Cybersecurity market consolidates: 404 acquisitions and $97 billion in 2025 – record year expected in 2026
The cybersecurity industry is heading toward a record year for acquisitions, according to investment bank Momentum Cyber's fresh Q3 report — and AI is what's driving the numbers up.
Momentum Cyber published its Q3 2026 Cybersecurity Market Review on October 1, and Dark Reading followed up with analysis on October 9. The numbers point in one direction: 117 acquisitions were announced in the third quarter alone, and around 450 deals are expected for all of 2026 — compared with the record year 2025, which saw 404 acquisitions and $97 billion in total transaction value. At the same time, funding rounds are edging down, to 754 annualized versus 820 last year. Capital is concentrating while consolidation accelerates.
The AI Security Segment Is Exploding
The most striking change lies in the segment figures. AI Security recorded 40 acquisition transactions through the first three quarters of 2026, against just 10 deals in all of 2025 — a fourfold increase in under a year. The segment also accounted for 142 funding rounds in 2026, making it the most actively funded area in cybersecurity, according to Momentum Cyber's press release.
It's worth noting that these are separate measured figures: the 40 AI acquisitions and the 142 funding rounds are segment figures, while the 117 acquisitions in the quarter and 450 for the full year are total market figures. The exact relationship between them is not explained in what has been made public.
Capabilities, Not Platforms
Behind the numbers, according to Momentum Cyber, lies a dual strategy. Early-stage funding goes to startups building AI-native categories, while established players are buying their way to capabilities. Examples from 2026: Cyera's purchase of Oasis Security for $1 billion and Cisco's dual acquisitions of Astrix Security and WideField Security. As a recent reference point for the big deals stands Google's purchase of Wiz for $32 billion in 2025.
The investment bank describes a growing market divide: capital is flowing quickly to AI-native innovators, while strategic buyers prefer capability-driven acquisitions over massive platform deals. The long-term value shift, according to the report, is toward infrastructure providers that secure non-human identities, data access, and autonomous systems.
The six categories drawing the most acquisition interest, according to Momentum Cyber, are identity and access management (IAM), non-human identity, data security, agentic security, runtime protection, and operational technology (OT) security.
Momentum Cyber's founder and CEO Eric McAlpine describes the pace as unprecedented: "We have just never seen a pace like this before," he tells Dark Reading. "A company doesn't have to be native-agentic, but it will be AI first, and I think that's what you're seeing in a lot of these deals now."
Zane Lackey, general partner at Andreessen Horowitz, points out that the entire cycle is compressed: "We're seeing the innovation cycle, the buying cycle, the M&A cycle — all of this wildly compressed in AI compared to cloud. I mean, right now it feels like we're in such early innings of this overall supercycle."
The Market Has Already Adjusted
The consolidation wave is not coming out of nowhere. Between January 28 and February 23, 2026, cybersecurity stocks fell sharply on fears that AI would displace SaaS vendors: CrowdStrike dropped 26 percent, JFrog 42 percent, Tenable Holdings 20 percent, and Zscaler 28 percent. The market, in other words, had priced in a world where AI changes the industry's economics — before Momentum Cyber's figures documented that acquisition activity had actually taken off.
The scale in September alone shows the same picture: 39 cybersecurity-related acquisitions were announced that month, according to SecurityWeek's M&A Tracker. Among them were Dragos's completion of its acquisitions of NetRise and runZero, Palo Alto Networks' purchase of Console — reported at $500 million in cash and stock, though unofficially confirmed — and the merger of NetSPI and Synack, creating a company with more than $200 million in revenue.
A Caveat About the Sources
All the figures in this story come from the same actor: Momentum Cyber, an investment bank that is itself a party in the market it describes and has its own incentive to highlight transaction activity. The report is available through the company's press release and Dark Reading's account; the underlying methodology and detailed transaction data cannot be independently verified from these.
Several questions remain open. How long will the wave last? How quickly will the AI security market become saturated? And what happens to valuations once buyers have built the capabilities they need? Lackey insists the cycle is early — but that is precisely what investors in an upcycle tend to say.