Recommended Free Tools
SecurityWeek counted 39 cybersecurity-related merger and acquisition deals announced in September 2026. The highlighted transactions span compliance, operational technology (OT), software supply-chain security, AI and data security, identity, cloud security, and offensive testing. The count is SecurityWeek’s roundup figure, not an independently audited census of the entire market.
What the September deal count includes
SecurityWeek’s October 6, 2026 roundup names 39 cybersecurity-related deals announced during September. Its list ranges from security vendors acquiring specialist firms to larger companies buying cybersecurity consultancies, product teams, and managed services businesses. The roundup does not define a complete market taxonomy or explain a qualification method, so the figure is best read as SecurityWeek’s count rather than a definitive total for every cybersecurity transaction that month. SecurityWeek’s roundup also cites more than 420 acquisitions announced in 2025, but that annual figure should not be directly compared with one month’s count without matching the underlying scope and methodology.
What the prominent deals add
Compliance and assurance
A-LIGN announced on September 22 that it had acquired Australian cloud security assessment firm AssurePoint. The company said the acquisition adds IRAP assessments and marks its entry into Australia. SecurityWeek’s roundup also lists A-LIGN’s acquisition of Pathfynder, a penetration testing, red teaming, and incident response firm, now identified as Pathfynder by A-LIGN.
A-LIGN CEO Scott Price described the intended benefit as bringing more work under one provider: “This acquisition means we can accomplish our client’s objectives under the same roof as their SOC 2 and ISO 27001 work, instead of sending them to a separate vendor for a framework that overlaps with audits we’re already executing.” That is the company’s stated rationale, not evidence of how the services will be integrated in practice. A-LIGN’s announcement provides the company’s account of the AssurePoint transaction.
#1 Best Overall
OT and critical infrastructure
Spanish managed security provider Aiuken Cybersecurity acquired 4Elitech, a Spanish specialist in industrial and critical-infrastructure cybersecurity, according to SecurityWeek. The reported capability additions include OT threat detection and industrial incident response.
Dragos completed its acquisitions of NetRise and runZero after Accenture’s majority investment in Dragos closed, SecurityWeek reported. NetRise brings firmware-level device exposure and software supply-chain visibility; runZero adds asset discovery, exposure assessment, and attack-surface intelligence. The combination extends Dragos’s OT asset visibility and threat detection into adjacent exposure-management and supply-chain areas. Dragos said terms for both acquisitions were not disclosed. SecurityWeek’s report on the completed acquisitions covers their status and terms.
Government, public-sector, and regulated-sector security
IBM announced its acquisition of Logiq Consulting on September 24. IBM describes Logiq as an NCSC-assured UK cybersecurity consultancy with expertise in defense, critical national infrastructure, and the public sector. IBM said the purchase expands its cybersecurity and sovereign technology capabilities for regulated and public-sector clients; that rationale is IBM’s own. IBM’s announcement describes the acquisition.
Data security and AI
Kiteworks announced it had acquired Bonfy.AI. SecurityWeek described the intended extension as applying policy enforcement to sensitive data exchanged by people and AI agents. The announcement signals a product direction, but does not establish that the capabilities are already integrated or demonstrate customer outcomes.
Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchPC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Upwind acquired Aegis in an all-equity transaction reportedly valued at $30 million, according to SecurityWeek. The publication reported that Aegis’s co-founders will lead Upwind AI Security Labs. The valuation is reported rather than independently verified here.
Offensive security and continuous testing
NetSPI and Synack agreed to merge; the deal should not be described as completed. SecurityWeek reported that the proposed combined company would have more than $200 million in revenue and pair penetration testers with agentic AI for continuous security testing. Synack frames the planned combination as continuous offensive security. Those descriptions concern the proposed business, not proof of realized integration or performance. Synack’s merger page presents the company’s framing.
Cloud security, automation, and compliance software
SecurityWeek reported that Palo Alto Networks acquired Console, an AI-native platform for building agentic workflows, for a reported $500 million in cash and stock. The report says the technology is intended to deepen Cortex automation; the rationale is attributed to the deal coverage, and the reported price is not independently verified here.
Pistachio acquired Hugin.io’s intellectual property and plans to launch a compliance management product in 2027, according to SecurityWeek. That is a future plan, not an already available product.
Free tools Windows power users keep installed
One-click scans. No signup required.
Best Value
Identity and managed detection
SecurityWeek reported that Omada acquired EmpowerID, adding an identity-related transaction to the month’s roundup. It also listed Quorum Cyber’s announced intent to acquire Ontinue, an MXDR provider. Quorum Cyber described a proposed Microsoft-first agentic security operations center combining managed detection and response, cyber resilience, and human expertise. The status remains an intent to acquire, and the proposed operating model is the acquirer’s stated plan. Quorum Cyber’s announcement explains the proposal.
Corporate entry into cybersecurity
Quantum eMotion and Plurilock agreed to a cash-and-stock acquisition valued at approximately C$33.8 million (US$23.6 million), according to SecurityWeek. The publication said the deal is intended to provide Quantum eMotion with a cybersecurity revenue base, customer relationships, and public-sector procurement channels. The transaction is agreed, not reported here as completed.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to read status and valuation claims
September’s announcements represent different stages, not a single set of closed transactions. A completed acquisition is distinct from an agreement to merge or acquire, and an announced intent is more preliminary still. SecurityWeek’s roundup is the source for the month’s broad list and many deal descriptions; direct company announcements support several featured examples, but the reviewed sources do not independently verify every transaction named.
- Completed: Dragos reported that its acquisitions of NetRise and runZero were completed; their terms were not disclosed.
- Agreed: NetSPI and Synack agreed to merge, while Quantum eMotion and Plurilock agreed to an acquisition. Neither should be presented as closed based on those announcements.
- Intent announced: Quorum Cyber said it intended to acquire Ontinue; that wording does not establish a completed purchase.
- Reported valuations: SecurityWeek reported $30 million for Upwind–Aegis and $500 million in cash and stock for Palo Alto Networks–Console. These are reported figures, not a consistent, independently confirmed valuation set.
- Different measure: The more-than-$200-million figure for NetSPI–Synack refers to reported revenue of the proposed combined company, not the merger’s purchase price.
The other deals in SecurityWeek’s September list
The roundup also names the following announced transactions. Its reviewed sources do not establish additional terms or status for these items beyond the roundup’s announcement framing:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Quick Recap
- Act Security / Cloud Copilot
- AXAITRA / Innovate
- CBTS / Recovery Point Systems
- CloudFirst / Forvis Mazars’ IT and cyber managed services practice
- Concentrix / CastleHill Managed Risk Solutions
- CyberMaxx / Avertium
- Epiq / Canopy
- Fime / Red Alert Labs
- Harvey / Guardrails AI
- InfraVia / Nexis
- ISMG / INE
- IT Solutions / STACK Cybersecurity
- ITC Federal / Apriva ISS
- Malam Team / Foretech Software
- Nomios / Orbcom
- Project Eleven / Riva Labs
- Risk X Group / Wolfpack Information Risk
- S&P Global / OpenZeppelin
- SecureSky / Soveren
- SGS / NetSentries
- Socure / Fravity
- Spin.AI / DoControl
- Surfshark / Optery
- ThreatBook / CyberStrikeAI
- TRG / Fentron
- Tusker / Fortress SRM
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
