Tech Industry Acquisitions

25 billion. Let that land. That’s the price Palo Alto Networks is paying to acquire CyberArk, not just a company, but a massive chunk of the identity-security market. This isn’t innovation. This is buying the market. From a business perspective? A clever move by Palo Alto. Expanding dominance, consolidating power, and tightening their position as the world’s largest cybersecurity vendor by market cap. But from a customer perspective? I see a different story. I’ve worked at Palo Alto myself. I know how the machine operates. It’s not about delivering the best security. It’s about extracting maximum value per customer. And when everything is pushed under one vendor and one strategy, the squeeze becomes very real. This acquisition means one thing for CyberArk customers: You will be squeezed out. Like a lemon. Because while it might look attractive, “one vendor for everything, easy integrations, simplified procurement”. The real outcome is vendor lock-in at a scale we’ve never seen before. All your eggs in one massive, shareholder-driven basket. And that’s the part many organizations underestimate. Ask yourself: Do you really want your entire security stack controlled by a single vendor whose primary obligation is to Wall Street, not your threat landscape? Consolidation may sound efficient. But in cybersecurity, diversity is resilience. Putting everything in one place doesn’t make you safer, it makes you dependent. This $25B deal should be a wake-up call. Not a convenience. Not a shortcut. A moment to rethink whether “one vendor to rule them all” is truly in your best interest.

Is tech M&A back? Google announced its intention to buy Wiz for $32b today. If approved by regulators, it would be the 6th largest technology M&A ever. This transaction would make Wiz the 5th most valuable pure-play security company. For Google, this would be its largest acquisition ever second to Motorola for about $12b. Notably two of the top three acquisitions are security. Mandiant sold for $5.4b. Why should Google be so interested in security? Microsoft’s Security Business generates $20b per year in revenue, so the market is large. A similarly sized business for Google, which trades at about 6x forward would create $120b in market cap. According to press, Wiz is between $500-1b in ARR. Assume revenue is 2/3 of ARR & it’s growing about 70%, which would imply about $850m in forward revenues. A premium 30x forward revenue multiple would suggest an acquisition price of about $25.5b. Google is paying a 25% premium for an extremely fast growing business in a core strategic cloud segment. A recent WSJ post highlighted the new FTC chair, Andrew Ferguson’s stance toward anti-trust may be more of the same for hyperscalers, which suggests a regulatory review is likely & a significant break-up fee likely in the terms. Does this suggest M&A is back in full swing? Without a doubt it shows major acquirors aren’t dissuaded by the public markets or the potential regulatory hurdles imposed by regulators. And startups are open to receiving premium offers, both of which are key ingredients to a vibrant M&A market. CrowdStrike, growing at 30%, trades at 18x forward.

𝐆𝐨𝐨𝐠𝐥𝐞'𝐬 𝐁𝐢𝐠 𝐒𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐌𝐨𝐯𝐞: 𝐓𝐡𝐞 $32 𝐁𝐢𝐥𝐥𝐢𝐨𝐧 𝐖𝐢𝐳 𝐀𝐜𝐪𝐮𝐢𝐬𝐢𝐭𝐢𝐨𝐧 𝐄𝐱𝐩𝐥𝐚𝐢𝐧𝐞𝐝 Google is acquiring Wiz, for $32 billion, with plans to integrate it into Google Cloud by 2026. To put that price tag in perspective, it's roughly equivalent to what Microsoft paid for LinkedIn or what Salesforce paid for Slack. 𝐖𝐡𝐲 𝐖𝐢𝐳 𝐈𝐬 𝐖𝐨𝐫𝐭𝐡 $32 𝐁𝐢𝐥𝐥𝐢𝐨𝐧 𝐭𝐨 𝐆𝐨𝐨𝐠𝐥𝐞 Wiz has developed something special: an AI-powered security platform that gives organizations unprecedented visibility into their cloud environments. Think of it as having X-ray vision for your digital infrastructure—it spots vulnerabilities and threats that traditional tools often miss. What makes Wiz particularly valuable is its approach to multi-cloud security. Most large organizations today don't just use one cloud provider—they might use Google Cloud for some operations, AWS for others, and Azure for yet more. Managing security across all these environments has become increasingly complex, and Wiz offers a unified solution to this growing headache. 𝐓𝐡𝐞 𝐅𝐚𝐬𝐜𝐢𝐧𝐚𝐭𝐢𝐧𝐠 𝐃𝐞𝐚𝐥 𝐒𝐭𝐫𝐮𝐜𝐭𝐮𝐫𝐞 Here's where things get interesting. Even though Google is buying Wiz, the company's products will continue to work on competing cloud platforms like AWS, Microsoft Azure, and Oracle Cloud. This is unusual but strategically brilliant for several reasons: - Customer retention: Wiz's existing customers won't need to switch cloud providers, preventing a mass exodus that would devalue the acquisition. - Regulatory smartness: By keeping Wiz operating across all major cloud platforms, Google avoids raising red flags with antitrust regulators who might otherwise worry about Google limiting a critical security tool to its own ecosystem. - Market expansion: Google can now earn revenue even from customers primarily using competing cloud services—essentially collecting "security rent" from its competitors' customer bases. The Price Negotiation Story What's particularly fascinating is that Wiz initially turned down an offer of about $23 billion last year. This confidence prompted Alphabet to increase its bid by nearly 40% to $32 billion. 𝐖𝐡𝐚𝐭 𝐓𝐡𝐢𝐬 𝐌𝐞𝐚𝐧𝐬 𝐟𝐨𝐫 𝐭𝐡𝐞 𝐈𝐧𝐝𝐮𝐬𝐭𝐫𝐲 While previous competition focused primarily on computing power, storage, and services, security has now emerged as a critical battleground. Microsoft and Amazon will likely respond with their own security-focused acquisitions. For enterprise customers, this is mostly good news. Google's resources will likely accelerate Wiz's product development, while the multi-cloud approach ensures continued choice and flexibility. However, this consolidation could eventually lead to higher prices if competition in the cloud security space diminishes. Early investors in Wiz are seeing exceptional returns, and this 𝐝𝐞𝐚𝐥 𝐰𝐢𝐥𝐥 𝐥𝐢𝐤𝐞𝐥𝐲 𝐭𝐫𝐢𝐠𝐠𝐞𝐫 𝐫𝐞𝐯𝐚𝐥𝐮𝐚𝐭𝐢𝐨𝐧𝐬 𝐚𝐜𝐫𝐨𝐬𝐬 𝐭𝐡𝐞 𝐜𝐲𝐛𝐞𝐫𝐬𝐞𝐜𝐮𝐫𝐢𝐭𝐲 𝐬𝐞𝐜𝐭𝐨𝐫.

SoftBank is set to buy ABB’s robotics division for $5.4 billion. The news comes just under six months after Zurich-based ABB Group spun out the division. ABB Robotics has been powerful player in the industrial robotics space, with a $2.4 billion revenue in 2024, but its parent company ultimately saw “limited synergies” between itself and the vertical. SoftBank, too, has tried its hands at robotics before. Softbank Robotics was the result of the company’s 2012 purchase of French firm, Aldebaran, a deal that resulted in the creation of the social robot, Pepper. Aldebaran ultimately returned to independence, only to declare bankruptcy earlier this year. The Japanese investment giant was also home Boston Dynamics from 2017 to 2021, acquiring the Spot-maker from Alphabet before selling off to current owner, Hyundai. Of this most recent deal, SoftBank Chairman and CEO, Masayoshi Son notes, “SoftBank’s next frontier is physical AI. Together with ABB Robotics, we will unite world-class technology and talent under our shared vision to fuse Artificial Super Intelligence and robotics — driving a groundbreaking evolution that will propel humanity forward.” The deal is expected to close in mid-2026.

Alphabet is buying Wiz for one of the highest (disclosed) revenue multiples in the history of large cybersecurity M&A. This deal is basically in a class of its own. Wiz falls somewhere between a 45-65x revenue multiple based on current estimates. (Note: ~$700M current revenue is estimated. Their most recent public disclosure was $500M). There's only one other cybersecurity-related transaction with a relatively similar profile: Okta's acquisition of Auth0 in 2021. I say *relatively* similar because Wiz's ARR is much higher than Auth0 had at the time of acquisition. The Okta-Auth0 deal had a 42.7x revenue multiple, which is easily the highest among large ($2.5B+) cybersecurity acquisitions that have actually closed. Leading the CIAM market was one of Okta's highest strategic priorities — so they paid a 42.7x multiple to buy the emerging market leader. Sound familiar? Leading the cloud security market is one of Alphabet's highest strategic priorities — so they're willing to pay an unprecedented multiple to buy a market leader while it's still private. No matter what it costs. --- A situation like Alphabet's acquisition of Wiz is comparable to CrowdStrike or Okta being taken off the board right before they went public. Alphabet is betting they are acquiring a future CrowdStrike or Okta. They know it takes a heavy premium to do it, and they clearly weren't willing to take "no" for an answer the first time.

The next major #cybersecurity platform isn’t coming from a security company. Last month, ServiceNow made two acquisition announcements that make its ambitions clear: 1) Veza - announced December 2nd for $1B+, bringing identity governance across human, machine, and AI identities. 2) Armis - announced December 23rd for $7.75B, entering exposure management across IT, OT, and connected devices. This is ServiceNow’s largest acquisition ever. These weren’t opportunistic bets. Even before the deals, ServiceNow’s security and risk business had crossed $1B in ACV, driven by workflow automation across security operations, incident response, vulnerability management, threat intelligence, and third-party risk. With Veza and Armis, ServiceNow has now tripled its security opportunity from ~$30B to ~$100B, adding $400M+ in ARR growing 50%+ YoY, and assembling the pieces of an end-to-end security platform. This mirrors a broader shift we’re seeing across the industry. In November, Palo Alto Networks - a security-native company - moved up the stack into CIO/CTO territory with its Chronosphere #acquisition. Now, ServiceNow, an infrastructure workflow leader, is moving into the CISO budget. The takeaway is clear: the era of pure-play cyber or pure-play #IT is coming to an end. What’s emerging instead is a converged infrastructure software market - one platform serving CISOs, CIOs, and CTOs from a shared control plane. This convergence will shape how products are built, how budgets are allocated, and where the next generation of infrastructure leaders emerge.

$740M for a category most security teams aren't monitoring yet. CrowdStrike is acquiring SGNL - identity security for AI agents. Most security teams have zero visibility into what AI agents can access inside their infrastructure. No governance. No controls. No monitoring. CrowdStrike just put a price tag on that blind spot. Same pattern I've watched for 20 years: New tech → new attack surface → ignored → breach → category explodes → big player overpays. Every. Single. Time. SASE. Zero trust. CSPM. XDR. Now AI agent identity. The CISOs who spotted these categories early bought smart. Everyone else paid the acquisition premium. Right now there are vendors building AI agent security. In 3 years there will be 3-4, owned by CrowdStrike, Palo Alto, and Microsoft. The buying window is open. It won't be for long. I've been tracking cybersecurity vendors since 2005. That's why I built IT-Harvest - 3,000+ vendors, 400+ categories, updated daily. The next $740M category is forming right now.

Identity is emerging as the #1 attack vector for cloud-native organizations, a trend amplified by advancements in AI! As a result, I anticipate identity protection becoming one of the most vital pillars of cybersecurity, standing alongside other key domains. Silverfort's acquisition of Rezonate last week needs to more close attention (especially after what we've seen with Crowdstrike's past moves here). This acquisition points to a critical area of identity that I see rapidly emerging. Let's break it down: There are 4-5 core pillars of identity (IAM, PAM, IGA, NHI, ITDR, etc), but this acquisition focused on identity protection (see below). For context, Identity protection is emerging as a category that adds a unified layer of security to your IAM identity infrastructure; some refer to it as an augmentation layer that provides visibility and enforcement— spanning all of a company’s IAM infrastructure for better security outcomes. ie. second-opinion to your Okta. Identity security vendors like Silverfort specialize in operating behind your authentication infrastructure like Okta (IAM, MFA, or Active Directory) to act as a second opinion on access requests. A core part is protecting against identity-based attacks for both humans and non-humans. Silverfort specializes in this area - its strongest assets was its specialization in being that security layer across your IAM infrastructure—detecting anomalous behavior, enforcing universal MFA, conditional access and ensuring companies have secure identity infrastructure —in real-time—not after an authentication has gone through. This is key. Prior to this acquisition, Rezonate specifically focused on reducing risks across your identity attack surface using their ISPM, ITDR, entitlement protection, and NHI capabilities - specializing in cloud environments, covering all cloud assets, SaaS applications, and identity providers (IdPs). While Silverfort provided broad security coverage, its strength lay in securing Active Directory (AD). Rezonate now further enhances Silverfort's capabilities in cloud identity security. This acquisition should create a unified identity protection platform that further enhances Silverfort's strength in its core areas, but now NHI, Identity security posture management (ISPM), and cloud entitlement management. These solutions work well alongside SIEM/XDR for detecting posture change leveraging TTP & IOC for better context. We've seen previous tremendous successes in the identity security space with names like CrowdStrike, and this is another example of consolidation in the space. Moving forward, as we see more identity breaches like credential stuffing, account takeovers, privilege escalations, and related behavioural attacks, vendors focusing on protecting the identity attack surface will continue to emerge / thrive IMO. This is a very important theme. I'll be writing a lot about this topic in 2025.

Every industry goes through 4 stages of consolidation, and cybersecurity is now at stage 3 (less than 10 years away from full consolidation). Twenty years ago, HBR published a study that looked at more than 1,300 major mergers and found that every industry follows the same path which they called the four stages of consolidation: opening, scale, focus, and balance and alliance. Here's how that can be applied to cyber. Stage 1: Opening The very beginnings of our market date all the way back to the mid-1980s. But, what we know as “modern cybersecurity” was born in the 2000 to 2010 decade. This was when companies like Palo Alto Networks (2005), Fortinet (2000), Zscaler (2007), Cloudflare (2009), Okta (2009), Proofpoint (2002), Mimecast (2003), Tenable (2002), Qualys (1999), CrowdStrike (2011), KnowBe4 (2010), and many others were started. These firms did exactly what Harvard Business Review researchers suggested: built for scale, expanded globally, and amassed strength fast enough to become too big to fail. Stage 2: Scale Next comes the race for growth. The 2010s unleashed a massive expansion of the cyber industry. The number of cybersecurity startups exploded, with more than 5,000 companies competing for CISO attention today. This decade was marked by an impressive pace of acquisitions. The already established players like Palo Alto, CrowdStrike, Cloudflare, and others honed the craft of M&A integration (though not without missteps and some did it better than others). The industry of the past 5-7 years has been defined by aggressive growth, fueled by both capital and consolidation. The pandemic as well as the increase in ransomware helped supercharge this growth as well. Stage 3: Focus (where cyber is today!) Today, I believe we have crossed from scale to focus. The signs are impossible to ignore. The list of top players has crystallized: Palo Alto, Cisco, CrowdStrike, Zscaler, Cloudflare, Okta, Fortinet, Microsoft, Google, IBM, and Check Point. Mega‑deals are increasingly common: Google’s acquisition of Wiz, Cisco’s purchase of Splunk, and the recently announced Palo Alto’s acquisition of CyberArk are just a few examples. What looks like uncharted territory is actually very much what’s expected at the focus stage. For startups, the dream of building a standalone giant is fading; the most realistic outcome is acquisition, and this reality is fueling the very M&A cycle that accelerates consolidation. Even the industry’s best-funded scaleups, like Wiz, Cyera, etc., are all, in my opinion, built as acquisition targets from day one. Stage 4: Balance and Alliance The last stage is coming. This is when consolidation slows, the top three companies will own as much as 70% to 90% of the market, and for the rest of the players, the game is basically over - they are either crushed or become absolutely insignificant and unable to achieve any meaningful scale. I think we're 7-10 years away from reaching the stage 4.

Five recent mergers and acquisitions highlight how cybersecurity vendors are converging technology with services to capitalize on the US$10 billion MDR opportunity, which Canalys (now part of Omdia) is forecasting to grow 16% in 2025: • Sophos’ US$849 million purchase of Secureworks, which closed in February, giving it 2,000 enterprise accounts, and expanding MDR with XDR and SIEM assets, and DFIR and advisory services. • Arctic Wolf’s US$160 million purchase of Cylance Inc., which also closed in February, giving the MDR provider EDR and AI assets, and a customer base to migrate. • The merger between Cybereason and Trustwave, announced in November, bringing together Cybereason’s EDR with Trustwave’s MDR, DFIR and consulting. • WatchGuard Technologies’s purchase of ActZero for an undisclosed sum in December, which expands its existing MDR offering with automated threat response and third-party integrations. • N-able’s US$266 million acquisition of its XDR/MDR tech partner Adlumin in November. This is a highly competitive market with others like Alert Logic (acquired by Fortra), Bitdefender, Check Point Software (aquired rmsource), CrowdStrike, eSentire, OpenText (acquired Pillr), ReliaQuest, SonicWall (acquired Solutions Granted), ThreatLocker and Trend Micro and many more scaling offerings. The path to MDR emerging as a category has been gradual, yet inevitable. On the demand side of the equation is the threat landscape. More attackers are targeting smaller and midsized organizations that have less cybersecurity resources. On the cybersecurity supply side of the equation, the widening skills gap and growing complexity. Moreover, businesses need help securing their environments, and technology alone cannot fill the gap. The recent acquisitions highlight the direction of MDR services. For SMBs, scalable, low-touch, and automated services that go beyond managed EDR with poorly defined response services to managed XDR and risk management services, compliant with cyber insurance. For larger customers, more tailored offerings, with broader integrations, custom playbooks, threat hunting, and extensive DFIR. As a result, there will be more M&A between cybersecurity vendors and MDR providers. However, more than 90% of cybersecurity spending is to, through and with partners. Invariably, vendors will increasingly find themselves competing with their partners. The most successful vendors will be those that take a partner-first approach, enabling those that just want to resell or refer to do so without friction, and enabling more service-led partner to co-sell and co-deliver.