)1.
The financing market tells the same story from below: the median Series C and later deal size rose from $50 million in 2023 to over $80 million in 2025 (Momentum Cyber), pushing late-stage companies toward the exit bands where liquidity is tightest.
The top
Eight deals above $1 billion, led by Google/Wiz and Palo Alto/CyberArk, carry most of the disclosed value.
The middle
$200 million to $1 billion has thinned. Exits of $300 to 700 million face the thinnest liquidity in several years1.
The base
A high volume of sub-$200 million tuck-ins, the deal flow a mid-market advisor actually sees.
The honest read
By value, the market looks like a contest of a few platform buyers. By count, it is overwhelmingly mid-market, and that mid-band is exactly where positioning and process decide outcomes.
1Finro figures are one analyst dataset; averages overstate the typical company, medians are lower.
SecurityWeek (2025 year in review); Finro (Q2 2026 analysis); Momentum Cyber.
nevonpartners.com
Where the activity concentrates.
Platform consolidation
Cloud security
DriverStack consolidation and proactive prevention.
Anchor
Google acquired Wiz, $32bn, the largest cybersecurity deal on record.
Control plane
Identity and access
DriverIdentity as the control plane for AI and machine identities.
Anchors
Palo Alto Networks acquired CyberArk, about $25bn.
ServiceNow acquired Veza, $1bn. CrowdStrike acquired SGNL, $740m.
Volume engine
Security services and MSSP
DriverThe most active M&A category by deal count, managed-services consolidation.
Note
Mostly sub-$1bn transactions, with no single mega-anchor.
Regulation pull
Risk and compliance, GRC
DriverRegulation, NIS2 and DORA, pulls compliance demand.
Anchor
Dataminr acquired ThreatConnect, $290m.
Frontier capital
AI security
DriverThe most financed sector of 2025.
Anchors
Cyera raised $540m at a $6bn valuation.
F5 acquired CalypsoAI. Check Point acquired Lakera.
A bridge to the industrial engines: OT security links cybersecurity to the industrial and defense cycles, for example Mitsubishi Electric's acquisition of Nozomi Networks.
Company and regulatory announcements; aggregate context Momentum Cyber; Kroll.
nevonpartners.com
Growth sets the multiple.
Public EV/Revenue multiples split sharply by growth. High-growth vendors trade at roughly 13 to 15 times revenue, low-growth vendors at roughly 3 to 5 times1. Kroll's software M&A median sits at 8.1 times.
Managed security services trade at a median of about 11.1 times EV/EBITDA (Kroll), the reference point for services and MSSP assets.
Across market types, Finro reports public companies averaging about 9.2 times, private about 15.4 times and M&A about 18.8 times EV/Revenue2.
The honest read
Growth and recurring-revenue quality drive the premium. The gap between public, private and M&A pricing is the discipline question for any process.
Solganick 13.1× and 5.3× on 2025E; Houlihan Lokey 15.4×, 5.2× and 2.9×; Kroll 8.1× software M&A median.
1Public multiples vary by sample and by basis. Solganick and Houlihan Lokey use 2025E revenue; Solganick's Q4 update uses 2026E, which lowers the headline; Kroll's 8.1× is a software M&A median since January 2024.
2Finro figures are one analyst dataset; averages overstate the typical company, medians are lower.
Solganick (Q3 2025); Kroll (Fall 2025); Finro (Q2 2026).
nevonpartners.com
Two markets, one cycle.
01 · The established market
Platform, services and GRC consolidation.
Led by strategic buyers acquiring cash flow and platform density: platform strategics rolling up the stack, services and MSSP consolidators driving volume, and private equity building GRC and services platforms.
92 percent of disclosed M&A value came from strategic buyers.
02 · The frontier
AI-native security, funded at premium multiples.
Backed by late-stage venture capital, with AI security the most financed sector of 2025 and rounds like Cyera's $540 million Series E at a $6 billion valuation setting the pace.
$20.7bn of venture and growth financing in 2025, up 52 percent.
Momentum Cyber, Cybersecurity Almanac (2026); company announcements.
nevonpartners.com
Strategic buyers retook the lead.
01
Platform strategics
Buying platform density and cash flow, with capability deals concentrated in identity, cloud and AI security.
Active acquirers
Palo Alto Networks, CrowdStrike, Google, ServiceNow, Cisco, Proofpoint
02
Private equity
Take-privates and GRC roll-ups; 165 completed deals in 2025, buying cash flow rather than growth.
Active sponsors
Thoma Bravo, Francisco Partners, Vista Equity, KKR, TA Associates
03
Services and MSSP consolidators
The volume engine of the market: security services was the most active M&A category by deal count.
Profile
Managed-services roll-ups, mostly sub-$1bn
04
Cross-border acquirers
Israel into the US, and US and European platforms extending into Europe, at an all-time high share of deals.
Share
About 45 percent of deals were cross-border
The buyer universe is wide: 781 unique strategic buyers, 442 PE-backed and 180 VC-backed acquirers, and 165 private equity firms completed deals (Momentum Cyber).
Momentum Cyber, Cybersecurity Almanac (2026); company announcements.
nevonpartners.com
Financing returned at scale.
AI security
The most financed sector of 2025, taking the mantle from risk and compliance.
The marquee round
Cyera raised a $540m Series E at a $6bn post-money valuation, data security.
Late-stage gravity
Late-stage rounds carried the majority of deal value; the median Series C and later deal size rose from $50m in 2023 to over $80m in 2025.
The long view
More than $119bn has been deployed across about 6,500 deals in the cybersecurity landscape since 2019.
2025 aggregate
$20.7bn1
Venture and growth financing across 820 deals in 2025, up 52 percent year on year.
1Financing totals differ by universe. Momentum Cyber reports $20.7bn across 820 deals, up 52 percent; Solganick reports $13.97bn across 392 rounds, up 47 percent.
Momentum Cyber, Cybersecurity Almanac (2026); PitchBook.
nevonpartners.com
Part two
02
The themes shaping 2026.
nevonpartners.com
01
The stack is consolidating from point tools to platforms.
The defining shift of the cycle is from best-of-breed point tools to integrated platforms. Buyers no longer want a capability; they want density across the stack, and they are paying for it.
Strategic buyers deployed 92 percent of disclosed M&A value in 2025. Identity and cloud security carried the highest deal value, while security services led by deal count, the quiet consolidation underneath the headlines.
Platform density, not point capability, is the prize. That logic explains both the mega-deals at the top of the market and the steady flow of tuck-ins below them.
92%
Of disclosed M&A value deployed by strategic buyers in 2025.
No. 1 by value
Identity and cloud security carried the highest deal value.
No. 1 by count
Security services was the most active M&A category by deal count.
Momentum Cyber, Cybersecurity Almanac (2026); Solganick.
nevonpartners.com
02
AI is both the threat and the product.
AI widens the attack surface and, at the same time, is redrawing what security software is. Gartner projects the AI-amplified security market to grow from $49 billion in 2025 to $160 billion by 2029, embedded in the total, not additive to it.
The capital noticed. AI security became the most financed sector of 2025, taking the mantle from risk and compliance, and drew a wave of capability deals: F5 and CalypsoAI, Check Point and Lakera, SentinelOne and Prompt Security.
For acquirers, AI security is where capability is bought before it scales. For founders, it is the segment where the financing market still pays a premium for growth.
$160bn
AI-amplified security market by 2029, from $49bn in 2025 (Gartner).
No. 1
The most financed sector of 2025, ahead of risk and compliance.
$540m
Cyera's Series E, at a $6bn valuation, the marquee round of the year.
Gartner (4Q25); Momentum Cyber, Cybersecurity Almanac (2026); company announcements.
nevonpartners.com
Regulation is becoming a deal driver.
Europe's regulatory wave is moving from transposition to enforcement. NIS2 reaches its compliance culmination in October 2026, with first administrative penalties already issued in Q1 2026. DORA has applied to financial entities since January 2025 and now brings ICT and managed-security providers under direct supervisory oversight.
The chain for dealmakers runs in one direction: regulation drives compliance and GRC demand, and that demand feeds GRC and services M&A, already among the most active categories of the cycle.
The dealmaker's chain
Regulation creates compliance demand. Compliance demand creates GRC and services revenue. That revenue is what consolidators are buying.
| Regulation | Timeline | What it means for deals |
|---|---|---|
| NIS2 | Transposition deadline October 2024; compliance culmination October 2026; first administrative penalties Q1 2026, across 18 sectors. | Compliance demand across 18 sectors. Germany and Austria are among the member states that have transposed. |
| DORA | Applies to financial entities since January 2025; first supervisory enforcement cycle in 2026. | ICT and managed-security providers come under direct oversight, raising the bar for services vendors. |
| Cyber Resilience Act | Main obligations apply toward 2027, with earlier reporting obligations1. | Product-side security obligations for anything with a digital element. |
| Digital Omnibus | November 2025. | A single entry point for incident reporting via ENISA, simplifying overlapping regimes. |
1The Cyber Resilience Act entered into force on 10 December 2024. Reporting obligations apply from 11 September 2026 and the main obligations from 11 December 2027. Source: European Commission.
EU Commission; ENISA; published legal guidance (Lexology, Bird & Bird, Reed Smith).
nevonpartners.com
DACH value sits in services and the mid-market.
The German cybersecurity market is projected to grow from $13.0 billion in 2025 to $20.6 billion by 2030, a 9.6 percent CAGR1. The marquee DACH transaction of 2025 was Proofpoint's $1.8 billion acquisition of Hornetsecurity of Hanover, completed 8 December 2025: a managed-service and SMB Microsoft 365 security platform with about $200 million of ARR growing over 20 percent, previously backed by TA Associates. It is a clean signal of where DACH value sits, in MSP and mid-market security.
$13.0bn1
German cyber market in 2025.
$1.8bn
Proofpoint's acquisition of Hornetsecurity.
9.6%
Market CAGR to 2030.
German and DACH leadership is concentrated in trusted national vendors, secunet (listed), Rohde and Schwarz Cybersecurity, G DATA and Utimaco, and in a deep managed-services base, which trades at about 11.1 times EV/EBITDA (Kroll).
From spending to dealmaking
Regulation
NIS2 and DORA, transposed and enforcing.
Germany and Austria are among the member states that have transposed NIS2, and enforcement begins to bite in 2026.
Consolidation
MSP and services roll-ups.
The Hornetsecurity exit shows where the value sits: managed services and mid-market security platforms.
Sovereignty
BSI-certified and data-sovereign vendors.
Trusted national vendors hold positions in critical infrastructure that travel well in a consolidating market.
1German market size is a secondary market-research estimate (MarketsandMarkets).
MarketsandMarkets; Proofpoint announcement (Dec 2025); SecurityWeek; Kroll.
nevonpartners.com
Notable cybersecurity transactions.
| Target | Target HQ | Acquirer / Investor | Date | Value |
|---|---|---|---|---|
| Platform and exposure | ||||
| Wiz | Israel | 2025 | $32bn | |
| Armis | Israel | ServiceNow | 2025 | $7.75bn |
| Chronosphere | USA | Palo Alto Networks | 2025 | $3.35bn |
| Identity | ||||
| CyberArk | Israel | Palo Alto Networks | 2025 | ~$25bn |
| Veza | USA | ServiceNow | 2025 | $1bn |
| SGNL | USA | CrowdStrike | 2026 | $740m |
| AI security | ||||
| Protect AI | USA | Palo Alto Networks | 2025 | ~$700m |
| Lakera | Switzerland | Check Point | 2025 | ~$300m |
| Prompt Security | Israel | SentinelOne | 2025 | ~$275m |
| CalypsoAI | USA | F5 | 2025 | ~$180m |
| Target | Target HQ | Acquirer / Investor | Date | Value |
|---|---|---|---|---|
| Data security | ||||
| Securiti AI | USA | Veeam | 2025 | $1.725bn |
| Cyera financing | Israel | Series E | 2025 | $540m at $6bn |
| Services, MSP and OT | ||||
| Hornetsecurity | Germany | Proofpoint | 2025 | $1.8bn |
| Jamf | USA | Francisco Partners take-private | 2025 | $2.2bn |
| Red Canary | USA | Zscaler | 2025 | ~$675m |
| Nozomi Networks | USA | Mitsubishi Electric | 2025 | n/d |
| Risk and compliance | ||||
| ThreatConnect | USA | Dataminr | 2025 | $290m |
Cross-border M&A hit an all-time high at about 45 percent of deals, with Israel the largest source1.
1Cybersecurity M&A trackers diverge by universe, disclosed-only basis and window. This report anchors on Momentum Cyber and treats value as concentrated in a few mega-deals.
Company and regulatory announcements; aggregate context Momentum Cyber, Kroll, Houlihan Lokey, Solganick.
nevonpartners.com
Outlook for 2026.
Volume · momentum carries
Spending rises to about $244 billion in 2026 (Gartner), and deal momentum carried into early 2026, with 34 transactions tracked in January alone1. Expect activity to stay elevated, led by the sub-$1 billion bands.
Valuation · still bifurcated
The market stays bifurcated: a high-growth premium at 13 to 15 times revenue alongside a thin middle in the $200 million to $1 billion exit bands. Recurring-revenue quality keeps setting the multiple. Premium multiples are persisting into 2026: Cyera's valuation rose from $6 billion at its Series E in 2025 to $9 billion at its Series F in early 2026.
Buyers · strategics lead
Strategics lead, private equity stays active in take-privates and GRC roll-ups, and identity and AI security remain the capability priorities across the buyer pool.
What to watch in 2026
NIS2 compliance
Compliance culmination in October 2026, with first administrative penalties already issued in Q1 2026.
DORA enforcement
The first supervisory enforcement cycle runs through 2026, with ICT and managed-security providers under direct oversight.
Cyber Resilience Act
Product-side obligations build toward 2027, with earlier reporting obligations on the way.
1Early-2026 deal figures are preliminary tracker data.
Gartner (2025); preliminary 2026 tracker data; EU regulatory calendar as on page 15.
nevonpartners.com
What the cycle means for participants.
Founders and owners
Positioning decides the outcome.
The mid-market exit window between $200 million and $1 billion has thinned, so positioning, process and timing decide outcomes. Quality managed-services, GRC and AI-security assets are in demand.
Private equity and sponsors
From buying growth to buying cash flow.
Take-privates, GRC and services roll-ups, and platform density are the active plays. The market has moved from buying growth to buying cash flow, and pricing discipline is the central question.
Corporates and strategics
Capability buying continues.
Platform consolidation continues, with capability buying concentrated in identity, AI security and cloud, and cross-border reach a recurring motive behind the largest transactions.
Synthesis of report findings. Context: Momentum Cyber; Finro; Kroll; Gartner.
nevonpartners.com
Experienced. Digital. Human.
Partner-led.
Every mandate is led by a Partner from start to Closing. The people you meet leading up to a mandate are the people who run the process, so you get the full benefit of senior experience.
Digitally powered.
The same data and AI tools reshaping cybersecurity sharpen our work, mapping buyers, benchmarking valuations and running tighter processes, so you reach the right outcome with fewer surprises.
Human at the core.
Selling or scaling a security business is a personal decision, not only a financial one. Deals turn on trust, and earning it on both sides of the table is the part of the work we care about most.
Security consolidates.
Capital follows.
So should advice.
Edition 01 · 2026 · © Nevon GmbH