Cybersecurity is having a record M&A year, and the buyer list looks nothing like it did two years ago. According to the latest tally from Momentum Cyber, an Austin-based investment firm focused on the sector, 117 cybersecurity acquisitions were announced in the third quarter alone — a quarterly high — putting 2026 on track for roughly 450 deals, up from 404 in 2025, which itself set the record with about $97 billion spent on acquisitions.
What is different this year is who is buying. Surging demand for native-AI cybersecurity services — and for the security capabilities needed to tame agentic AI — has pulled in acquirers far beyond the traditional roster of security vendors. Momentum Cyber points to identity and access management, non-human identity, data security, agentic security, runtime protections and operational technology as the categories drawing the most interest.
The AI-specific slice of the market is where the acceleration is sharpest: AI security acquisitions jumped to 40 deals in the first three quarters of 2026, compared with 10 throughout all of last year. The template deals are already familiar — Google's $32 billion purchase of Wiz in 2025 set the ceiling, and this year's examples include Cyera's $1 billion acquisition of Oasis Security and Cisco's dual acquisitions of Astrix Security and WideField Security.
The arc of the year makes the recovery starker. In late January, fears that AI models could quickly replace SaaS products — the so-called SaaS-pocalypse — hammered security stocks alongside the rest of software: between January 28 and February 23, CrowdStrike fell 26 percent, JFrog dropped 42 percent, Tenable slid 20 percent and Zscaler lost 28 percent. Those worries proved overblown. CrowdStrike is up 127 percent year to date, JFrog is up 72 percent, Tenable has gained 68 percent, and Zscaler, still down 3 percent, has recovered most of its losses.
"We have just never seen a pace like this before," said Eric McAlpine, founder and CEO of Momentum Cyber, adding that a company "doesn't have to be native-agentic, but it will be AI first" — a standard he says is now visible across deal diligence. Zane Lackey, a general partner at Andreessen Horowitz, framed the same dynamic from the builder's side: the innovation cycle, the buying cycle and the M&A cycle have all been "wildly compressed" relative to the cloud era. "Right now it feels like we are in such early innings of this overall super cycle," he said.
The financing side of the market is softer than the M&A side. Funding rounds are on track to decline to an annualized 754 this year from 820 in 2025, and McAlpine notes that private equity firms held onto portfolio companies through the spring's AI-fear sell-off rather than taking them to market. His prediction: within six months, PE firms will resume exits at a pace not seen this year, adding another supply of sellers to an already crowded market.
The structural driver cuts both ways. AI-assisted attacks are getting cheaper and faster, which makes security capabilities a necessity for any company deploying agentic AI; at the same time, AI-native defense startups are the product everyone wants. Incumbents have concluded that buying is faster than building, and the result is a consolidation wave in which the check-writers increasingly sit outside the industry being consolidated.
Comments (0)
Log in to join the discussion
Log InNo comments yet