Q3 2026: 121 deals, accelerating every month, and half of it was services.

The Cyber Deal Index is BrimWall's quarterly count of every announced cybersecurity M&A transaction, with a focus on the part of the market the headline coverage skips: deals below $50M, where most of the industry actually changes hands. This is the first edition.

The quarter accelerated as it went

Deal count rose every month: 26 announcements in July, 40 in August, 57 in September. September 2026 was, by SecurityWeek's own running count, one of the busiest cyber M&A months on record. Whatever the financing headlines say about cyber, the acquisition market is not slowing down. It is speeding up, and it is speeding up at the small end.

Half the quarter was services

MSSP and MDR consolidation was the single largest engine of the quarter, 30 of 121 deals. The pattern repeats across geographies: PE-backed platforms (CompassMSP, The 20 MSP, New Charter, Redsquid, Focus Group, Presidio) buying small regional operators one at a time, plus the occasional large move like Quorum Cyber taking Ontinue or CyberMaxx taking Avertium. Add the pentest shops, privacy and GRC consultancies, audit firms, VARs, and IR boutiques, and roughly half of Q3's transactions were services businesses changing hands. The count is directional. It is not close.

GRC and compliance came second at 17, inflated by a single buyer: Sequrio, a German privacy-services roll-up, announced five acquisitions in one September week. Data security (13) and identity (11) follow. The DSPM pattern we mapped in May, crowded category consolidating into platforms, is now running in privacy services and identity services in real time.

Nineteen deals came from eight buyers

The quarter's volume was not 121 independent decisions. Eight repeat acquirers accounted for 19 of the deals: Sequrio announced five German privacy acquisitions in a single September week, and Palo Alto Networks, A-LIGN, SGS, Kiteworks, Cribl, Viatel, and Athena Agentic each made two. Programmatic consolidators, most of them sponsor-backed, are setting the market's pace, and they buy from a list, not from inbound.

Who was buying

Strategic platforms made 76 of the 121 acquisitions. PE-backed platforms made another 33, which understates private equity's real weight: most of those "strategic" MSP and MSSP buyers are themselves sponsor-owned. Direct PE deals (Bridgepoint taking a majority of Lansweeper, One Equity buying Myriad360, Apax, Adelis, InfraVia, Wind Point) added six more.

The more surprising names came from outside security altogether. Bank of America bought a pentest consultancy, Visa a biometrics platform, Munich Re a cyber insurer, and Qualcomm, S&P Global, Deel, Harvey, ClickHouse, Anaconda, and Burson all took security assets in the same window. For founders, the practical read: the real buyer list is wider than the security industry.

One absence worth naming: not a single search fund or independent sponsor was identifiable as a buyer in the public record this quarter. Either they are not closing in cyber, or they are closing so quietly that nothing surfaces. For founders at the small end of the market, that is a real gap in the buyer pool the generalist coverage never mentions.

Where the money went

Sixteen of the quarter's deals carried a disclosed or credibly reported value, about $5.2B in total, and the concentration is the story: identity took roughly 70 cents of every disclosed dollar. Visa's $2.4B purchase of BioCatch, Cyera's reported $1B acquisition of Oasis Security, and Okta's reported $200M Permiso deal account for most of the quarter's visible money. The rest of the tape runs from Munich Re's $575M At-Bay deal down to a $1.1M cyber-range tuck-in; most pricing below $50M, as ever, never reached a press release.

The market below $50M

Strip out the mega-deals and the shape of the working market appears: 81 of the quarter's 121 deals, two-thirds, point below $50M on value or target profile. That is where the volume lives, where the repeat buyers hunt, and the segment the headline coverage treats as a footnote.

It is also the segment where headline multiples mislead in both directions: a $2.4B biometrics exit says nothing about what a $6M ARR MSSP clears, and a $2.4M MSP tuck-in says nothing about what a growing identity product commands. Below $50M, price is discovered in process, in who is in the room and what the retention curve looks like. That is the market this Index keeps score on, and the market BrimWall works in every day.

The full list: all 121 deals

Every announced transaction we could verify for the quarter, grouped by month. A cyan edge marks BrimWall's directional sub-$50M flag: Yes where the value or target profile points below $50M, No where it clearly does not, ? where the public record does not say.

Methodology: the Index counts cybersecurity and security-adjacent M&A transactions announced July 1 to September 30, 2026, compiled from SecurityWeek's monthly M&A roundups, Return on Security issues #251–264, Pinpoint Search Group's monthly reports, and primary announcements, with BrimWall categorization. September includes the completion of Accenture's majority investment in Dragos and the related runZero and NetRise closings only by reference; both were announced in June and are excluded from the Q3 count. Category boundaries and sub-$50M flags are matters of analytical judgment. Values are as publicly disclosed or credibly reported and may not reflect final terms. Deal-level sourcing is available on request.