TL;DR
- ServiceNow closes $7.75B Armis acquisition — the largest pure-play cybersecurity deal in enterprise software history — combining asset visibility with autonomous risk remediation and NowAI workflow orchestration.
- Cyera acquires Ryft ($100–130M) to build a "unified control plane" for agentic AI data access — three days after Cyera's $9B valuation crossed the wire.
- Proofpoint acquired Acuvity (February 2026) positioning itself as the first vendor to "comprehensively secure the agentic workspace."
- QuoIntelligence raises €7.3M Series A on the back of NIS2/DORA mandating continuous threat intelligence across 160,000+ European organizations.
- The thesis connecting all four: security is no longer a product category — it's a platform control layer, and the platform must operate at machine speed.
Background: How We Got Here
In January 2024, the cybersecurity vendor landscape still looked like a catalogue. There were 3,500+ point tools across 18 recognized product categories. Enterprise security teams ran an average of 76 separate tools. CISOs joked that their job had become "buying SaaS subscriptions and hoping they talk to each other."
Then three things happened simultaneously.
AI agents went to work. Not the demo kind — the production kind. By Q1 2026, enterprises were running thousands of autonomous AI agents against internal data, APIs, and workflows. These agents didn't have static identities. They shifted identity based on task, tools, and delegation chain. Legacy DLP, SIEM, and IAM products — built for human-speed, human-initiated access — were blind to them.
The regulatory baseline moved. NIS2 entered enforcement in late 2024. DORA followed in January 2025. Together they imposed proactive, continuous cyber risk management on more than 160,000 European organizations — including every significant player in financial services, manufacturing, government, and critical infrastructure. Reactive security was no longer a compliant security posture. You needed continuous, forward-looking threat intelligence. You needed evidence of it.
Attack velocity inverted the human model. The mean time from CVE publication to first exploitation dropped below 24 hours for critical vulnerabilities in 2025. In Q1 2026, several zero-days saw weaponized PoCs within hours of disclosure. The analyst review-and-ticket model — where a human sees an alert, opens a ticket, and routes it to another human — was no longer compatible with the threat timeline. The loop was structurally too slow.
These three forces converged in early 2026 to produce what may be the most consequential 90-day acquisition window in cybersecurity history.
The Deals, Decoded
1. ServiceNow + Armis: The $7.75B Control Tower Bet
ServiceNow closed its acquisition of Armis Security for approximately $7.75 billion in cash on April 24, 2026 — funded through a combination of cash on hand and debt, with Tidal Partners serving as lead financial advisor.
Armis built its reputation as the definitive cyber asset intelligence platform: agentless discovery of every connected device across IT, OT, IoT, cloud, and medical environments. The platform mapped assets in real time, scored cyber exposure, and identified drift. What it couldn't do was act on that intelligence at scale.
ServiceNow's Now Platform could act — it owns half the world's enterprise workflow automation. But it lacked the asset intelligence to know what to act on.
The combination is architectural: Armis feeds continuous, real-time asset context into ServiceNow's Context Engine, which automatically prioritizes risk, routes remediation workflows, and can trigger autonomous response actions without human approval for lower-severity events.
This deal doesn't stand alone. In March 2026, ServiceNow acquired Veza — an AI-native identity intelligence platform — which brought fine-grained visibility into who has access to what data and whether that access is appropriate. Now add Armis: what system has what vulnerabilities. Combine: a platform that knows identity × asset × exposure, can reason about the intersection in real time, and can remediate autonomously.
ServiceNow VP John Aisien framed it without modesty: "We're positioned to build the largest cyber business in the world." Armis CEO Yevgeny Dibrov called it the "control tower" for enterprise security in the AI era.
The strategic signal: the future of enterprise security is a workflow orchestration platform with autonomous response primitives built in, not a security product with workflow bolted on. ServiceNow just paid $7.75B to prove it.
2. Cyera + Ryft: The Agentic Identity Problem, Solved (Maybe)
Five days ago, Cyera — valued at $9 billion following a $400M Series F in January 2026 — announced the acquisition of Ryft for an estimated $100–130 million.
Ryft is a two-year-old startup that solved a specific, painful problem: how do you track and govern data access when the entity accessing the data is an AI agent that shifts identity based on task, tool context, and delegation chain?
Cyera CTO Tamar Bar-Ilan was direct: "Agents shift identity based on the task, the tools, and the chain of delegation from other agents. That is a fundamentally different identity model than anything enterprise security was built for."
The legacy model works on static principals: user Alice has role X, therefore Alice can access Y. AI agents don't have static principals. An agent running a data pipeline job at 2 AM might operate with one set of permissions, then receive a delegation from an orchestration agent, and operate with an entirely different scope — without any human in the loop making that transition.
Ryft built instrumentation specifically for this model: tracing the full data lineage of agent actions, flagging anomalous access patterns (e.g., an agent suddenly exfiltrating data it hasn't touched before), and enforcing policy at the tool-call level.
Combined with Cyera's existing data security posture management (DSPM) platform, the acquisition creates what Cyera is calling a "unified control plane" — a single layer that governs data access for both human users and AI agents across enterprise environments.
The market timing is sharp. The Cyera-Ryft deal closed the same week that Anthropic's research team showed a production-grade AI agent autonomously mapping and extracting sensitive data from a mock enterprise environment in under 90 minutes. The attack surface isn't theoretical anymore.
3. Proofpoint + Acuvity: The Agentic Workspace Bet (February 2026)
Proofpoint's February 2026 acquisition of Acuvity added AI-native visibility and governance into what Proofpoint positioned as "the first unified platform to comprehensively secure the agentic workspace."
Acuvity had built fine-grained observability into enterprise AI usage: which tools, which models, which data, which users — and whether those interactions introduced regulatory or data-exposure risk. Think of it as a DLP layer, but purpose-built for agentic AI traffic rather than email attachments.
The deal validated a bet Proofpoint had been making since 2024: that the next major threat vector wouldn't be phishing or malware — it would be employees (and agents) using AI tools in ways that inadvertently exfiltrate intellectual property, regulated data, or customer PII.
A separate survey released this week (cited in our recent analysis) found that 52% of organizations admit they cannot fully trust their AI security controls — they've deployed policies, but they can't verify enforcement. Proofpoint + Acuvity is a direct response to that confidence gap.
4. QuoIntelligence €7.3M Series A: Regulation as Market Creator
While the above deals address the supply-side of autonomous defense, QuoIntelligence's €7.3M raise (led by Elevator Ventures and BMH, announced April 27) captures the demand-side structural shift.
Frankfurt-based QuoIntelligence builds "finished" threat intelligence — contextualized, actionable reports automatically generated from raw intelligence feeds, regulatory filings, and threat actor telemetry. Their pitch: NIS2 and DORA don't just require you to have security controls — they require you to demonstrate proactive, continuous threat intelligence with audit-grade documentation.
For the 160,000+ European organizations now in scope, that's a compliance requirement, not a nice-to-have. QuoIntelligence CEO Sebastien Meriot put it plainly: "NIS2 and DORA have turned what was a competitive advantage for our customers into a regulatory baseline for every mid-market company in Europe."
The Series A gives QuoIntelligence runway to expand from its current German and Austrian customer base into the broader European mid-market — financial services, government, manufacturing — where NIS2/DORA compliance is still a live project for most security teams.
The investment thesis is interesting: regulation is not just a compliance burden — it's a market creation mechanism. By mandating continuous threat intelligence, the EU essentially guaranteed a buying cycle for vendors like QuoIntelligence that didn't exist at scale two years ago.
The Convergence Thesis
Strip the deal-by-deal analysis and a single pattern emerges: four separate bets on the same architectural premise.
Security must:
1. Know everything (asset visibility, identity graph, data lineage)
2. Reason over that knowledge in real time (AI/ML enrichment, context engines)
3. Act without waiting for humans (autonomous response, workflow orchestration)
4. Prove it continuously (regulatory documentation, audit trails)
This isn't a product feature list. It's a platform architecture. And building it from scratch is prohibitively expensive — which explains why incumbents (ServiceNow, Proofpoint, Cyera) are buying rather than building.
The losers in this consolidation will be the point-tool vendors who built excellent detection capabilities but no response primitive, and excellent response capabilities but no intelligence layer. The buyers are explicitly avoiding those gaps. ServiceNow paid $7.75B specifically because it couldn't build asset intelligence fast enough organically.
The Autonomous Defense Inflection Point
There's a harder question underneath all of this: are these acquisitions defensive or offensive moves?
The optimistic read: the industry is finally building the infrastructure needed to close the human-speed gap. A platform that sees everything, reasons over it automatically, and remediates without tickets is genuinely better security.
The pessimistic read: consolidation at this scale creates monoculture risk. When ServiceNow's Context Engine becomes the standard risk prioritization layer for thousands of enterprises, a single flaw in that engine — a model miscalibration, a logic bypass, a supply chain compromise of the Armis ingestion pipeline — becomes a critical infrastructure event.
This is the tension that Lyrie was built around. Autonomous defense is necessary. It's also a new attack surface category. The same speed that makes autonomous response valuable makes autonomous response compromise catastrophic.
Lyrie Take
The cybersecurity industry is betting that more automation closes the security gap. We think that's half right.
Automation closes the human-speed gap. What it potentially opens is a machine-trust gap: enterprise environments increasingly making high-stakes security decisions — blocking traffic, revoking credentials, quarantining systems — based on signals from AI models that have not been formally verified, adversarially hardened, or tested for manipulation.
The ServiceNow-Armis deal is architecturally elegant. It's also a world where a single prompt injection into an Armis-discovered device's hostname field could, if not sanitized, propagate through the Context Engine and trigger an autonomous remediation workflow on the wrong target.
NIS2 and DORA require continuous threat intelligence. They do not yet require formal verification of autonomous response systems. That regulatory gap is where the next generation of attacks will live.
Lyrie's autonomous defense model addresses this explicitly: every automated action is cryptographically logged, model outputs are sandboxed before execution, and any response touching a production system requires confidence-threshold verification before trigger. Autonomy without auditability isn't defense — it's a new attack surface with admin privileges.
Defender Playbook
If you're evaluating autonomous security platforms in 2026:
1. Demand response audit trails. Every autonomous action should generate an immutable log: what was observed, what model scored it, what confidence threshold was met, what action was taken. If the vendor can't show you this, they're not ready for NIS2/DORA.
2. Map your agentic AI blast radius. Before deploying platforms like Cyera+Ryft, inventory every production AI agent in your environment: what data it touches, what systems it calls, what escalation chains exist. You can't govern what you haven't mapped.
3. Treat the security platform as an attack surface. Your SIEM, SOAR, and asset management systems now make security decisions. Add them to your threat model. Run purple team exercises that target the orchestration layer, not just endpoints.
4. Don't wait for DORA enforcement. If you're a European financial services firm and you don't have documented, continuous threat intelligence, the compliance clock is ticking. QuoIntelligence-style vendors are now commodity for this use case.
5. Ask your MSSPs about autonomous response scope. What actions can their platform take without human approval? Under what conditions? Against which assets? Most MSSPs haven't answered this question for themselves yet.
Sources
1. ServiceNow completes $7.75B Armis acquisition — Yahoo Finance, April 24, 2026: https://finance.yahoo.com/sectors/technology/articles/servicenow-completes-armis-acquisition-closing-201000676.html
2. "With Armis, ServiceNow is positioned to build the largest cyber business in the world" — Calcalist Tech, April 28, 2026: https://www.calcalistech.com/ctechnews/article/hjn5q53pwl
3. ServiceNow acquires Armis: AI Cyber Defense Platform Analysis — ECI Research / Efficiently Connected, April 29, 2026: https://www.efficientlyconnected.com/servicenow-armis-acquisition-ai-cyber-defense-2/
4. Cyera Acquires Ryft to Extend Agentic AI Security Platform — BusinessWire, April 23, 2026: https://www.businesswire.com/news/home/20260423988692/en/Cyera-Acquires-Ryft-to-Extend-its-Agentic-AI-Security-Platform
5. AI security unicorn Cyera acquires Ryft in $100–130M deal — Calcalist Tech, April 24, 2026: https://www.calcalistech.com/ctechnews/article/rjni88wawl
6. Cyera Boosts Data Security For AI Agents With Acquisition Of Ryft — CRN, April 24, 2026: https://www.crn.com/news/security/2026/cyera-boosts-data-security-for-ai-agents-with-acquisition-of-ryft
7. Why Security Is Consolidating Around Platforms — The Product Journey, April 23, 2026: https://theproductjourney.substack.com/p/why-security-is-consolidating-around
8. QuoIntelligence raises €7.3M Series A led by Elevator Ventures — Tech Funding News, April 27, 2026: https://techfundingnews.com/quointelligence-7-3m-series-a-nis2-dora-threat-intelligence/
9. Cybersecurity Market Report 2026 — CyberStartup Index, April 25, 2026: https://cyberstartupindex.com/cybersecurity-market-2026
Lyrie.ai Cyber Research Division — Senior Analyst Desk
Lyrie Verdict
Lyrie's autonomous defense layer flags this class of exposure the moment it surfaces — no signature update required.