SecurityWeek counted 39 cybersecurity-related merger and acquisition deals announced in September 2026. The most visible themes in its roundup include compliance and assurance, operational technology (OT), software supply-chain security, AI and data security, offensive testing, identity, and cloud security. That count is SecurityWeek’s, not an independently audited census of the entire market.
What September’s deal count includes
SecurityWeek’s October 6 roundup lists 39 cybersecurity-related deals announced during September. Its list is useful as a monthly snapshot, but the article does not define a complete market taxonomy or a method for deciding which transactions qualify. The capability themes below describe the highlighted deals; they are not a statistical breakdown of all 39.
As an Amazon Associate I earn from qualifying purchases.
SecurityWeek also cites more than 420 acquisitions announced in 2025 in its annual M&A report. That annual figure has a different time span, and its scope and methodology should be reviewed before comparing it directly with September’s monthly count.
Recommended Free Tools
Notable capability themes in the announced deals
Compliance, assurance, and public-sector expertise
A-LIGN announced its acquisition of Australian cloud security assessment firm AssurePoint on September 22. The company said the deal adds IRAP assessment capabilities and marks its entry into Australia. CEO Scott Price said the acquisition would let A-LIGN handle clients’ SOC 2 and ISO 27001 work alongside assessments for overlapping frameworks, rather than send them to a separate vendor. That is the company’s rationale, not evidence of realized integration or customer outcomes. A-LIGN’s announcement describes the deal.
#1 Best Overall
SecurityWeek also lists A-LIGN’s acquisition of Pathfynder, a penetration testing, red teaming, and incident response firm, now called Pathfynder by A-LIGN. IBM announced its acquisition of Logiq Consulting on September 24. IBM describes Logiq as a UK NCSC-assured cybersecurity consultancy with expertise in defense, critical national infrastructure, and the public sector; IBM says the acquisition expands its cybersecurity and sovereign technology capabilities for regulated and public-sector clients. That strategic rationale is IBM’s. IBM’s announcement provides its description of the acquisition.
OT and critical infrastructure
Spain-based managed security provider Aiuken Cybersecurity acquired 4Elitech, a Spanish specialist in industrial and critical-infrastructure cybersecurity, according to SecurityWeek. The roundup says the deal adds OT threat detection and industrial incident response.
Dragos completed acquisitions of NetRise and runZero after Accenture’s majority investment in Dragos closed. NetRise brings firmware-level device exposure and software supply-chain visibility; runZero adds asset discovery, exposure assessment, and attack-surface intelligence. Dragos says the combined capabilities sit alongside its OT asset visibility and threat detection. The terms of both acquisitions were not disclosed. Dragos’s follow-up reports their completion and undisclosed terms.
AI, data security, and cloud protection
Kiteworks announced the acquisition of Bonfy.AI, saying it intends to extend policy enforcement over sensitive data exchanged by people and AI agents. Palo Alto Networks acquired Console, an AI-native platform for building agentic workflows. SecurityWeek reported that Console’s technology is intended to deepen Cortex automation and that the cash-and-stock transaction was reportedly valued at $500 million. The reported price and product rationale should be understood as reported deal details and company strategy, not proof of integration or performance.
Upwind acquired Aegis in an all-equity transaction reportedly valued at $30 million, according to SecurityWeek. Aegis’s co-founders are to lead Upwind AI Security Labs. The valuation is reported, not independently verified here.
Offensive security and continuous testing
NetSPI and Synack agreed to merge; the merger should not be treated as completed. SecurityWeek reports that the proposed combined company has more than $200 million in revenue and describes plans to pair penetration testers with agentic AI for continuous security testing. Synack presents the combination as continuous offensive security. These are announced plans and reported merger context, not evidence of post-merger results. The companies’ merger page describes their announced combination.
Identity and compliance products
SecurityWeek lists Omada’s acquisition of EmpowerID, a deal in the identity space. Pistachio acquired Hugin.io intellectual property and plans to launch a compliance management product in 2027. That launch is a future plan; it is not an existing product.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Announced, agreed, and completed are not the same
The roundup mixes different stages of deal activity. Dragos reported completed acquisitions of NetRise and runZero. NetSPI and Synack agreed to merge, while Quorum Cyber announced its intent to acquire MXDR provider Ontinue. The Ontinue announcement describes a proposed Microsoft-first agentic SOC combining managed detection and response, cyber resilience, and human expertise; those are the acquirer’s stated plans, not demonstrated outcomes. Quorum Cyber’s announcement frames the transaction as an intent to acquire.
Best Value
Other transactions are described in SecurityWeek’s roundup as acquisitions or announced deals, but the reviewed announcements do not establish additional terms or status for every item. In particular, Quantum eMotion and Plurilock agreed to a roughly C$33.8 million (US$23.6 million) cash-and-stock acquisition. SecurityWeek says the proposed deal is intended to give Quantum eMotion cybersecurity revenue, customer relationships, and public-sector procurement channels. It remains an agreed transaction in the cited account, not a completed acquisition.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Other deals named in the September roundup
SecurityWeek’s list also names the following announced transactions. The reviewed sources do not establish their terms or status beyond the roundup’s announcement framing:
- Act Security / Cloud Copilot
- AXAITRA / Innovate
- CBTS / Recovery Point Systems
- CloudFirst / Forvis Mazars’ IT and cyber managed services practice
- Concentrix / CastleHill Managed Risk Solutions
- CyberMaxx / Avertium
- Epiq / Canopy
- Fime / Red Alert Labs
- Harvey / Guardrails AI
- InfraVia / Nexis
- ISMG / INE
- IT Solutions / STACK Cybersecurity
- ITC Federal / Apriva ISS
- Malam Team / Foretech Software
- Nomios / Orbcom
- Project Eleven / Riva Labs
- Risk X Group / Wolfpack Information Risk
- S&P Global / OpenZeppelin
- SecureSky / Soveren
- SGS / NetSentries
- Socure / Fravity
- Spin.AI / DoControl
- Surfshark / Optery
- ThreatBook / CyberStrikeAI
- TRG / Fentron
- Tusker / Fortress SRM
Why the deal values are not a reliable ranking
The roundup does not provide a consistent set of valuations for all 39 transactions, so it cannot support a meaningful ranking of the month by deal value. The $30 million figure for Upwind’s all-equity acquisition of Aegis is reported by SecurityWeek, while Dragos said the NetRise and runZero terms were not disclosed. SecurityWeek also reports more than $200 million in revenue for the proposed NetSPI–Synack combination; that is revenue context, not a purchase price.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
For readers tracking consolidation, the clearest signal in the selected deals is capability expansion: vendors are combining adjacent offerings across assurance, OT visibility, exposure management, identity, AI and data security, and offensive testing. Announced rationales describe what the companies intend to build or sell together. They do not establish that integration has happened or that customers have realized the promised benefits.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
