Cybersecurity · Industry brief

Quorum Cyber has agreed to acquire Ontinue, combining two Microsoft-focused managed security providers in a deal reflecting broader consolidation in the cybersecurity sector. According to the companies, merger and acquisition value in cybersecurity rose 270 percent to USD $96 billion in 2025, with 2026 on track for a record number of deals. The combined entity will integrate Quorum Cyber's managed security and threat intelligence operations with Ontinue's managed extended detection and response business, positioning itself around AI-embedded security operations that work at machine speed while maintaining human oversight and accountability, particularly across Microsoft security tools and services.

PwC's 2027 Global Digital Trust Insights survey of 3,934 business and tech leaders across 71 countries identifies AI system attacks as the top cyber threat organizations are least prepared to address, with 50% of security leaders citing this as a major preparedness gap. The report reveals 84% of security and finance leaders expect cybersecurity budgets to increase, with AI as a top investment priority, though only 39% have fully formalized operational continuity plans addressing cyber risks. Key market trends show organizations investing heavily in managed security services, with 53% prioritizing AI and 49% prioritizing cloud security as top managed services needs over the coming year. The report also highlights critical gaps in data protection fundamentals, with companies implementing only three of seven key data risk measures, and governance challenges around AI accountability, with no single ownership model emerging across organizations.

California enacted SB 690, which significantly narrows website privacy litigation risks by barring private lawsuits targeting website tracking technologies under the California Invasion of Privacy Act's pen register and trap-and-trace provision, leaving enforcement solely to the state attorney general. The law applies retroactively to cases, arbitrations, and demand letters filed on or after January 1, 2025, though companies remain exposed to other privacy claims and enforcement avenues and should continue reviewing tracking tools, consent practices, disclosures, and vendor relationships.