Thirty-nine cybersecurity-related merger and acquisition (M&A) deals were announced in September 2026.
For a detailed view of the more than 420 acquisitions announced in 2025, check out SecurityWeek’s annual M&A report.
Here are some of the most important cybersecurity M&A deals announced in September 2026:
A-LIGN acquires AssurePoint and Pathfynder
Cybersecurity compliance firm A-LIGN has acquired Sydney-based AssurePoint, a cloud security assessment company. The deal adds IRAP assessments to A-LIGN’s portfolio and marks its entry into Australia. A-LIGN also acquired Pathfynder, a firm providing penetration testing, red teaming, and incident response services. Pathfynder will operate as Pathfynder by A-LIGN.
Aiuken Cybersecurity acquires 4Elitech
Spanish managed security provider Aiuken Cybersecurity, part of the Allurity group, has acquired 4Elitech, a Spanish specialist in industrial and critical infrastructure cybersecurity. The deal adds OT threat detection and industrial incident response capabilities to Aiuken’s offering.
Dragos acquires NetRise and runZero
Dragos has completed its acquisitions of NetRise and runZero as part of Accenture’s $4.1 billion OT cybersecurity push announced in June. NetRise contributes firmware-level insight into device exposure and software supply chain visibility, while runZero adds asset discovery, exposure assessment and attack surface intelligence. Dragos said the acquisitions add exposure management and software supply chain security to its platform alongside existing OT asset visibility and threat detection.
IBM has acquired UK-based Logiq Consulting, a cybersecurity consultancy serving the UK defense, government, and critical infrastructure sectors. The deal expands IBM’s secure digital transformation and sovereign technology capabilities in the UK.
Kiteworks has announced the acquisition of AI data security company Bonfy.AI, a move aimed at extending real-time policy enforcement over sensitive data exchanged by both human users and AI agents. Bonfy technology will extend Kiteworks’ policy enforcement across agent and human data exchange and usage.
NetSPI and Synack have agreed to merge, creating an offensive security company with more than $200 million in revenue. The KKR-backed combined company will pair expert penetration testers with agentic AI for continuous security testing.