Thirty-three cybersecurity acquisitions closed or were announced in August, and the two largest were done by companies that don’t sell security. Visa paid $2.4 billion for BioCatch, the behavioural biometrics firm. Munich Re paid $575 million for At-Bay, the cyber insurtech.
That’s the shape of the market right now. Security capability is being pulled inside payments networks, insurers, HR platforms and data companies, where it works as a margin input rather than as a product line.
Buyers From Adjacent Industries
Visa’s logic is straightforward. Behavioural intelligence that spots a fraudulent session before authorisation reduces losses on a network Visa already owns, and it’s worth more inside the rails than sold as software to banks. Munich Re’s is the same idea from the other end: owning the risk mitigation service makes the underwriting book cheaper to run.
Further down the size range the pattern holds. Deel, a workforce platform, bought the deepfake detection firm Clarity for a reported $40 million to $50 million, because remote hiring fraud is now Deel’s problem. Datavault AI paid $94.5 million for CyberCatch, taking compliance tooling and post-quantum encryption into a data monetisation business. NetApp took JetStream Software for data management.
None of these buyers will report a security segment. The revenue disappears into payments, insurance, HR and storage.
The Security Vendors Are Buying AI Defence
Where pure-play security companies did buy, they bought the same thing. Fortinet took Virtue AI for agent protection and model red teaming. Palo Alto Networks took Console for agentic workflow automation inside Cortex. Cribl bought Radiant Security for AI-driven SOC work. Brinqa and PlexTrac merged exposure management with offensive validation, and Echo picked up Minimus for container security.
Every one of the platform vendors is assembling the same shelf: secure the AI agents customers are deploying, and use agents to run the SOC. Whoever has that shelf stocked in eighteen months sets the renewal price for everyone else.
Funding Is Fine, Just Not Exciting
Cybersecurity and privacy startups raised $10.6 billion in the first half of 2026. The second quarter brought in $4.4 billion, down about 30 percent from the first quarter and from the year-ago period, with eight rounds above $100 million.
The big ones went to companies with real scale. Cyera raised $600 million at a $12 billion valuation, NinjaOne extended its Series C past $400 million at $12.3 billion, and Dream took $260 million at $3 billion. On the exit side, Motorola Solutions buying counter-drone firm D-Fend Solutions for $1.5 billion was the largest.
Capital is available for late-stage winners and thin everywhere else, which is what produces a thirty-deal month. Founders who raised in 2021 at a multiple they can’t grow into are selling to whoever needs the capability, and increasingly that’s a bank, an insurer or a payroll company.