Cybersecurity Acquisitions in 2019

Palo Alto Networks completed its acquisition of Aporeto Inc., a machine-identity based microsegmentation company, integrating Aporeto’s technology into its Prisma Cloud native security platform. The deal (reported at about $150 million) brings Aporeto’s co-founders and microsegmentation capabilities into Palo Alto’s cloud security offerings to expand cloud-native workload protection.

Funds advised by Apax Partners have completed the acquisition of Coalfire, a cybersecurity advisory and assessment services firm, from The Carlyle Group and The Chertoff Group. The investment will support Coalfire's growth through technology investment, expanded services (including cloud security, penetration testing and CMMC readiness) and strategic acquisitions.

OPSWAT, a San Francisco–based critical infrastructure cybersecurity company, has completed the acquisition of Impulse, a Tampa, Florida firm known for its SafeConnect Network Access Control and Software Defined Perimeter solutions. The deal integrates Impulse's NAC and SDP technologies and teams into OPSWAT's product portfolio and establishes OPSWAT's first East Coast hub in Tampa to expand engineering, IT, and support capabilities.

Tenable, Inc. acquired Indegy Ltd. for $78 million in cash to add industrial/OT cybersecurity capabilities and deliver a unified IT/OT risk view. The purchase brings Indegy's OT device intelligence and threat-detection capabilities into Tenable's Cyber Exposure platform to accelerate IT/OT convergence.

Proofpoint, Inc. completed its acquisition of ObserveIT, an insider threat management and endpoint monitoring platform, in November 2019. The deal brings ObserveIT's endpoint agent technology and data risk analytics into Proofpoint's people-centric security portfolio to extend data loss prevention (DLP) and insider-threat capabilities to endpoints.

Bluestone Investment Partners’ portfolio company Intrepid Solutions and Services has completed the acquisition of BWM Outcomes, a provider of cybersecurity and intelligence analysis services for U.S. defense and intelligence customers. BWM founder Jacqueline Bahe will join Intrepid as BWM President to continue running the business, which expands Intrepid's cyber and intelligence analytic capabilities and customer relationships.

IPKeys Power Partners has acquired Ontario-based N-Dimension Solutions, a managed detection and remediation (MDR) provider serving utilities, and will integrate N-Dimension into its IPKeys Power Partners platform. The transaction also included an equity investment in IPKeys from EnerTech Capital to support growth and strategic expansion of IPKeys' Cyber Lab as a Service offering.

Plixer, a network and security intelligence provider, has acquired Great Bay Software, a vendor of endpoint visibility and device discovery solutions. The acquisition unifies endpoint and network visibility capabilities to give security and network operations teams improved real-time and historical device insights and automated incident response.

Aqua Security acquired CloudSploit to expand its cloud-native security platform into Cloud Security Posture Management (CSPM) and deepen VM security capabilities. The acquisition adds CloudSploit’s SaaS-based cloud configuration monitoring and open-source heritage to Aqua’s container, serverless and cloud workload protection offerings.

Five Points Capital, alongside co-investors Pleasant Bay Capital, Crescendo Capital and Capital Southwest Corporation and new CEO Mike Dager, completed a recapitalization of GrammaTech, a developer of software-assurance tools and application-security solutions. The transaction establishes a new leadership team (Mike Dager as CEO) and positions GrammaTech to expand in the growing application-security market serving government and commercial clients.

Sumo Logic acquired JASK Labs to integrate JASK's cloud-native Autonomous Security Operations Center (ASOC) capabilities into Sumo Logic's Continuous Intelligence Platform, expanding its cloud-native security intelligence, cloud SIEM and compliance offerings. The deal adds JASK's security engineering talent and an Austin, Texas office to Sumo Logic and aims to reduce alert fatigue and automate SOC workflows for modern, multi-cloud environments.

Broadcom Inc. completed its acquisition of the Enterprise Security business of Symantec Corporation, which will operate as the Symantec Enterprise division within Broadcom. The deal expands Broadcom’s infrastructure software portfolio and brings Symantec’s enterprise security products, customers and employees into Broadcom’s software franchises.

CynergisTek, Inc. acquired Backbone Enterprises, Inc. (d/b/a Backbone Consultants) to expand its cybersecurity, IT audit, and data privacy capabilities. The transaction (announced November 1, 2019) included initial consideration of approximately $7.0 million ($5.5M cash, $1.5M stock) plus up to $4.0 million in earn-outs and brings Backbone’s ~ $3.6M trailing-12-month revenue and a small team of security, privacy, and IT audit professionals into CynergisTek’s managed services portfolio.

Clearlake Capital Group and TA Associates have completed a strategic growth investment in DigiCert, with the management team continuing to lead and investing alongside the new investors. The capital will be used to accelerate product development and automation of certificate management, expand DigiCert's PKI, TLS/SSL and IoT security offerings, and support organic and inorganic growth initiatives.

SailPoint Technologies completed the acquisitions of Orkus and OverWatchID for total consideration of $37.5 million. The deals expand SailPoint's cloud identity governance capabilities by adding Orkus' AI/ML-driven IaaS access monitoring and OverWatchID's activity-based access analytics to the SailPoint Predictive Identity platform.

Private equity firms TA Associates and Charlesbank Capital Partners have signed definitive agreements to become additional investors in HelpSystems, joining existing investor HGGC as well as management and employees. The minority growth investment will provide capital to accelerate HelpSystems' organic growth and support complementary acquisitions of cybersecurity, automation and analytics solutions.

LINKBYNET has acquired WISE Partners, a French cybersecurity and digital trust consulting firm, in a move to strengthen LINKBYNET's cloud security and managed security services in France and Europe. The deal brings over 60 consultants from WISE Partners into LINKBYNET's cybersecurity cluster and is positioned as an add-on to LINKBYNET's existing capabilities while Keensight Capital (LINKBYNET's investor) commented on the strategic fit.

VMware completed its acquisition of Carbon Black in an all-cash transaction valued at $2.1 billion (at $26 per share). Carbon Black will form the nucleus of a new VMware Security Business Unit to expand VMware’s cloud-native security and endpoint protection capabilities.

Elastic N.V. (Elastic) completed the acquisition of endpoint protection vendor Endgame in October 2019. The transaction, with a total purchase price of approximately $234 million (shares plus cash to repay debt and transaction expenses), brings Endgame's endpoint protection capabilities into Elastic’s security portfolio to integrate with Elastic SIEM and expand Elastic’s security product offering.

I-TRACING Group has acquired IDENTO, a French identity and access management (IAM) consulting and engineering firm, while IDENTO remains under the control and management of its founders, Zahi Dib and Charlotte Fourcroy. The deal strengthens I-TRACING's cybersecurity services and engineering capabilities in IAM, expanding its offering to large enterprise clients in France and via its international subsidiaries.

Framatome has acquired FoxGuard Solutions, a U.S.-based provider of industrial cybersecurity, computing and regulatory compliance solutions headquartered in Christiansburg, Virginia. FoxGuard will become Framatome's center of expertise for cybersecurity in North America, expanding Framatome's consulting, implementation and managed cybersecurity offerings for the energy and critical infrastructure sectors.

Palo Alto Networks has completed the acquisition of Zingbox, an IoT-focused cybersecurity company, for approximately $75 million in cash. The deal brings Zingbox's AI/ML-driven, cloud-based IoT security capabilities into Palo Alto Networks' Next-Generation Firewall and Cortex platforms to expand its IoT security offerings.

Entourage Investment Group, LLC completed the acquisition of Axiom Cyber Solutions, a Las Vegas-based cybersecurity company founded in 2015. The founders, Troy and Shannon Wilkinson, will remain as advisors while Entourage provides capital, infrastructure and resources to scale Axiom’s SaaS cybersecurity platform for the SMB market.

Ampcus Cyber (an Ampcus company) has completed the acquisition of Orbit Cyber Inc., a specialist provider of cybersecurity services focused on industrial/OT and enterprise security, compliance and NERC‑CIP attestation readiness. The deal expands Ampcus Cyber’s service portfolio and strengthens its position and go-to-market capabilities in North America for critical‑infrastructure and enterprise cybersecurity offerings.

Private equity turnaround and growth firm Stage Fund has acquired Cymmetria, a cyber deception software provider with offices in Tel Aviv and Denver. Stage Fund appointed Daniel Frydenlund as chairman of Cymmetria’s board and plans to boost R&D in Tel Aviv while expanding sales and marketing from a new Denver headquarters to accelerate growth in the cyber deception market.

FPE Capital LLP has completed a growth investment in Intragen, a pan‑European cybersecurity consultancy and systems integrator specialising in Identity & Access Governance (I&AG). The founders, Ian Yoxall and Mike Jones, remain in leadership roles as FPE partners with management to accelerate international expansion and further scale the business.

SmartRIA acquired the Greytwist Data Governance software platform and related assets in an asset sale, integrating Greytwist's vendor due diligence, PII data governance, and cybersecurity policy management capabilities into SmartRIA's Compliance Management Platform. SmartRIA will bring the Greytwist team aboard to support customers and accelerate the combined product roadmap for wealth management firms.

CyberRisk Alliance (CRA), a PE-backed business intelligence company focused on cybersecurity, has acquired Cybersecurity Collaborative, a private peer-council platform for CISOs founded by Stuart Cohen. The deal brings Cybersecurity Collaborative into CRA’s portfolio to expand its peer council/membership offerings and accelerate product and market expansion for CISOs across enterprise, government and healthcare organizations.

CyberRisk Alliance (backed by Growth Catalyst Partners) has acquired SC Media, the longtime cybersecurity publishing and events brand, from Haymarket Media, Inc. The deal expands CyberRisk Alliance’s portfolio of cybersecurity-focused business intelligence products and events as part of its rapid roll-up strategy in the information risk marketplace.

GoSecure acquired EdgeWave to extend its managed detection and response (MDR) capabilities into the email inbox, combining EdgeWave’s email security platform and customer base with GoSecure’s CounterTack-powered detection and response services. The deal adds EdgeWave’s thousands of customers, channel partners and cybersecurity personnel to GoSecure, accelerating product capability expansion and scale.

Houston-based merchant bank Braes Capital has acquired Siege Technologies, a Chantilly, Virginia cybersecurity research and development firm focused on the federal market. The acquisition positions Braes to build broader cyber capabilities to protect critical infrastructure across federal, energy and financial services markets; Siege was divested by Nehemiah Security to allow Nehemiah to focus on its Risk Quantifier SaaS.

Palo Alto Networks completed the acquisition of Twistlock, a container security leader, for approximately $410 million in cash. The deal adds Twistlock's container and cloud-native security capabilities to Palo Alto's Prisma cloud security suite and brings Twistlock co-founders into Palo Alto Networks.

Onapsis, a Boston-based business-application cybersecurity provider, has acquired Heidelberg-headquartered Virtual Forge, a specialist in SAP application security and compliance. The acquisition adds Virtual Forge’s detection and remediation technology to Onapsis’s platform to expand capabilities for protecting SAP and Oracle customizations and to accelerate international growth.

Accenture has acquired Deja vu Security, a Seattle-area company that specializes in security design and testing for enterprise applications and Internet of Things (IoT) technologies. Deja vu Security will join Accenture Security's Cyber Defense offerings to deepen Accenture's capabilities in application and IoT security; financial terms were not disclosed.

Imperva has signed an agreement to acquire Distil Networks, a leader in bot management, to integrate advanced bot mitigation into Imperva's application security platform. The acquisition expands Imperva's capabilities in detecting and mitigating malicious automated traffic across web, mobile and API channels, providing customers a more comprehensive, integrated application security solution.

Providence Strategic Growth (PSG), the growth equity affiliate of Providence Equity Partners, has made a strategic growth investment in ThreatConnect, an Arlington, Virginia-based provider of an intelligence-driven security operations platform. The funding will be used to accelerate ThreatConnect's go-to-market strategy, product development and international expansion as the company plans to increase staff by more than 50% over the next 12 months.

Sophos (LSE: SOPH) has acquired Rook Security, an Indianapolis-based managed detection and response (MDR) provider founded in 2008, to expand its re-sellable MDR services by combining Rook's threat detection, investigation and incident response capabilities with Sophos' DarkBytes technology. Rook Security was privately owned; Capstone Partners advised Rook and Barnes & Thornburg LLP served as legal counsel. No financial terms were disclosed.

CertiPath and ZEVA jointly acquired SAFE-BioPharma, a provider of high-assurance digital identity and cryptography standards for the pharmaceutical, biotechnology, and healthcare industries. The buyers intend to refresh and expand SAFE-BioPharma's policies, specifications, and services to strengthen digital identity trust across regulated health and life-science organizations.

Sunstone Partners acquired Terra Verde Security LLC, TruShield Security Solutions and Sword & Shield Enterprise Security and combined them into a single managed cybersecurity platform called Avertium. The new company will serve mid-to-large enterprises with managed security, compliance and advisory services, operating SOCs in Arizona and Tennessee and leveraging a combined team of more than 150 employees and 1,000+ customers.

By Light Professional IT Services LLC acquired Metova Federal, a provider of cyber range and cyber training services to U.S. government customers. The add-on strengthens By Light's cyber and intel offerings and expands its CyberCENTS cyber training and exercise capabilities; financial terms were not disclosed.

Orange has acquired SecureLink Group, a pan-European cybersecurity infrastructure and managed services provider, from Investcorp for an enterprise value of €515 million. Investcorp originally acquired SecureLink in 2015 and grew it via a buy-and-build strategy across Europe and China; Orange says the acquisition reinforces its cybersecurity operations in Europe and expands its managed security capabilities.

DivvyCloud, a provider of cloud security and compliance automation, raised $19 million in a growth round led by Providence Strategic Growth with follow-on investments from MissionOG and RTP Ventures. The funding (bringing total raised to $29M) will be used to accelerate product innovation—extending policy enforcement into CI/CD, container and serverless support—and to expand sales, marketing and customer success efforts.

The GLI Group (GLI) has acquired SeNet International Corporation to expand its information security and cybersecurity capabilities in the United States. SeNet will operate as the U.S. information-security platform for GLI's Bulletproof Solutions, with SeNet leadership retained to support combined service offerings to gaming, government, and commercial clients.

Symphony Technology Group (STG) has made a growth equity investment in RedSeal, a provider of cyber risk modeling software for hybrid environments, to support the company’s product and market expansion. The investment will fund accelerated growth and scaling of RedSeal’s platform, which is used by Global 2000 companies and government agencies; terms were not disclosed.

Palo Alto Networks completed the acquisition of Demisto, a security orchestration, automation and response (SOAR) vendor, to integrate Demisto's automation and AI capabilities into its Cortex security platform. The deal was valued at approximately $560 million in cash and stock and is intended to expand Palo Alto Networks' automated threat prevention and response capabilities for security operations teams.

Carbonite, Inc. completed its acquisition of Webroot Inc. for $618.5 million in cash, combining Carbonite's cloud-based backup and recovery capabilities with Webroot's cloud-native cybersecurity platform. The transaction is intended to create an integrated data protection and endpoint security offering for small and mid-sized businesses and managed service providers.

NTT Security Corporation has signed a definitive agreement to acquire WhiteHat Security, a San Jose–based application security provider. WhiteHat will operate as an independent, wholly-owned subsidiary of NTT Security, expanding NTT's application security and DevSecOps capabilities and enabling combined end-to-end cybersecurity offerings.

Comcast Corporation acquired BluVector, an AI- and machine-learning driven cybersecurity company, to expand its cybersecurity capabilities and integrate BluVector's threat-detection technology into Comcast's product and service offerings. Financial terms were not disclosed; BluVector's leadership will continue under a new CEO and will collaborate with Comcast on product development and growth.

Verizon Communications closed its acquisition of ProtectWise, a Denver-based provider of cloud-delivered Network Detection and Response (NDR). Verizon will integrate ProtectWise's NDR technology and team into its enterprise security offerings to expand detection and response capabilities and support customers as they adopt next-generation connectivity including 5G; terms were not disclosed.

German systems integrator N3K (a VR Equitypartner portfolio company) has acquired Cygna Labs, a Miami Beach–based provider of Microsoft-focused hybrid and cloud auditing and compliance software. The deal secures Cygna Labs’ IP and is intended to expand N3K’s compliance and auditing product capabilities; financial terms were not disclosed. Cygna Labs was previously majority owned by Blackbird Ventures.