Cybersecurity · Industry brief

IT services M&A activity recorded 449 deals worth $14.8 billion in H1 2026, with cybersecurity among the leading sectors driving deal activity alongside cloud, data and analytics, and managed services. The report from EY India notes that strategic buyers accounted for approximately 47 percent of deal volume while pursuing large acquisitions to expand scale and deepen sector capabilities, with private equity investors remaining active through platform-building and consolidation strategies. Cybersecurity providers continued to dominate deal activity as large and mid-sized IT services companies pursued acquisitions to strengthen positioning for AI-enabled transformation mandates.

Bank of America is acquiring U.K.-based information-security specialist MDSec Consulting Limited, expected to close in Q4 2026 subject to regulatory approval. The deal will bring approximately 65 cybersecurity professionals into BAC's technology and security organization to strengthen vulnerability assessment, threat detection and security engineering capabilities. The acquisition reflects rising cybersecurity M&A activity across the financial services sector, with AI security emerging as a particularly important area of dealmaking, as peer institutions JPMorgan and Morgan Stanley similarly expand their cybersecurity and AI capabilities in response to increasingly sophisticated cyber threats.

On August 5, the New York State Department of Financial Services announced a $250,000 cybersecurity settlement with Order Express, Inc., a licensed money transmitter, for violations of DFS's cybersecurity regulation (23 NYCRR Part 500). The investigation uncovered deficiencies in the company's cybersecurity program including inadequate policies for system updates and insufficient risk assessments that left the company exposed to vulnerabilities. The DFS cybersecurity regulation, which became effective in March 2017 and was updated in November 2023, has served as a national model for regulators including the FTC, multiple states, the National Association of Insurance Commissioners, and the Conference of State Bank Supervisors. On July 31, the G7 Cyber Expert Group announced the successful conclusion of its 2026 Cross-Border Coordination Exercise, which simulated a large-scale cyber attack across all G7 jurisdictions to test the collective ability of G7 financial authorities to coordinate and respond to major cross-border cyber incidents affecting the financial sector. The exercise brought together ministries of finance, central banks, bank supervisors, and market authorities to test improvements in incident response, recovery, and crisis communication, and marked the adoption of a long-term exercise strategy to increase the frequency of future simulations.