Cybersecurity · Industry brief

Cybersecurity M&A reached record levels in 2025 with 426 announced acquisitions totaling $92.5 billion, an 82% increase over 2024. Major deals closing in 2026 include Google's $32 billion acquisition of Wiz in March, Palo Alto Networks' $25 billion CyberArk deal in February, and ServiceNow's $7.75 billion Armis acquisition in April. By mid-June 2026, deal trackers cataloged approximately 190 transactions. Four regulatory regimes are driving acquisition demand: the EU's NIS2 Directive, DORA for financial services, SEC cyber disclosure rules, and CMMC for US defense contractors. These compliance requirements are converting security from discretionary to mandatory spending, making GRC specialists, testing firms, and already-certified vendors highly sought acquisition targets. AI security has become the fastest-rising acquisition theme, with 94% of surveyed leaders naming AI as the most significant driver of change in cybersecurity. Nearly half of strategic technology deal value above $500 million in 2025 came from AI-native companies or deals citing AI benefits. Buyers are targeting companies with labeled security telemetry, production AI detection capability, runtime protections for models, and governance tooling. Consolidation continues through platformization, with large vendors assembling network, cloud, identity, endpoint, and data security capabilities into integrated platforms. Valuations stratify by model: small services firms sell for 3x-5x SDE, service-led firms for 5x-9x EBITDA, profitable product companies for 10x-20x EBITDA, and high-growth platforms on revenue multiples ranging from 20x to 32x annual recurring revenue depending on growth rates and retention metrics.

Germany's BSI issued formal notices to 47 entities in Q4 2025 for NIS2 non-compliance, with enforcement actions signaling that supervisory authorities are exercising their inspection and penalty powers. Essential entities in critical infrastructure face administrative fines up to €10 million or 2% of global annual turnover for violations. NIS2 mandates that essential entities achieve 24-hour early warning and 72-hour incident notification for significant cybersecurity incidents, requiring continuous monitoring capabilities across OT environments. The directive expands coverage to over 200,000 organizations across the EU, with the critical infrastructure cybersecurity market valued at USD 21.60 billion in 2023 and projected to reach USD 30.96 billion by 2032. NIS2 Article 21 technical requirements mandate comprehensive OT asset inventory, network segmentation between IT and OT environments, configuration change management for industrial control systems, and supply chain risk management. Organizations managing distributed critical infrastructure across multiple jurisdictions must implement centralized security platforms that maintain consistent compliance evidence while generating jurisdiction-specific documentation for each national authority. Compliance automation reduces audit preparation time from weeks to days by maintaining continuous asset inventory, configuration baselines, and change logs that satisfy regulatory documentation requirements.

The U.S. Government Accountability Office identified potentially duplicative cybersecurity reporting requirements across critical infrastructure sectors, finding that approximately 70% of 117 regulations reviewed contained overlapping reporting obligations. Out of 80 regulations with duplicate requirements, there were at least 125 total reporting demands: 48 requiring cybersecurity incident reporting, 52 requiring cybersecurity plans or technical information, and 25 requiring reviews, audits, or assessments. The GAO report, published in response to the Trump administration's March 2026 cybersecurity strategy prioritizing harmonization and reduced compliance burdens, notes this administrative burden will intensify once CISA issues its final rule implementing the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA) in September 2026, which will require critical infrastructure entities to report substantial cyberattacks within 72 hours. The GAO intends to issue an implementation plan to streamline cybersecurity regulations for critical infrastructure entities.