Cybersecurity M&A Roundup: 39 Deals Announced in September 2026
SecurityWeek logged 39 cybersecurity mergers and acquisitions announced in September 2026.
SecurityWeek's September 2026 roundup counts 39 cybersecurity merger and acquisition announcements, after more than 420 deals announced in 2025. Larger transactions include Dragos completing acquisitions of NetRise and runZero as part of Accenture's $4.1 billion OT cybersecurity effort, Palo Alto Networks buying Console for $500 million in cash, and NetSPI agreeing to merge with Synack into a company with more than $200 million in revenue. Other named buyers include A-LIGN, IBM, Kiteworks, Quantum eMotion, Quorum Cyber, and Upwind.
- September 2026 brought 39 announced cybersecurity acquisitions.
- Dragos completed NetRise and runZero buys tied to Accenture's OT push.
- Palo Alto Networks paid $500 million cash for Console.
- NetSPI and Synack agreed to merge above $200 million in revenue.
Full article707 words · extracted from securityweek.com · click to collapse
Thirty-nine cybersecurity-related merger and acquisition (M&A) deals were announced in September 2026.
For a detailed view of the more than 420 acquisitions announced in 2025, check out SecurityWeek’s annual M&A report.
Here are some of the most important cybersecurity M&A deals announced in September 2026:
A-LIGN acquires AssurePoint and Pathfynder
Cybersecurity compliance firm A-LIGN has acquired Sydney-based AssurePoint, a cloud security assessment company. The deal adds IRAP assessments to A-LIGN’s portfolio and marks its entry into Australia. A-LIGN also acquired Pathfynder, a firm providing penetration testing, red teaming, and incident response services. Pathfynder will operate as Pathfynder by A-LIGN.
Aiuken Cybersecurity acquires 4Elitech
Advertisement. Scroll to continue reading.
Spanish managed security provider Aiuken Cybersecurity, part of the Allurity group, has acquired 4Elitech, a Spanish specialist in industrial and critical infrastructure cybersecurity. The deal adds OT threat detection and industrial incident response capabilities to Aiuken’s offering.
Dragos acquires NetRise and runZero
Dragos has completed its acquisitions of NetRise and runZero as part of Accenture’s $4.1 billion OT cybersecurity push announced in June. NetRise contributes firmware-level insight into device exposure and software supply chain visibility, while runZero adds asset discovery, exposure assessment and attack surface intelligence. Dragos said the acquisitions add exposure management and software supply chain security to its platform alongside existing OT asset visibility and threat detection.
IBM has acquired UK-based Logiq Consulting, a cybersecurity consultancy serving the UK defense, government, and critical infrastructure sectors. The deal expands IBM’s secure digital transformation and sovereign technology capabilities in the UK.
Kiteworks has announced the acquisition of AI data security company Bonfy.AI, a move aimed at extending real-time policy enforcement over sensitive data exchanged by both human users and AI agents. Bonfy technology will extend Kiteworks’ policy enforcement across agent and human data exchange and usage.
NetSPI and Synack have agreed to merge, creating an offensive security company with more than $200 million in revenue. The KKR-backed combined company will pair expert penetration testers with agentic AI for continuous security testing.
Palo Alto Networks acquires Console
Palo Alto Networks has acquired Console, an AI-native platform for building agentic workflows using natural language, for $500 million in cash. Console’s technology will deepen agentic capabilities in the Cortex platform, letting security teams automate investigation and remediation.
Oslo-based human risk management company Pistachio has acquired the intellectual property of Norwegian cyber-risk management platform Hugin.io. Pistachio plans to use the technology to launch a compliance management product in 2027.
Quantum eMotion to acquire Plurilock
Quantum security firm Quantum eMotion (QeM) has agreed to acquire Plurilock Security for roughly C$33.8 million ($23.6 million) in cash and stock. Both companies are based in Canada. The deal gives QeM an established cybersecurity revenue base, customer relationships, and public-sector procurement channels.
Quorum Cyber to acquire Ontinue
Edinburgh-based Quorum Cyber has agreed to acquire Ontinue, a managed extended detection and response (MXDR) provider headquartered in Redwood City, California, and Zurich. The deal will combine AI-powered MXDR, cyber resilience and human expertise to create a Microsoft-first agentic SOC.
Cloud security firm Upwind has acquired Israeli AI security startup Aegis in an all-equity deal reportedly valued at $30 million. Aegis’ co-founders will lead the newly launched Upwind AI Security Labs, which will research and build defenses against AI-driven attacks.
Other cybersecurity M&A deals announced in September 2026:
Act Security acquires Cloud Copilot
CBTS acquires Recovery Point Systems
CloudFirst acquires Forvis Mazars’ IT and cyber managed services practice
Concentrix acquires CastleHill Managed Risk Solutions
InfraVia acquires a majority stake in Nexis
IT Solutions acquires STACK Cybersecurity
ITC Federal acquires Apriva ISS
Malam Team acquires Foretech Software
Project Eleven acquires Riva Labs
Risk X Group acquires Wolfpack Information Risk
S&P Global to acquire OpenZeppelin
SGS acquires majority stake in NetSentries
Surfshark acquires majority stake in Optery
ThreatBook acquires CyberStrikeAI
Related: Cybersecurity M&A Roundup: 33 Deals Announced in August 2026
Related: Cybersecurity M&A Roundup: 21 Deals Announced in July 2026