Cybersecurity · Industry brief

Cybersecurity M&A activity reached record pace in Q3 2026 according to Momentum Cyber's market review, with 336 M&A transactions and $15.4 billion in disclosed M&A value through the first three quarters of 2026, driven by a five-fold increase in AI-related acquisitions. Strategic acquirers accounted for 92% of M&A capital deployed, prioritizing capability-driven acquisitions in AI governance, non-human identity, and runtime protection over large platform deals. AI Security emerged as the most active segment with 40 M&A transactions in 2026 compared to 10 in 2025, while 142 AI Security financing rounds were completed, and more than 14 new cybersecurity unicorns emerged as capital concentrated around high-growth platforms.

The EU Cybersecurity Act has strengthened ENISA with a permanent mandate and expanded resources. The agency now oversees the European Cybersecurity Certification Framework, enabling companies to certify ICT products and services once for recognition across the EU. ENISA coordinates incident response through the CSIRTs Network and manages cross-border cyberattack coordination. In January 2026, the Commission proposed a revised Cybersecurity Act to further enhance ENISA's capabilities, including issuing early threat alerts, supporting ransomware response in cooperation with Europol and CSIRTs, and operating a unified vulnerability management service. The framework introduces a trusted ICT supply chain security approach to mitigate risks from third-country suppliers. On 15 January 2025, targeted amendments were adopted enabling certification schemes for managed security services including incident response and penetration testing. On 20 January 2026, proposed amendments to the NIS2 Directive aim to simplify compliance for approximately 28,700 companies, including 6,200 micro and small enterprises.

On September 18, 2026, the Department of Justice announced revisions to the Justice Manual strengthening False Claims Act (FCA) enforcement, signaling a significant shift in regulatory approach. The revisions limit the use of sub-regulatory guidance (non-binding agency materials like FAQs and policy statements) as a basis for FCA liability, requiring that enforcement actions rest on binding statutes or regulations rather than agency guidance alone. However, guidance remains relevant as evidence of knowledge, industry standards, or to establish underlying legal duties, and false certifications of compliance with guidance can still support FCA claims. The second revision expands DOJ's dismissal authority over qui tam actions (whistleblower lawsuits filed on the government's behalf), requiring that every declination to intervene be accompanied by a dismissal analysis, with mandatory reassessment during litigation. This represents a meaningful procedural shift from prior practice where DOJ rarely sought dismissal of declined cases, giving the Department greater control over relator-driven litigation and allowing it to dismiss "parasitic or opportunistic" actions that duplicate existing investigations or waste taxpayer resources. The changes reflect DOJ's effort to manage an expanding FCA docket in federally regulated sectors including healthcare, government contracting, and defense, amid broader expansion of federal anti-fraud enforcement efforts including the newly created Task Force to Eliminate Fraud and the DOJ's National Fraud Enforcement Division.

Accenture's acquisition of Dragos and ServiceNow's purchase of Armis have sparked a wave of IoT/OT security consolidation in the market. According to Asimily CEO Shankar Somasundaram, the consolidation is driven by rapid IoT/OT device growth and investor appetite for the sector, but it's creating openings for specialized independent vendors. Acquisition "refugees" are switching to focused providers due to service changes and contract shifts following major deals. Somasundaram notes that larger organizations increasingly prefer best-in-class solutions with strong ecosystem integration over consolidated platforms, and warns that acquired security products often experience roadmap shifts toward acquirer priorities, leaving customers facing uncertain futures they didn't choose.