Cybersecurity · Industry brief

Accenture announced its largest-ever cybersecurity acquisition, purchasing Australian firm CyberCX from BGH Capital for over A$1 billion ($650 million), according to the Australian Financial Review. The deal significantly expands Accenture's cybersecurity capabilities across Australia, New Zealand, the UK, and the US, with CyberCX bringing 1,400 employees to the combined entity. This acquisition represents part of Accenture's broader consolidation strategy in cybersecurity, with 20 security-focused acquisitions completed since 2015, reflecting surging global demand for cybersecurity services driven by escalating cyber threats and sophisticated cyberattacks across industries.

On July 13, 2026, the Department of Defense suspended the Cybersecurity Maturity Model Certification (CMMC) Phase 2 scheduled for November 2026, along with Phases 3 and 4, pending review by a new CMMC Reform Task Force reporting within 60 days. The suspension is a policy memo, not a regulatory change—DFARS requirements and the CMMC Program rule remain in force, and contracting officers may only designate CMMC Level 1 or Level 2 (Self) during the review. DoD cited Small Business Administration data suggesting future CMMC phases could cost small and midsize businesses over $7 billion annually and noted an assessor shortage with roughly 100 authorized C3PAOs unable to serve 100,000+ companies needing assessments; officials did not rule out ending the program entirely. Contractors handling controlled unclassified information must continue implementing NIST SP 800-171 and maintaining SPRS compliance; self-certification now carries greater legal risk under DOJ's Civil Cyber-Fraud Initiative targeting false cybersecurity certifications. The public request for information closes August 14, 2026, and completed Level 2 (C3PAO) certifications retain contractual value as satisfying "or higher" designations. Existing CMMC clauses and prime contractor flowdowns remain enforceable unless modified in writing, and subcontractors should confirm any changes to flowdowns before altering assessment plans (source: Government Contracts Law blog, citing DoD memoranda 26-P-1023).

Cybersecurity continues to attract strong M&A interest as AI-enabled threats expand the attack surface and regulatory requirements become more demanding. This represents one of the defined M&A themes within the technology sector, where infrastructure-layer assets and application-layer companies show diverging valuation dynamics. The source is BCG's Global M&A analysis published in 2026, which provides sector-level sentiment indices and dealmaking patterns across industries.

Check Point's Chief Strategy Officer outlines the company's M&A strategy focused on consolidation while avoiding over-concentration risk. The vendor is acquiring companies to strengthen AI security capabilities, including acquisitions from Switzerland and Israel to combine and expand AI protection offerings. Check Point positions consolidation as necessary given shortened vulnerability-to-exploitation windows, but advocates for a "sweet spot" approach—consolidating many functions while maintaining best-of-breed solutions in specialized areas like SOC/SIEM through preferred partnerships. The company has exited CNAPP after determining competitors offered superior products, framing this as a responsibility-driven approach to security. Check Point's four core pillars are Hybrid Mesh Network Security, Workspace Security, Exposure Management, and AI Security, with the company emphasizing expertise and integration over attempting to lead in every security domain.