Cybersecurity · Industry brief

Kiteworks acquired Israeli startup Bonfy.AI, which specializes in real-time data classification and policy enforcement for AI agent security. Israeli cybersecurity startup Huskeys raised a $27 million Series A led by Blackstone to secure increasingly complex internet traffic generated by autonomous systems. These transactions signal market fragmentation around specific AI agent security control points, with identity providers, data-security vendors, and enterprise software platforms expected to integrate agent-security capabilities, creating a new M&A landscape as enterprises scale from pilot deployments to hundreds of agents requiring permissions, monitoring and governance.

Europe's defense sector is undergoing rapid consolidation supported by a fundamental shift in competition policy. The European Commission's Defence Readiness Omnibus (June 2025) and revised merger guidelines (April 2026) now explicitly weigh security and defense objectives alongside traditional competition concerns, enabling faster clearance of transactions that enhance EU defense readiness and resilience. The EC introduced an "innovation shield" that permits acquisitions of startups with unique technologies without competition concerns when at least three independent firms have similar R&D projects, and unconditionally cleared the Leonardo/Iveco €1.7 billion defense vehicles acquisition in March 2026 as an example of swift approval. The U.K.'s CMA similarly revised merger efficiency guidance in September 2026 to recognize dynamic efficiencies from combining complementary capabilities. Foreign direct investment screening is tightening with higher mitigation requirements for allied investors, while the Foreign Subsidies Regulation has cleared the first two defense transactions without conditions. The EU is mobilizing €800 billion in defense investment by 2030 through frameworks including the Important Projects of Common European Interest (IPCEI) and European Defence Fund, with EU member states expected to spend €454 billion on defense in 2026 (9% year-over-year increase). The EC's Omnibus also signals willingness to provide tailored antitrust guidance for competitor collaborations in defense production and procurement, with state aid rules being adjusted to exempt or expedite approval for projects essential to national security interests.

Senate Bill 690, passed by the California Legislature and pending Governor Newsom's signature by September 30, would narrow enforcement of California's Invasion of Privacy Act (CIPA) by restricting private civil actions under CIPA § 638.51 (pen register and trap and trace device claims arising from website tracking) to the California Attorney General exclusively, effective January 1, 2027. The bill represents the most significant development in CIPA website tracking litigation but is narrower than earlier drafts; it leaves intact claims under CIPA §§ 631, 632, and 632.7 (wiretapping and eavesdropping), meaning approximately 73 percent of organizations facing CIPA litigation remain exposed. The California Department of Justice would receive approximately $1.5 million in funding and six new positions to enforce the carve-out, though no enforcement mandate is imposed. The retroactivity provision applies to pending claims in actions commenced on or after January 1, 2025, and will likely face litigation on due process and vested rights grounds. Separately, a Second District court ruling in Variety Media, LLC v. Super. Ct. (August 2026) adopted a technology-neutral reading of pen register definitions, signaling the underlying theory survives on better-pleaded facts.