Cybersecurity · Industry brief

Cybersecurity has become a central component of M&A due diligence as buyers increasingly recognize the potential financial, operational and reputational risks associated with cyber incidents. Recent regulatory developments, expanded disclosure requirements and a growing number of ransomware and data breach events have heightened scrutiny of target companies' cybersecurity practices. Acquirers are devoting greater attention to evaluating cybersecurity controls, incident response capabilities and compliance with applicable privacy and data protection laws, with areas of focus including governance structures, third-party vendor management, employee training, access controls, cybersecurity insurance coverage and procedures for identifying and responding to security threats. Transaction parties are addressing cybersecurity considerations early in the deal process, with buyers seeking enhanced representations and warranties, specific indemnification protections or remediation measures as conditions to closing.

Veriff, an Estonian AI document-verification vendor, acquired fellow Estonian firm Vespia, a Know Your Business specialist, in an all-share-and-cash deal on 5 February 2026, marking the eleventh transaction since early 2024 to reshape the iGaming KYC market and the first instance where a pure-play verification vendor became a buyer rather than an acquisition target. This deal exemplifies a broader consolidation wave where surviving identity-verification pure-plays – including Socure, Signicat, and Veriff – are now assembling "trust platforms" by bolting on KYB, behavioural credit data, and AML screening capabilities, a shift from 2024–2025 when private-equity sponsors and data conglomerates dominated acquisition activity. Between 2024 and early 2026, eleven major transactions reshaped iGaming identity verification: Entrust acquired Onfido (~$650M, April 2024), Experian bought NeuroID (August 2024) and KYC360 (27 October 2025), LexisNexis Risk Solutions acquired IDVerse (early 2025), Corsair Capital took IDnow ($295M, 6 March 2025), Signicat acquired Inverid (July 2025) and Logalty (December 2025), Socure bought Qlarifi (December 2025), and Visa acquired Featurespace (~£700M, December 2024). The market concentration is climbing: the top-five vendor revenue share is rising, with Sumsub remaining independent as of January 2026 at unicorn valuation but widely regarded as the most attractive remaining strategic target. Regulatory or antitrust scrutiny is expected as top-five market share climbs past 45%, with observers forecasting at least one deal will draw competition review, and additional KYB tuck-ins by end-2026 as business verification becomes table stakes.

On June 26, 2026, Florida Attorney General James Uthmeier and Roku announced a negotiated resolution of Florida's enforcement action under the Florida Digital Bill of Rights. Roku alleged to have collected and sold sensitive children's data including viewing habits, voice recordings, and precise geolocation without adequate parental consent. Under the settlement, Roku committed to a $25 million investment in engineering resources to enhance child protection features and parental controls, with nationwide deployment expected within 12 months and no finding of wrongdoing or civil fine assessed. The resolution carries significant implications for privacy enforcement strategy: a single state achieved national product redesign scope, remediation budgets may become litigation reference points for class actions, and children's data protections tend to become operational baselines extending to adult-facing data practices, potentially accelerating broader privacy compliance convergence across all user categories.

Aryon Security, a Tel Aviv-based cloud security company, raised $29 million in Series A funding led by Brightmind Partners. The round was co-founded by Stephen Ward, former CISO at The Home Depot and TIAA. Aryon is positioning itself in a new category of cloud security focused on prevention rather than detection, with co-founder and CEO Ron Arbel stating the company "makes prevention operational, scalable, and safe for the world's most complex cloud environments."