ARTHOS Software M&A-Report:
Cybersecurity M&A at Record Levels

Growth is structural, not cyclical.

Gartner expects global security spending to rise almost 13% to around $249bn in 2026. German IT security budgets are expected to grow by 9.9% to EUR 12.2bn. NIS2 and DORA are now being actively enforced, and AI is reshaping both attack and defence: 89% of organisations report AI-enabled attacks, while machine and agent identities already outnumber human users by more than 80 to 1.

The M&A market has responded.

With 336 software and services transactions through Q3, 2026 is heading for a record year. Google closed its $32bn acquisition of Wiz, Palo Alto Networks completed the $25bn takeover of CyberArk, and ServiceNow paid $7.75bn for Armis. Strategic acquirers account for 92% of deal value, AI security deals have increased strongly, and identity attracts around 70% of disclosed value. Platform vendors prefer to acquire rather than develop in-house, and each large transaction creates integration gaps that are closed through mid-sized add-on acquisitions.

For European owners, this matters.

Digital sovereignty has become a deal rationale: Airbus acquired Quarkslab, Leonardo bought Becrypt and Axiomatics, and IBM took over Logiq in the UK. US strategic buyers pay attractive prices for European assets, as Proofpoint’s $1.8bn purchase of Hornetsecurity shows, while private equity builds platforms in identity and managed security. Investor demand clearly extends beyond pure software vendors to IT service and consulting firms with a credible cybersecurity practice.