Cybersecurity · Industry brief

ScanSource is acquiring value-added reseller and managed service provider MicroAge for $220.5 million in an all-cash transaction, adding over 2,400 U.S. customers and 200 employees. The acquisition, announced in ScanSource's Q4 earnings report, represents a strategic shift in the enterprise cybersecurity and IT services distribution market—moving from arms-length distributor relationships toward direct ownership of service providers. CEO Mike Baur indicated the company plans to rent MicroAge's engineering and consulting resources (including its Octum.ai AI consulting business) to technology advisors in ScanSource's Intelisys channel, addressing service gaps and capturing hardware and professional services revenue that currently bypasses distributors. Industry observers, including Converged Technology Professionals CEO Joe Rittenhouse, characterize this consolidation trend as reflecting fundamental changes in partner value models, with customers increasingly demanding integration, implementation, and post-deployment support capabilities rather than vendor comparison services. The deal mirrors ScanSource's 2024 acquisition of technology advisor business Resourcive, signaling a broader consolidation pattern in the IT channel as distributors move upstream to interface directly with end customers.

CrowdStrike's global CTO Elia Zaitsev is launching Cognition, a new $170 million venture fund focused on AI-enabled cybersecurity, alongside former CrowdStrike corporate development executives Gur Talpaz and Tayler Sipperly. The fund plans to make three to four concentrated investments annually at seed ($6 million average) and Series A ($15 million average) stages, targeting startups developing security solutions for agentic AI systems and enterprise AI adoption. Cognition's thesis centers on agentic AI creating new attack surfaces and security risks as organizations deploy autonomous agents with access to corporate systems, data and workflows, requiring new classes of security platforms distinct from traditional enterprise security products. The move reflects broader industry shifts as cybersecurity vendors develop tools for monitoring agent behavior, controlling permissions, detecting prompt injection attacks and managing AI identities across enterprise environments. (Source: Axios reporting cited in article)

CrowdStrike is expanding Project QuiltWorks, its cyberdefense alliance, from large enterprises to small and midsized businesses through channel partners including Arrow Electronics, Pax8, TD Synnex, and managed service providers. The initiative integrates CrowdStrike's AI-driven vulnerability discovery with partner expertise and services from OpenAI and Anthropic. The model allows MSPs to wrap enterprise-grade security capabilities around their own services for SMB customers lacking dedicated security teams, with Omdia research indicating each dollar of CrowdStrike sales generates over $7 in partner services opportunities across the customer lifecycle. Channel Dive reports this reflects broader vendor interest in SMB opportunities, with CrowdStrike positioning partners as outsourced security arms rather than fulfillment arms, though potential conflicts exist—such as with Zip Security, which already sells competing managed security platforms.

Defense contractors are experiencing declining confidence in their cybersecurity readiness under the U.S. military's Cybersecurity Maturity Model Certification (CMMC) program, according to a CyberSheath report published Thursday. Only 65% of contractors that submitted 2026 self-assessment scores reported high confidence in their accuracy, down from 89% in 2025 and 94% in 2024, with the median contractor believing it is only 70% ready for certification review. The Department of Defense suspended CMMC's second phase in July citing excessive compliance costs, though first-phase requirements remain in effect. Contractors continue struggling with evolving requirements, evidence production, and compliance demonstration, though mean self-assessment scores have improved to +51 in 2026 and adoption of key security practices like multifactor authentication (63%), secure backups (48%), and vulnerability management (44%) has increased. The Trump administration continues prosecuting defense firms under the False Claims Act for misrepresenting cybersecurity compliance, reinforcing accountability despite delayed third-party certification requirements. Contractors surveyed also called for expanding DFARS cybersecurity requirements to managed security service providers, managed service providers, and other technology vendors to address supply-chain vulnerabilities (CyberSecurityDive, citing CyberSheath report).