Cybersecurity
Cybersecurity Consolidation
M&A Timeline
Splunk, SailPoint re-IPO, CyberArk, Wiz. The megadeals that changed who is on this page.
Mar 2024
DealCisco
Cisco closes Splunk (~$28B)
Security becomes a Splunk-plus-legacy segment. FY2026 security $8.232B.
12 Feb 2025
DealSailPoint
SailPoint re-IPO
IGA returns to public markets after Thoma Bravo. Q1 FY2026 ARR $925M.
30 Jul 2025
DealPalo Alto
PANW announces CyberArk (~$25B)
Identity named a platform pillar. $45 cash + 2.2005 PANW shares.
11 Feb 2026
DealPalo Alto
PANW closes CyberArk
CyberArk is no longer a roster row.
11 Mar 2026
DealAlphabet
Google closes Wiz (~$32B)
Largest Google deal. CNAPP is hyperscaler attach. Wiz is not a roster row.
PE Takeouts
Proofpoint, Sophos, KnowBe4. Mentioned here, not profiled.
| Company | Sponsor | Why it matters |
|---|---|---|
| Proofpoint | Thoma Bravo | Email security taken private. The missing public email-security P&L. |
| Sophos | Thoma Bravo | Endpoint/firewall mid-market. Not a public comparable for CRWD/FTNT. |
| KnowBe4 | Vista | Security awareness training. Human layer, not a platform. |
| SailPoint (prior) | Thoma Bravo then re-IPO 2025 | The round-trip that put IGA back on this page. |
Platform Attach vs Standalone Budget
Who is a CISO line item versus who is bundled into Microsoft, Google, or Cisco.
| Buyer budget | Standalone names | Attach names |
|---|---|---|
| Network / firewall / SASE | PANW, FTNT, ZS, CHKP, NET | Cisco Security on the switching quote |
| Endpoint / XDR / SOC | CRWD, S | Microsoft Defender / Sentinel |
| Identity | OKTA, SAIL, PANW (CyberArk) | Microsoft Entra |
| CNAPP / cloud | PANW Prisma, CRWD cloud, ZS | Wiz inside Google Cloud; AWS security services |
| Data / resilience | RBRK, VRNS, TENB, QLYS | Hyperscaler backup and DSPM SKUs |
Gen Digital Consumer
FY2026 $5.0B. Cyber Safety $3.34B, Trust-Based $1.66B. Different wallet from enterprise ARR.
Major Deals
Dollar table for the transactions that changed who is on this page.
| Deal | Value (announced) | Closed | Roster effect |
|---|---|---|---|
| Google / Wiz | ~$32B cash | 11 Mar 2026 | Wiz is Alphabet, not a row |
| PANW / CyberArk | ~$25B cash-and-stock | 11 Feb 2026 | CyberArk is Palo Alto |
| Cisco / Splunk | ~$28B | Mar 2024 | Splunk is Cisco |
| SailPoint re-IPO | Listed Feb 2025 | 12 Feb 2025 | IGA is public again |
| Proofpoint / Sophos / KnowBe4 | PE | Prior years | Mention only, not profiled |
Tuck-in Deals
Chronosphere, Red Canary, Axiom, Lakera. Consideration only where the cited primary prints it. Red Canary's close PR does not print a dollar.
| Deal | Closed | Printed consideration | What it bought |
|---|---|---|---|
| PANW / Chronosphere | 29 Jan 2026 | $3.35B cash and replacement equity awards (announce PR) | Observability. Standalone near term. Over $160M ARR at announce, not a cyber P&L line. |
| ZS / Red Canary | 1 Aug 2025 | Not printed in the close PR | MDR / SOC. Operates as Red Canary, a Zscaler company. |
| Okta / Axiom Security | 4 Sep 2025 | $54M cash (Q3 FY2026 10-Q) | Cloud PAM into Okta Privileged Access. |
| CHKP / Lakera AI | Q4 2025 | About $190M net cash (FY2025 6-K) | AI security. Separate from the Q1 2026 Cyata / Cyclops / Rotate announces, which print no dollars. |
F5 Software vs Systems vs Services
FY2025: software $803M, systems $706M, services $1.579B. ADSP is the pitch. Appliances still print.
Prefer Sterling in Google
Add sterlingcharts.com as a preferred source so our charts can appear with a preferred badge in Google Top Stories, AI Mode, and AI Overviews.