September M&A: 39 Deals Reshape Security

Thirty-nine cybersecurity-related merger and acquisition deals were announced in September 2026, according to SecurityWeek's monthly roundup. The slate spans compliance assessments, operational technology monitoring, AI data governance and offensive security services — a breadth that reflects how fragmented the sector's buying priorities have become.

Compliance Firms Push Into New Markets

Cybersecurity compliance firm A-LIGN expanded on two fronts. It acquired Sydney-based AssurePoint, a cloud security assessment company, adding IRAP assessments to its portfolio and marking its entry into Australia. Separately, A-LIGN acquired Pathfynder, a firm providing penetration testing, red teaming and incident response services. Pathfynder will operate under the name Pathfynder by A-LIGN.

In Spain, managed security provider Aiuken Cybersecurity, part of the Allurity group, acquired 4Elitech, a Spanish specialist in industrial and critical infrastructure cybersecurity. The deal adds OT threat detection and industrial incident response capabilities to Aiuken's offering.

IBM acquired UK-based Logiq Consulting, a cybersecurity consultancy serving the UK defense, government and critical infrastructure sectors. The deal expands IBM's secure digital transformation and sovereign technology capabilities in the UK.

OT and Industrial Security Consolidates

Dragos completed its acquisitions of NetRise and runZero as part of Accenture's $4.1 billion OT cybersecurity push announced in June. NetRise contributes firmware-level insight into device exposure and software supply chain visibility, while runZero adds asset discovery, exposure assessment and attack surface intelligence.

Dragos said the acquisitions add exposure management and software supply chain security to its platform alongside existing OT asset visibility and threat detection. The completion of both deals marks the operational phase of a transaction first outlined earlier in the year.

Aiuken's purchase of 4Elitech follows the same industrial-security logic, bringing OT threat detection and industrial incident response into a managed security provider's portfolio.

AI Security Drives Platform Deals

Kiteworks announced the acquisition of AI data security company Bonfy.AI, a move aimed at extending real-time policy enforcement over sensitive data exchanged by both human users and AI agents. Bonfy technology will extend Kiteworks' policy enforcement across agent and human data exchange and usage.

Palo Alto Networks acquired Console, an AI-native platform for building agentic workflows using natural language, reportedly for $500 million in cash and stock. Console's technology will deepen agentic capabilities in the Cortex platform, letting security teams automate investigation and remediation.

Cloud security firm Upwind acquired Israeli AI security startup Aegis in an all-equity deal reportedly valued at $30 million. Aegis' co-founders will lead the newly launched Upwind AI Security Labs, which will research and build defenses against AI-driven attacks.

Offensive Security Gets Bigger

NetSPI and Synack agreed to merge, creating an offensive security company with more than $200 million in revenue. The KKR-backed combined company will pair expert penetration testers with agentic AI for continuous security testing.

Quorum Cyber, based in Edinburgh, agreed to acquire Ontinue, a managed extended detection and response (MXDR) provider headquartered in Redwood City, California, and Zurich. The deal will combine AI-powered MXDR, cyber resilience and human expertise to create a Microsoft-first agentic SOC.

Pistachio, an Oslo-based human risk management company, acquired the intellectual property of Norwegian cyber-risk management platform Hugin.io. Pistachio plans to use the technology to launch a compliance management product in 2027.

Quantum and Financial Security Moves

Quantum security firm Quantum eMotion (QeM) agreed to acquire Plurilock Security for roughly C$33.8 million ($23.6 million) in cash and stock. Both companies are based in Canada. The deal gives QeM an established cybersecurity revenue base, customer relationships and public-sector procurement channels.

The month's other deals touched identity, data governance and risk management. Omada acquired EmpowerID; SecureSky acquired Soveren; Spin.AI acquired DoControl; and Surfshark acquired a majority stake in Optery. S&P Global moved to acquire OpenZeppelin. ThreatBook acquired CyberStrikeAI, and Socure acquired Fravity.

Full List of September Deals

The roundup also listed these cybersecurity M&A deals announced in September 2026:

• Act Security acquires Cloud Copilot
• AXAITRA acquires Innovate
• CBTS acquires Recovery Point Systems
• CloudFirst acquires Forvis Mazars' IT and cyber managed services practice
• Concentrix acquires CastleHill Managed Risk Solutions
• CyberMaxx acquires Avertium
• Epiq acquires Canopy
• Fime acquires Red Alert Labs
• Harvey acquires Guardrails AI
• InfraVia acquires a majority stake in Nexis
• ISMG acquires INE
• IT Solutions acquires STACK Cybersecurity
• ITC Federal acquires Apriva ISS
• Malam Team acquires Foretech Software
• Nomios acquires Orbcom
• Omada acquires EmpowerID
• Project Eleven acquires Riva Labs
• Risk X Group acquires Wolfpack Information Risk
• S&P Global to acquire OpenZeppelin
• SecureSky acquires Soveren
• SGS acquires majority stake in NetSentries
• Socure acquires Fravity
• Spin.AI acquires DoControl
• Surfshark acquires majority stake in Optery
• ThreatBook acquires CyberStrikeAI
• TRG acquires Fentron
• Tusker acquires Fortress SRM

Context From 2025

For a detailed view of the more than 420 acquisitions announced in 2025, SecurityWeek published its annual M&A report.

The September roundup follows earlier monthly tallies: 33 deals announced in August 2026 and 21 deals in July 2026, according to SecurityWeek's related coverage.

Individual deals were announced with varying levels of detail. A-LIGN publicized its acquisitions separately, including AssurePoint and Pathfynder.

What the Deal Flow Means

The sheer volume of September's 39 announcements suggests consolidation is not slowing, even as buyers spread their attention across very different niches. Compliance assessors, OT specialists and AI security startups are all attracting capital, which could mean security budgets are being redirected toward tooling that addresses governance and industrial risk rather than only traditional endpoint or network defense.

For security teams, the practical consequence may be fewer, larger vendors offering broader platforms. That could simplify procurement but also reduce choice. The pace also raises questions about integration risk: combining a firmware-analysis company, an asset-discovery firm and an OT monitoring platform into one offering takes time, and customers may not see immediate benefits.

Public-sector procurement channels, highlighted in the Quantum eMotion–Plurilock deal, could become a more common rationale for acquisitions as governments tighten supply chain requirements. Meanwhile, the focus on agentic AI — seen in the Palo Alto Networks, Kiteworks and Upwind deals — indicates that buyers believe AI-driven attacks and AI-assisted defense will be central to security operations in the near term. Whether that belief translates into effective products remains to be seen, but the money is already moving.