Cybersecurity startup M&A holding steady after record year

Cybersecurity startup M&A holding steady after record year

While not at the same breakneck pace as last year, M&A deals involving cybersecurity startups have remained strong in 2022, even with an economy reeling.

Last year was a record for cybersecurity trading, with the purchase of 124 VC-backed startups, according to data from Crunchbase. Although 2022 doesn’t look like it will break that record, with only 49 announced for nearly half of the year, this year is still posting a healthy pace, according to market watchers.

The deal may not set records this year, but it hasn’t fallen off a cliff either: For comparison, all of 2020 saw 76 cybersecurity firm M&A deals.

“While we are a bit behind the record levels of 2021, when you compare this year’s activity to… all of 2020, it paints a slightly more positive outlook,” he said. Dino Boukourisfounding director of San Francisco-based financial advisory firm cyber impulse.

Search less. Close more.

Increase your revenue with all-in-one prospecting solutions powered by the leader in private enterprise data.

“That said, the public market and associated cryptocurrency corrections, coupled with general economic and geopolitical uncertainty, have led to a slight slowdown in mergers and acquisitions to start the year,” he added.

slight slowdown

Despite that slowdown, this year has already seen big deals involving VC-backed startups, including:

  • Support Associates bought the Burlington, Massachusetts-based application security company truecode for $2.5 billion in May.
  • amd acquired Milpitas, California-based distributed services platform Thinking for $1.9 billion in April.
  • SentinelOne bought Fremont, California-based identity detection and response company active networks for $616.5 million in March.

That shouldn’t surprise most. Cybersecurity has proven to be resilient in a market where threats and attack surfaces are constantly expanding. Although some IT budgets are being cut, most companies still view cybersecurity as a “must have” due to the increasing number of national and international bad actors and attacks.

alberto yepezco-founder and CEO of Capital of Forgepoint— which specializes in cybersecurity and infrastructure software investments and has seen four exits this year alone in security — said the market for M&A deals remains strong and still offers good multiples for investors.

“M&A premiums aren’t going down yet because the companies being bought right now are some of the best,” said Yepez, whose exits include Attivo Networks and, more recently, threat detection and response. Cysiv be bought by ForeScout.

Yepez said he still sees solid multiples (around 20x ARR for good startups) and thinks he should continue with strategic buyers like Google, Microsoft Y Amazon still swimming in the waters of acquisitions.

google already got a big deal on cyber when he announced that he would pay $5.4 billion to buy a publicly traded cyber company principal.

“I think prices will fall when private capital starts to come into the picture,” he said.

needing cash

Prices could also start to fall if fundraising continues to slow and startups need cash.

“The real question, however, is after valuations in private markets recalibrate. Will that create a tailwind for mergers and acquisitions for those companies that may be facing challenges raising capital or possibly facing a ‘downside round’ if they were to raise capital? Boukouris said.

Boukouris said that when evaluating strategic alternatives, startups may begin to look at mergers and acquisitions as an alternative if it’s hard to raise money.

Still, the slowdown in fundraising doesn’t seem to affect cybernetically much like other technology sectors, with the industry coining more than a dozen unicorns already this year.

While some fear economic uncertainty due to inflation and higher interest rates, making money to complete deals more expensive, could chill some mergers and acquisitions in the second half of the year, many of those invest in cyber do not anticipate a slowdown.

“I don’t think interest rates should affect mergers and acquisitions too much,” Yepez said. “I think he will continue to be strong in the second half.”


Cybersecurity is defined by the network security, cloud security, cybersecurity, and identity management industries, according to data from Crunchbase.

Other readings:

Illustration: Dom Guzman

Stay up to date with the latest funding rounds, acquisitions, and more with Crunchbase Daily.

Leave a Comment