Cybersecurity · Industry brief

California has enacted Senate Bill 690 (SB 690) to restrict private lawsuits under California's Invasion of Privacy Act (CIPA) regarding pen register devices, eliminating claims based on Section 638.51 for online conduct. The amendment, retroactively applying to cases filed in 2025 or later, affects approximately 27 percent of CIPA cases but shifts enforcement authority to the California Attorney General with penalties of $5,000 per occurrence and a budget allocation of up to $1.5 million with six new DOJ positions dedicated to SB 690 enforcement. California's Privacy Protection Agency (CalPrivacy) has issued automated decision-making technology (ADMT) regulations under the CCPA, effective January 1, 2027, requiring companies to conduct risk assessments, provide pre-use notices, offer opt-outs, and grant access rights for automated systems that substantially replace human decision-making in significant decisions affecting employment, housing, financial services, healthcare and education. Companies already using ADMT for significant decisions before the risk assessment requirement took effect must complete documented assessments by December 31, 2027. The regulations have prompted related litigation including Mobley v. Workday, Kistler v. Eightfold AI, and Does 1-26 v. Meta Platforms challenging algorithmic screening, predictive recruiting and workforce analytics systems.

The AI Cybersecurity Market is experiencing significant consolidation and M&A activity. Palo Alto Networks acquired Console in September 2026 to expand agentic analysis and automated investigation capabilities within its Cortex platform. Google acquired Wiz in March 2026 to integrate cloud security with Google's threat intelligence and AI-powered security operations for hybrid environments. CrowdStrike acquired Onum in September 2025 to strengthen its Falcon Next-Gen SIEM with real-time telemetry management for autonomous detection and response. The market also reflects substantial venture funding, with companies like Cyera raising USD 400 million in Series F funding in January 2026, ReliaQuest raising over USD 500 million at a USD 3.4 billion valuation in March 2025, and Torq securing USD 140 million in Series D funding in January 2026 to advance agentic AI security operations platforms.

AI, data, and cybersecurity due diligence is now a core M&A consideration and valuation discipline rather than a legal checkbox. Per Reed Smith's PEMACOM 2026 conference insights, NIS2 is expanding cybersecurity obligations across sectors, making breach preparedness and incident response capabilities critical diligence areas. Data protection approaches and cybersecurity governance directly affect deal value, with buyers potentially inheriting material GDPR and EU AI Act exposure if acquiring non-compliant systems. Private equity sponsors acquiring AI-enabled businesses face compounding compliance debt if governance isn't built in from the outset. Cybersecurity has moved from a back-office issue to boardroom priority, requiring integrated assessment alongside AI governance and data protection rather than siloed review (Reed Smith, PEMACOM 2026 Conference, September 22, 2026, Munich).