The count. SecurityWeek tallied 37 cybersecurity M&A deals announced in October. The biggest was Proofpoint’s roughly $6.3 billion cash deal for Varonis. Next was IonQ’s all-stock deal for Elisity, worth up to $1.3 billion. Around them: Absolute Security bought Phoenix Technologies’ FirmGuard firmware business. Aikido Security bought OutKept and Cyberly to launch a workforce security unit. Hex-Rays agreed to buy HexAI, reportedly for $30 million to $35 million. Most deals carried no disclosed price.
The tell. Read the buyer column, not the price column. Anthropic agreed to acquire Opaque Systems, a confidential-AI company. Cohere signed a letter of intent for AISLE. Cognition, the maker of the Devin coding agent, bought Corridor, which puts security checks inside AI coding tools. Three AI companies, one month, all buying security rather than partnering for it.
Why they buy instead of partner. For an AI company, security is no longer a feature a customer bolts on later. It’s the reason a bank or hospital says yes or no. If your agent writes code, the buyer wants to know it won’t ship a hole. If your model runs on their data, they want proof the data stays private. You can’t outsource the answer to that question and still own the sale. So the labs bring the team in-house. Cognition’s own post says Corridor’s team will build Devin Security alongside its chief security officer, Alex Stamos.
Then November opened with the reverse. CrowdStrike agreed to buy Fiddler, which watches what AI agents do, and Dreadnode, which attacks AI systems before launch. CrowdStrike didn’t disclose prices. The Wall Street Journal, via SecurityWeek, reported about $400 million and $95 million, roughly $495 million combined. So security platforms are buying AI security while AI companies buy security. Both sides are racing toward the same middle: whoever controls the trust layer for agents.
What it means for startups. The exit map for an AI security startup just got wider. A year ago the obvious buyers were the big security platforms. Now the list includes the model labs and the agent builders. More bidders is good for founders. It also means the bar for staying independent rises. Dreadnode, per SecurityWeek, raised a $14 million Series A in early 2025. If the reported $95 million is right, it sold within two years of that round.
Where I’m skeptical. A deal count is a blunt tool. Thirty-seven deals with mostly undisclosed terms tells you activity, not value. Many of these are small team buys. And an AI lab buying a security company doesn’t make it a security company. Integration is where these deals usually go wrong: the acquired team becomes a feature group, the roadmap narrows to one product, and customers of the standalone tool get left behind.
For buyers. If you depend on a small AI security vendor, ask now what happens if it’s bought. Is the product tied to one model or agent? Who owns your data and logs after a sale? Get exit terms in the contract while you still have leverage.
Where I land. The October number is fine. The buyer list is the signal. Security is becoming part of how AI gets sold, and the companies selling AI have figured that out. Expect more labs on the acquirer side of the table, and more security platforms paying up to keep them from owning the trust layer.