AI Scramble Drives Cybersecurity M&A Boom

The escalating demand for AI-native cybersecurity solutions, coupled with the need for robust security measures to manage agentic AI, places 2026 on track to achieve an unprecedented level of cybersecurity startup acquisitions.

Despite a projected slight decline in the total value of financing deals this year — anticipated to reach an annualized total of 754 funding rounds, down from 820 last year — the number of mergers and acquisitions is expected to rise significantly, reaching 450 deals, an increase from 404 transactions in the previous year, as reported by Momentum Cyber, a prominent cybersecurity investment firm. Key areas of focus include identity and access management, non-human identity, data security, agentic security, runtime protections, and securing operational technology.

The accelerating advancements in AI applications for cybersecurity, exemplified by Anthropic's Mythos foundational model and the rise of AI-automated attacks, have created a sense of urgency among dealmakers, according to Eric McAlpine, founder and CEO of a firm based in Austin.

“We have just never seen a pace like this before,” he states. “A company doesn’t necessarily need to be native-agentic, but it does need to prioritize AI, and that trend is evident in many of today's transactions.”

In 2025, M&A activity achieved significant records, both in volume, with 404 deals, and in value, as corporations invested $97 billion to acquire startups. The prior two years also featured major acquisitions, such as Google's $32 billion acquisition of Wiz in 2025. In 2026, however, investors are employing a dual strategy concerning AI: funding early-stage startups to cultivate AI-native categories while larger firms are pursuing acquisitions of AI startups to enhance their capabilities, as demonstrated by Cyera’s $1 billion acquisition of Oasis Security and Cisco's dual purchases of Astrix Security and WideField Security.

AI has intensified market dynamics, expedited startup incubation cycles, and accelerated deal-making processes, even outpacing the cloud and software-as-a-service (SaaS) investment markets, observes Zane Lackey, a general partner at venture capital firm Andreessen Horowitz.

“We're witnessing an exceptionally compressed cycle of innovation, purchasing, and M&A activities in the realm of AI compared to cloud — it feels as though we are at the very beginning of a significant super cycle,” he comments. “For those involved in company formation or investment, it is truly the golden age.”

AI Everywhere in Cybersecurity

However, the landscape for cybersecurity in early 2026 appeared less favorable.

In January 2026, significant sell-offs occurred in the stock market among SaaS companies as concerns arose regarding the potential obsolescence of their services due to rapid advancements in AI models. Subsequently, major cybersecurity companies also experienced stock declines amid fears of succumbing to a "SaaS-pocalypse." Between January 28 and February 23, 2026, CrowdStrike's stock fell by 26%, JFrog dropped by 42%, Tenable Holdings by 20%, and Zscaler by 28%.

Such concerns proved to be exaggerated, as most companies have since rebounded and exceeded previous valuations: CrowdStrike has risen by 127% year-to-date, JFrog by 72%, and Tenable by 68%. Zscaler remains slightly down, a 3% decrease since the year's beginning, though it has recovered a significant portion of its earlier losses. The anxiety surrounding AI-enhanced and fully-automated attacks has underscored the critical need for robust cybersecurity measures among organizations adopting agentic AI.

Although investments in cybersecurity firms slowed initially, they have recuperated, according to McAlpine from Momentum Cyber.

“Due to the fears surrounding the SaaS-pocalypse and the Mythos-induced panic earlier this year, many private equity firms opted to retain their portfolio companies instead of seeking market opportunities with them — they held back on those actions,” he explains. “I predict that in six months, we will observe a restoration to normalcy, and private equity firms will actively pursue the sale of their portfolio companies at a pace not seen this year.”

Acquisitions related to AI security surged to 40 deals within the first three quarters of the year, a substantial increase from just 10 for the entire previous year. Nevertheless, the term “AI security” may not fully encapsulate the integral role AI has assumed within the cybersecurity sector. In actuality, AI is swiftly becoming embedded in every category, remarks McAlpine. The company’s classification system of twelve sectors and 62 sub-sectors may eventually evolve into fewer, more comprehensive categories.

“AI is rapidly blurring the boundaries, so the next version we release next year could potentially simplify to three main categories: AI for security, security for AI, and everything else,” he observes humorously.

A Tale of Two Markets: M&A Versus Financing

The pursuit of financing companies, however, is not experiencing the same level of intensity as the race to secure capabilities, according to McAlpine. “In the financing landscape, there is a more discerning approach regarding where venture capitalists and private equity firms are indicating their support,” he notes. “The overall volume is lower, with fewer deals, but those deals come with larger investment sizes.”

The focus of financing is shifting towards founders with proven track records.

Given the rapid evolution of both capabilities and the market landscape, companies are experiencing a more streamlined “seed-to-C funding path,” adds McAlpine. “What would have typically included distinct rounds of seed, Series A, B, and C funding over several years is now often consolidated into a single funding package right from the outset.”

Additionally, non-traditional companies are beginning to drive innovations in both cybersecurity and AI security. SaaS companies are concentrating on securing agentic workloads, while operational-technology firms are focused on managing agents that oversee fleets of devices. Despite differing focuses, they share common challenges, according to Lackey.

“There are three primary challenges: the first being attacks, the second technological changes, and the third compliance requirements,” he states. “We are currently experiencing significant impacts from the first two, and it is widely recognized that the third challenge is on the horizon as well.”

McAlpine concurs that the forthcoming wave of buyers in the cybersecurity sector may emerge from outside traditional cybersecurity firms. He anticipates that hyperscalers and leading research labs will substantially acquire cybersecurity capabilities.

“It is no secret that security ranks as one of the foremost concerns within frontier technology,” he emphasizes. “There is a critical need for a deeper understanding of AI and cybersecurity, with significant stakes involved.”