July 2026 Cybersecurity M&A: 21 Deals Announced

Twenty-one cybersecurity mergers and acquisitions were announced in July 2026. Major transactions involved traditional financial services, endpoint and cloud security firms, data protection vendors and network observability providers.

Bank of America announced plans to acquire MDSec Consulting Limited, a UK information security consultancy that employs about 65 cybersecurity professionals. The bank said the deal will expand its presence in northern England.

CrowdStrike purchased the patents and source code of Israeli firm XM Cyber from Schwarz Group for an undisclosed amount. CrowdStrike plans to incorporate exposure management and attack-path analysis into its platform. Schwarz Group paid $700 million to acquire XM Cyber in 2021.

Barracuda Networks bought Texas-based Evo Security for an undisclosed sum, adding multi-tenant identity, identity and access management and privileged access management features to its BarracudaONE platform for managed service provider partners. Cribl acquired Israeli automated detection engineering startup CardinalOps and announced a new office in Tel Aviv; CardinalOps’ technology is intended to extend Cribl’s AI platform to improve threat coverage and reduce log management costs for enterprise security operations centers.

Cyera agreed to acquire Israeli startup Oasis Security in a deal valued at about $1 billion, combining Cyera’s data security capabilities with Oasis’s non-human identity governance for enterprise AI agents and service accounts. Okta signed an agreement to buy Palo Alto–based Permiso Security for roughly $200 million to add continuous identity threat detection for human, machine and autonomous AI identities across cloud environments. Palo Alto Networks plans to acquire Embrace to add mobile and web observability and real-time user telemetry. Qualcomm acquired Israeli IoT security vendor SAM Seamless Network for a reported amount above $100 million and said it will integrate SAM’s network security software into its wireless chipsets and gateways; SAM’s customers include AT&T and Verizon.

Infoblox entered a definitive agreement to acquire network intelligence and observability platform Kentik, combining Infoblox’s DNS and network context with Kentik’s real-time traffic visibility to support hybrid cloud resilience. Other deals announced in July included CompassMSP’s acquisition of The Logic Group, CyberNut’s purchase of Neptune Navigate, Databarracks acquiring Acumen, DataExpert Group acquiring ADO Security, Katalyst acquiring Layer27, Keyfactor agreeing to acquire Cofide, NINJIO purchasing SafeStack, TAC InfoSec acquiring Safehouse Technologies, The 20 acquiring Sundance Networks, Veridas buying Fourthline, Viatel Technology Group acquiring FullProxy and Webacy acquiring Trugard Labs.

The transactions covered identity and access management, non-human identity governance for AI and service accounts, automated detection engineering, data security, network observability and IoT or edge protection integrated at the chipset level. Some deal values were disclosed — Cyera/Oasis at about $1 billion, Okta/Permiso at roughly $200 million and Qualcomm/SAM above $100 million — while many amounts remained undisclosed.

Following 2025, when more than 420 cybersecurity acquisitions were announced across the year, July 2026 recorded 21 announced deals across these technology areas.