Booz Allen Hamilton has agreed to acquire Defy Security in a move that sharpens its push into end-to-end, product-led cybersecurity for global commercial enterprises. The deal brings Defy into Booz Allen as a wholly owned subsidiary and folds its customer base, vendor relationships, and go-to-market muscle into Booz Allen’s global commercial business, targeting sectors that don’t have time for theory—financial services, health and life sciences, manufacturing, technology, energy, retail, and the messy overlaps in between. The message is pretty clear: security buyers want outcomes, not slide decks, and they want them fast.
For Booz Allen, the acquisition deepens a strategy that blends advanced tradecraft with scalable technology. Products like Vellox Reverser™, its AI-powered malware analysis capability, are designed to move from lab to production without losing the guardrails that regulated enterprises expect. Defy’s engineers, solution architects, and sales teams—about 100 people spread between the Pittsburgh area and San Ramon—add a commercial tempo that complements Booz Allen’s long-standing federal and regulated-industry DNA. Andrew Turner, who leads the firm’s global commercial business, framed the deal as a way to unlock new markets while accelerating innovation in a threat environment that doesn’t slow down just because governance is hard. That line lands, because buyers are feeling the squeeze from both sides.
Geography matters here too. The combination is meant to bolster Booz Allen’s growing footprint in the UK and the European Union, widening access to advanced cyber services for international customers that increasingly operate across jurisdictions with very different rules and risk profiles. Defy’s founder and CEO, Justin Domachowski, pitched the logic from the buyer’s seat—reimagining how enterprises purchase and scale cyber technology—arguing that Booz Allen’s global reach paired with Defy’s solutions and talent creates a broader, more practical platform for customers who need to move from point tools to coherent security programs. You can hear the relief in that framing, honestly.
The transaction is expected to close in the first quarter of Booz Allen’s fiscal year 2027, pending customary regulatory approvals, with financial terms undisclosed. Advisors on the deal underscore its scale and intent: Booz Allen worked with AGC Partners, PwC, King & Spalding, and Oliver Wyman, while Defy was advised by J.P. Morgan Securities and Choate, Hall & Stewart. Backed by Sverica Capital, Defy exits with a strategic buyer that can carry its commercial vision further. For the market, it’s another signal that cybersecurity is consolidating around firms that can actually deliver—from strategy through technology to operations—without dropping the ball halfway through.