TL;DR

The cybersecurity M&A market is undergoing a structural reset, not a cyclical dip. After a record-shattering 2025 — anchored by Google's $32 billion acquisition of Wiz — deal volume has slowed sharply in 2026 as AI fundamentally resets the build-versus-buy calculus. Startups that raised at $800M peak valuations are being shopped at $50M and still failing to attract bids. Valuation multiples for average players have compressed from 13.7x to 6–8x ARR. But the big platforms — CrowdStrike, Palo Alto, Zscaler, Check Point — are consolidating aggressively into AI-native capabilities. The winners are clear: agentic AI security, identity, data governance, and OT security. The losers are point solutions with no AI story and no platform home. This is a buyer's market that rewards conviction and punishes hesitation.

---

Background: 2025's Record Boom Set Unrealistic Expectations

The cybersecurity M&A cycle that peaked in 2025 was, in hindsight, fueled by artificial scarcity. With Google's $32 billion acquisition of Wiz landing as the largest cybersecurity deal in history, it signaled to every founder, LP, and corporate development team that sky-high valuations were achievable. Mergermarket data tracked $62.9 billion in cybersecurity M&A deal volume across 2025, nearly doubling historical averages. Other landmark transactions clustered around identity, cloud security, and AI detection capabilities, each reinforcing the narrative that any defensible moat commanded a premium.

That optimism did not survive contact with Q1 2026.

Dealmaking stalled sharply as acquirers stepped back to ask a question that 2025's frenzy had delayed: which of these assets can still command a premium once AI commoditizes what they do? For many point-solution vendors, the honest answer is: none of them.

---

The Structural Reset: AI as Valuation Destroyer and Creator

The ION Analytics/Mergermarket data published in late April 2026 captures what practitioners are describing as an inflection — not a correction. The Nasdaq CTA Cybersecurity Index is down 14% from its October 2025 high. Private market valuations have slid well below 2021–2022 funding peaks. The average cybersecurity startup that raised at a 20x ARR multiple in 2022 is now trading hands at 6–8x, and only if it can demonstrate proprietary data, defensible technology, and what buyers call "system-of-record status."

SecurityScorecard CEO Aleksandr Yampolskiy offered the sharpest data point in the current cycle: a company was recently offered to his firm at approximately $50 million — down from roughly $800 million at peak valuation. The offer was declined. Not because of the price, but because AI had eroded the product's underlying defensibility to the point where even a 16x haircut couldn't make the economics work.

This is the AI trap that dozens of cybersecurity startups are now caught in:

• Threat detection + correlation tools built on rule sets and signature matching → commoditized by LLM-native reasoning
• Compliance documentation platforms → AI-native alternatives built in weeks, not years
• Manual threat hunting workflows → automated by agentic AI pipelines
• Vulnerability scanning point tools → absorbed into platform agents with broader context

The critical distinction is not product category but data moat and workflow lock-in. Companies that own the authoritative record of something — identity posture, asset inventory, third-party risk scores — retain leverage. Those that merely process data someone else owns are exposed.

Boutique cyber M&A advisor Domenic Perri of Altitude Cyber, speaking at RSAC 2026, put numbers to the bifurcation: high-growth companies saw multiples expand to 13.7x revenue in 2025, while slow-growth peers watched multiples contract to 3.5x — down from 4.5x the prior year. The gap is widening in 2026 as the selective environment becomes more selective.

---

Technical / Strategic Analysis: Who Is Buying What and Why

The Platform Consolidators

The most telling signal in the April 2026 M&A data is which companies are acquiring and what they're buying. The major platforms — Palo Alto Networks, CrowdStrike, Check Point, Zscaler — have not stopped doing deals. They've refined their thesis.

Palo Alto Networks → Portkey ($120–140M): This is the defining deal of the current moment. Palo Alto is acquiring an AI Gateway — the control plane for routing, governing, and securing autonomous AI agent traffic. As enterprises deploy agentic workflows at scale, every LLM call, every tool invocation, every API handshake becomes an attack surface. Portkey's AI Gateway slots directly into Palo Alto's Prisma AIRS platform as the enforcement point for AI agent security. This is not a feature acquisition; it's an architectural bet that the AI control plane becomes as important as the firewall in the next three years.

Cyera → Ryft ($100–130M): Cyera, the $9B-valued data security firm, acquiring a data lake platform purpose-built for AI agents. The thesis: autonomous AI systems need governed, trusted, secure data stores to function safely. Enterprises deploying agents at scale without solving the data governance layer will face catastrophic insider-equivalent risks when those agents pull from uncontrolled sources. Cyera is positioning as the foundational data security layer for agentic AI — a TAM that didn't exist 18 months ago.

Silverfort → Fabrix Security (tens of millions): Autonomous identity security at runtime. As AI agents assume identities — service accounts, OAuth tokens, API keys, session credentials — traditional identity governance breaks down. Silverfort's acquisition of Fabrix brings an AI decisioning engine that evaluates access in real time rather than relying on pre-provisioned policies. This is the next phase of identity: not just who you are, but what you're doing and whether that behavior is anomalous for an agent operating at machine speed.

Airbus → Quarkslab: Europe's aerospace and defense sector building sovereign cybersecurity capability, specifically targeting AI-driven threats and reverse engineering protection. QShield addresses a problem that traditional endpoint vendors haven't prioritized: protecting software binaries from AI-assisted reverse engineering. As AI makes malware development faster and binary analysis cheaper, application hardening becomes a national security matter.

Fortra → Zero-Point Security: Red team training capacity acquisition. As enterprises staff up offensive security teams to keep pace with AI-accelerated adversary TTPs, the market for elite adversary emulation training has become a strategic asset. Fortra's Cobalt Strike and Outflank platforms become significantly more valuable when paired with a certified red team training pipeline.

The Emerging Consolidation Themes for H2 2026

Based on deal flow patterns and executive commentary, four sectors are drawing the most acquisition attention:

1. Agentic AI Security — Protecting autonomous AI systems: their identities, their data access, their communication channels, their prompt pipelines. This is the dominant thesis of 2026 M&A. Average enterprise now deploys an estimated 36.9 AI agents in production workflows (Gravitee State of Agent Security 2026), yet fewer than 47% have implemented monitoring. The gap between deployment and governance is the next category.

2. OT/ICS Security — The Everfield acquisition of Rhebo (from Landis+Gyr) signals continued consolidation in industrial security. Geopolitical tension, critical infrastructure targeting by state actors, and the convergence of OT networks with cloud management planes have made ICS anomaly detection a strategic asset class.

3. Identity Fabric — The identity perimeter has collapsed. Zero-trust requires granular, real-time identity assertion across human, machine, and AI agent principals. Acquisitions targeting autonomous identity security (Silverfort/Fabrix) and runtime access protection will accelerate.

4. MSSP and Services — Capstone Partners' May 2026 market update notes that general cybersecurity service providers and MSSPs accounted for 59.5% of YTD deal activity. As AI makes detection cheaper, differentiation shifts to human expertise, managed response, and customer relationships. Services businesses with recurring revenue, high retention, and skilled analyst pools are trading at premiums despite the overall market softness.

---

Market Sizing and Macro Context

Gartner projects global cybersecurity spending will reach $240 billion in 2026, up 12.5% year-over-year. This is not a declining market — it is a market being reorganized around a new threat paradigm. The ISC2 2025/2026 workforce survey identifies AI/ML as the #1 skill gap in security teams, cited by 41% of organizations. Cloud security follows second.

The Department of War cyber budget has expanded despite cuts to civilian federal agencies, underwriting demand for cleared, sovereign, and defense-grade cybersecurity capability — which explains the Airbus/Quarkslab and Fortreum/Kovr.AI (CMMC 2.0, FedRAMP, DOD SRG) acquisitions.

For private equity, the environment has sharply bifurcated. Sponsors are pulling back from new platform investments — higher cost of capital, pressure to stabilize existing portfolios. Strategic acquirers are filling the void: ServiceNow committed $7.8 billion for Armis (IoT/OT/asset intelligence), and Databricks has made aggressive security data bets. Large cash-rich companies with AI mandates are likely to accelerate acquisitions of AI-native security tools through H2 2026.

The build-versus-buy calculus has fundamentally shifted: AI makes internal development faster and cheaper, so acquisitions are now primarily justified by capabilities that can't be quickly replicated — proprietary threat intelligence, trained models, customer trust, regulatory certification, and specialized talent.

---

IOCs / Market Signals to Watch

Note: In an industry analysis context, these are strategic signals rather than technical indicators of compromise.

• Valuation floor signal: When companies that raised at $800M sell at $50M and still don't attract buyers, the dead-cat assets are fully marked. Markets clearing at these levels suggest a floor is forming for quality assets.
• AI Gateway as control plane: Palo Alto's Portkey acquisition will trigger competitive responses from CrowdStrike, Zscaler, and Check Point. Watch for AI Gateway / agent proxy acquisitions from each within 6 months.
• MSSP consolidation: 59.5% of deals in services signals that platform providers are vertically integrating delivery. Pure-play MSSPs without a platform affiliation are acquisition targets.
• Sovereign cyber: European defense + critical infrastructure (Airbus/Quarkslab, Rhebo/OT) signals a parallel track where geopolitical mandates drive acquisition outside US-centric logic.
• AI agent security TAM forming: The combination of Cyera/Ryft, PAN/Portkey, and Silverfort/Fabrix in a single month is not coincidence. The agentic AI security category is crystallizing. First-movers acquiring the right control points now will have platform leverage in 12–18 months.

---

The Lyrie Take

What's playing out in cybersecurity M&A is the same structural shift we've seen before — but accelerated by AI to a pace that's leaving defenders and deal-makers alike scrambling. The Google/Wiz deal was the capstone of the old paradigm: acquire a best-of-breed cloud security leader at a massive premium because building equivalent capability would take three years. That math no longer holds. With AI-assisted development, three years of engineering can compress to six months. The only sustainable acquisition thesis in 2026 is buying what you genuinely cannot build: proprietary data sets, regulatory certifications, customer trust built over a decade, and specialized human expertise.

The danger for the enterprise buyer is the opposite trap: assuming AI makes acquisition unnecessary. The companies executing the most disciplined strategies — Palo Alto, CrowdStrike, Silverfort — are not abandoning M&A. They are using it precisely: to acquire specific control points in emerging threat surfaces (AI agent governance, autonomous identity, OT anomaly detection) before the category consolidates around a competitor.

For security practitioners watching the market: the consolidation signals where the threats are going. When six major deals in a single month target AI agent security and identity runtime protection, that's not investor sentiment — it's a read of the threat landscape 18 months forward. Agentic AI is the next major attack surface. The deals being written now are the leading indicator.

Lyrie.ai's own architecture anticipates this trajectory. Autonomous cyber operations require the same capability stack being assembled through these acquisitions: AI-native identity trust, governed agent data pipelines, real-time behavioral anomaly detection, and platform-level control planes that span the full enterprise attack surface. We're watching this market not as observers but as participants in the paradigm being built.

---

Defender Playbook: Navigating the Consolidation Era

1. Audit your vendor stack for acquisition risk. Point solution vendors with no AI story and no platform affiliation are acquisition candidates — or sunset candidates. Identify which of your security tools are likely to be absorbed, deprecated, or EOL'd within 24 months and plan migration paths.

2. Demand AI agent security from every vendor, not just dedicated AI security vendors. Your EDR, SIEM, CASB, and identity platform all need native AI agent visibility. If your current vendors can't articulate their roadmap for agentic AI threat detection, treat them as legacy.

3. Inventory your AI agent estate now. If the average enterprise has 36.9 deployed AI agents and fewer than half have monitoring, your organization almost certainly has ungoverned agents. Catalog them: what identities they use, what data they access, what external systems they communicate with.

4. Prioritize identity for machine and AI principals. Human identity governance is mature. Machine identity — service accounts, API keys, OAuth tokens, agent credentials — is not. The Silverfort/Fabrix thesis is directly actionable: deploy runtime identity analytics that cover non-human principals.

5. Evaluate sovereign and compliance-grade vendors for regulated environments. The Airbus/Quarkslab and Fortreum/Kovr.AI deals signal that defense and critical infrastructure sectors are demanding vendors with sovereign capability and formal compliance certifications. If you operate in regulated environments, vendor selection criteria must include geopolitical and regulatory supply chain risk.

6. Don't conflate market softness with reduced threat. Cybersecurity spending is growing 12.5% YoY to $240B globally despite the M&A slowdown. The threat landscape is not softening. Use the current buyer's market to consolidate your own vendor footprint toward platforms with demonstrated AI-native roadmaps.

---

Sources

• ION Analytics / Mergermarket — "Cybersecurity M&A stalls after 2025 surge as AI resets valuations" (May 2026): https://ionanalytics.com/insights/mergermarket/cybersecurity-ma-stalls-after-2025-surge-as-ai-resets-valuations-dealspeak-north-america/
• SecurityWeek — "Cybersecurity M&A Roundup: 33 Deals Announced in April 2026" (May 2026): https://www.securityweek.com/cybersecurity-ma-roundup-33-deals-announced-in-april-2026/
• Capstone Partners — "Cybersecurity Market Update – May 2026" (May 6, 2026): https://www.capstonepartners.com/insights/article-cybersecurity-market-update/
• Gartner — Global Cybersecurity Spending Forecast 2026 ($240B, +12.5% YoY)
• Gravitee — "State of Agent Security 2026" (36.9 average AI agents per enterprise; <47% monitoring adoption)
• ISC2 — Cybersecurity Workforce Study 2025/2026 (AI/ML = #1 skill gap, 41% of teams)
• Palo Alto Networks — Portkey acquisition announcement (April 2026): https://www.paloaltonetworks.com/company/press/2026/palo-alto-networks-to-acquire-portkey-to-secure-the-rise-of-ai-agents
• Cyera / Ryft — Acquisition announcement (April 2026): https://www.businesswire.com/news/home/20260423988692/en/Cyera-Acquires-Ryft-to-Extend-its-Agentic-AI-Security-Platform
• Silverfort / Fabrix — Acquisition announcement (April 2026): https://www.silverfort.com/blog/fabrix-security-joins-silverfort-to-deliver-autonomous-identity-security-at-runtime/
• Airbus / Quarkslab — Acquisition announcement (April 2026): https://www.airbus.com/en/newsroom/press-releases/2026-04-airbus-strengthens-sovereign-cyber-security-with-acquisition-of-quarkslab-in-france

---

Lyrie.ai Cyber Research Division — Senior Analyst Desk