Cybersecurity · Industry brief

ServiceNow completed its US$7.75 billion acquisition of Armis, a cyber-asset visibility platform providing security across IT, operational technology, and connected devices. Accenture agreed to acquire a majority stake in Dragos and 100% of runZero and NetRise for approximately US$4.175 billion enterprise value, combining operational technology threat detection, attack-surface intelligence, and firmware-level visibility into a unified OT security platform. Kroll reported 75 cybersecurity transactions in Q1 2026 with US$2.2 billion of disclosed deal value, with enterprise value to revenue multiples falling 26% quarter on quarter. Nuvei acquired Payoneer for approximately US$2.75 billion, combining cross-border payment infrastructure, regulatory permissions, and marketplace distribution. Bullish acquired Equiniti for US$4.2 billion to gain regulated transfer-agent infrastructure and capital-markets licensing relevant to tokenised markets. MARA acquired Long Ridge Energy & Power for US$1.5 billion to control power generation and permitted land for AI data-centre development. Cybersecurity buyers prioritised assets with proprietary telemetry, high-fidelity datasets, strong enterprise retention, platform expansion potential, and clear security operations integration, with next battlegrounds including machine identity for AI agents, exposure management by business context, and operational technology security for energy and manufacturing sectors.

Munich Re agreed to acquire cyber insurtech At-Bay for $575 million, combining cyber insurance with managed detection and response (MDR) services. The broader insurance M&A market is rebounding in 2026 with global deal value projected at $1.6 trillion in the first half, up 28% from 2025, with carriers concentrating acquisitions on AI capabilities and specialty underwriting, particularly in cyber and specialty insurance. Additional deals include American Family's $1.2 billion acquisition of Bowhead Specialty and MAPFRE's $1.54 billion acquisition of Safety Insurance. The trend reflects strategic necessity rather than broad optimism, with carriers bundling cyber coverage with security operations services, which will likely increase control documentation requirements for enterprise buyers during renewals and tighten underwriting standards across the industry.

On April 23, 2026, HHS OCR announced settlements with four regulated entities following separate HIPAA Security Rule ransomware investigations, with the entities collectively paying $1,165,000 and agreeing to corrective action plans monitored for two years. OCR has reported a 264% rise in large breaches involving ransomware between 2018 and 2024, with ransomware now established as a primary enforcement lane. Additionally, HHS OCR published a Notice of Proposed Rulemaking on January 6, 2025 (90 FR 800, Docket HHS-OCR-0945-AA22) to overhaul the HIPAA Security Rule, with the comment period closed March 7, 2025 and OMB's Unified Agenda targeting July 2027 for final action.