Cybersecurity Sector Sees 39 M&A Deals in September 2026, Including Key Acquisitions by IBM and Palo Alto Networks

Overview of September 2026 Cybersecurity M&A

The cybersecurity sector saw 39 merger and acquisition deals announced in September 2026. This activity continues the trend of consolidation and strategic growth within the industry, following over 420 acquisitions in 2025.

Key Acquisitions and Strategic Expansions

Several significant acquisitions were reported. IBM acquired UK-based Logiq Consulting, a cybersecurity consultancy serving the UK defense, government, and critical infrastructure sectors, to expand its secure digital transformation and sovereign technology capabilities. Palo Alto Networks acquired Console, an AI-native platform for building agentic workflows, for an estimated $500 million in cash and stock, aiming to deepen its agentic capabilities.

A-LIGN, a cybersecurity compliance firm, acquired AssurePoint, a cloud security assessment company, to add IRAP assessments and enter the Australian market. A-LIGN also acquired Pathfynder, a firm specializing in penetration testing, red teaming, and incident response services. Aiuken Cybersecurity, part of the Allurity group, acquired 4Elitech, a Spanish specialist in industrial and critical infrastructure cybersecurity, adding OT threat detection and industrial incident response capabilities.

Focus on OT Security and Exposure Management

Dragos completed its acquisitions of NetRise and runZero, part of Accenture’s $4.1 billion OT cybersecurity initiative. NetRise provides firmware-level insight into device exposure and software supply chain visibility, while runZero adds asset discovery, exposure assessment, and attack surface intelligence. These acquisitions enhance Dragos's platform with exposure management and software supply chain security alongside existing OT asset visibility and threat detection.

AI and Offensive Security Developments

Kiteworks acquired Bonfy.AI, an AI data security company, to extend real-time policy enforcement over sensitive data exchanged by human users and AI agents. In offensive security, NetSPI and Synack agreed to merge, creating a combined company with over $200 million in revenue, which will pair expert penetration testers with agentic AI for continuous security testing.