Forty-five cybersecurity merger and acquisition (M&A) deals were announced in October 2025.
Out of the 45 deals, roughly a quarter had publicly reported financial terms. A majority of deals were smaller, highly strategic acquisitions focusing on acquiring high-value tech or talent.
Private equity firms were active in both large-scale buyouts and consolidation plays, showing confidence in GRC and other mature platforms.
In fact, GRC companies were involved in over a dozen deals. The data shows an effort to consolidate GRC platforms, particularly through the integration of niche expertise such as third-party risk management and AI governance.
Half a dozen deals involved identity and authentication firms, with several major companies looking to add next-generation features such as passwordless authentication and identity threat detection and response into their core identity platforms.
While a majority of the target companies are based in the United States, a significant number of deals involve Australian companies, with several transactions pointing to consolidation within the local market.
Here are some of the most important cybersecurity M&A deals announced in October 2025:
Dataminr acquires ThreatConnect
Real-time event and risk detection solutions provider Dataminr is acquiring threat intelligence firm ThreatConnect for $290 million in cash and equity. The goal is to combine Dataminr’s data signals platform with ThreatConnect’s deep internal data capabilities to create agentic AI-powered intelligence that is tailored to each customer’s needs.
Identity solutions provider Imprivata has bought identity threat detection and response company Verosint. Imprivata said the acquisition will enable it to add AI-powered risk intelligence to its platform. By integrating Verosint’s risk engine, Imprivata can continuously detect and respond to identity-based threats.
Francisco Partners to take Jamf private after acquisition
Private equity firm Francisco Partners has entered into a definitive agreement to acquire Apple device management and security firm Jamf in a $2.2 billion deal. The transaction is expected to close in the first quarter of 2026, when Jamf will become a privately held company.
Identity, access and device management company JumpCloud has acquired Breez, an identity threat detection, investigation, and response (ITDR) platform. The acquisition accelerates JumpCloud’s security roadmap, bringing ITDR tools and expertise directly into its platform. With Breez’s technology, JumpCloud expands its ability to detect, investigate, and respond to identity threats.
LevelBlue, one of the world’s largest managed security service providers, announced a definitive agreement to acquire extended detection and response (XDR) provider Cybereason. Following the acquisition, Cybereason’s XDR technology and digital forensics and incident response (DFIR) capabilities will be integrated into LevelBlue’s portfolio of managed security services.
NSO to be acquired by US investors
The controversial spyware maker NSO Group has been acquired by a group of American investors led by Hollywood producer Robert Simonds, transferring controlling ownership of the firm out of Israel. The deal has been reportedly valued at several tens of millions of dollars.
Automated security validation and penetration testing firm Pentera has acquired DevOvean, which specializes in remediation management, for $30 million. The integration of DevOcean capabilities will enable Pentera to reduce remediation overload, enrich findings with organizational context, speed up remediation, and enforce SLA-driven remediation.
Ping Identity to acquire Keyless
Ping Identity has signed an agreement to acquire Keyless, a London-based firm specializing in privacy-preserving biometric authentication. The deal will bring Keyless’ Zero-Knowledge Biometrics technology to the Ping Identity Platform. The deal enables Ping to help enterprises verify users securely, without ever storing or sharing sensitive biometric data.
RecordPoint acquires Redactive
RecordPoint, a data management and AI governance firm, has bolstered its capabilities through the acquisition of Redactive, a Melbourne-based startup that helps companies make AI adoption secure, compliant, and scalable. The goal of the deal is to accelerate the development of RecordPoint’s AI governance platform with new threat management capabilities. Redactive’s technology enhances RecordPoint’s capacity to address emerging AI cyber threats targeting highly sensitive data.
Business advisory firm Riveron announced its acquisition of Eden Data, an Austin-based advisory firm known for its deep cybersecurity and GRC expertise. The deal expands Riveron’s Risk Advisory offerings, combining financial controls, operational risk, and emerging technology expertise under one roof.
Searchlight Cyber acquires Intangic
Attack surface management and threat intelligence firm Searchlight Cyber has acquired risk management company Intangic. The move enhances Searchlight’s ability to help organizations measure, monitor and mitigate cyber risk across their external environments.
Twilio has entered into an agreement to acquire Stytch, an identity platform for AI agents. Stytch’s experts and technology will help Twilio build an intelligent identity layer across its platform. This is driven by the need to authenticate both human users and the emerging AI Agents that act on their behalf.
Cloud network security firm Vectra AI announced the acquisition of network observability company Netography. As part of the deal, Netography Fusion will join the Vectra AI portfolio as Vectra Fusion, delivering agentless, cloud-native observability to enable proactive, preemptive cyberattack defense for hybrid and multi-cloud environments. This marks the second company led by Netography CEO Martin Roesch to be acquired.
Veeam Software to acquire Securiti AI
Data portability and resilience solutions provider Veeam Software has announced plans to acquire data security posture management (DSPM) company Securiti AI for $1.725 billion in cash and stock. The acquisition will unite their capabilities and enable Veeam to eliminate the challenge of managing fragmented data.
Related: Cybersecurity M&A Roundup: 40 Deals Announced in September 2025
Related: Cybersecurity M&A Roundup: 27 Deals Announced in August 2025
