Latest / Cybersecurity Business with Fexingo: Security Companies, Breaches, and Enterprise Defense / How Cybersecurity M&A Is Reshaping the Industry
Transcript
- Lucas: So late last year, Palo Alto Networks announced it was acquiring Cato Networks for two point eight billion dollars. That's a big number, but what's more interesting is what it signals about the direction of the entire cybersecurity industry. Luna: Cato was a big independent player in the SASE space — secure access service edge. So Palo Alto essentially bought its way into a category it had been building toward for years. Lucas: Exactly. And this wasn't a distressed sale. Cato had strong revenue growth, a solid customer base. Palo Alto paid a premium because they needed to own that piece of the stack. The deal tells you that platform consolidation is accelerating. Luna: Platform consolidation — meaning enterprises want fewer vendors, not more. They want one throat to choke. Lucas: Right. And that's the key driver behind most of the big cybersecurity M&A we're seeing. Look at the numbers: in 2025, global cybersecurity M&A volume hit roughly fifty eight billion dollars, up from about forty two billion in 2024. That's a year-over-year increase of nearly forty percent. Luna: And a lot of that was driven by large vendors like Palo Alto, CrowdStrike, Microsoft, and Cisco buying up smaller point-solution companies. Lucas: Yeah. The strategic logic is pretty clear. If you're a CISO, you're managing dozens of security tools. Each one has its own console, its own alerting, its own update cycle. That creates complexity, and complexity creates risk. So the promise from the big platforms is: buy more from us, reduce that complexity. Luna: But there's a tension there. Consolidation can reduce choice and innovation. If a few giant vendors control the stack, do we end up with less competition? Lucas: That's the million-dollar question. And it's one the industry is wrestling with right now. The counterargument is that smaller startups still have room to innovate in specific niches — they just become acquisition targets faster. The venture capital flowing into cybersecurity is still strong. In 2025, cybersecurity startups raised about fourteen billion dollars globally. That's down from the peak of 2021, but it's still healthy. Luna: So the model becomes: build a great point product, get acquired by a platform. That's the exit strategy for a lot of founders. Lucas: Exactly. And that's not necessarily bad for innovation. The platform companies integrate those products, and the technology reaches a broader customer base. But there is a real risk of vendor lock-in. Once you're deep into Palo Alto's ecosystem, or CrowdStrike's, or Microsoft's, switching costs are high. Luna: I want to go back to the Palo Alto-Cato deal specifically. What made Cato such a strategic fit? Lucas: Cato was one of the early leaders in SASE — combining software-defined wide-area networking with cloud-delivered security. Their platform handled firewalling, secure web gateway, zero-trust network access. That's exactly the set of capabilities that Palo Alto needed to round out its own Prisma SASE offering. Luna: And Palo Alto had been trying to build that in-house. But acquiring gave them an established customer base and a proven product overnight. Lucas: Right. The build-versus-buy decision was pretty clear here. Cato had about two thousand enterprise customers and was growing at about thirty percent year-over-year. Palo Alto estimated it would take three to four years to build equivalent functionality internally. So they paid a premium to compress that timeline. Luna: What did they pay exactly? I remember it was a mix of cash and stock. Lucas: Two point eight billion, roughly half in cash, half in stock. That values Cato at about twelve times its annual recurring revenue. For context, typical cybersecurity acquisitions in 2025 were around eight to ten times ARR. So it was a premium, but not outrageous for a category-defining company. Luna: And what happened to Cato's founders and leadership? Lucas: The CEO, Shlomo Kramer, stayed on to run the combined SASE business within Palo Alto. That's common in these deals — you retain the talent, especially the technical leadership. The product teams were integrated, but Cato's core engineering remained largely intact. Palo Alto was smart about not disrupting what was working. Luna: So we're seeing this pattern repeated across the industry. Microsoft acquired RiskIQ for threat intelligence. CrowdStrike bought Humio for logging. Cisco bought Splunk — that was a huge deal, twenty eight billion. Lucas: The Splunk deal is fascinating because it's a different kind of consolidation. Splunk isn't purely a security company — it's an observability and data analytics platform. But security is one of its biggest use cases. Cisco needed that to compete with Palo Alto and CrowdStrike in the security information and event management, or SIEM, market. Luna: So the boundaries between categories are blurring. Network security, endpoint security, cloud security, identity — they're all becoming one big platform play. Lucas: That's the thesis. And it's driving a lot of the M&A we're seeing in 2026 as well. Just this quarter, we've seen private equity firms getting more active too. Thoma Bravo, for instance, acquired a couple of mid-market security firms and merged them into a larger platform. That's another path to consolidation. Luna: Private equity tends to focus on operational efficiency and margin improvement rather than product innovation. Does that change the industry's trajectory? Lucas: It can. pe backed firms often cut costs and cross-sell to existing customers. They're less likely to take big product risks. That can create an opening for startups that are more agile. So there's a natural cycle: PE buys mature companies and optimizes them, startups innovate and eventually get acquired by the platforms or by other PE firms. Luna: And what about the customer perspective? If you're a CISO at a mid-sized company, how do you navigate this consolidation? Lucas: That's the practical question. I think the smart move is to evaluate your long-term roadmap. If you're already heavily invested in one platform, the incremental cost of adding more from that vendor is probably lower than switching. But you also need to maintain some optionality. Don't let any single vendor own your entire security posture. Luna: So multi-platform but with a preferred vendor? Lucas: Exactly. Use a primary platform for your core needs — endpoint, network, identity — but keep best of breed tools for specific areas like cloud security or application security. And make sure your contracts have reasonable exit clauses. Vendor lock-in is real, but it's not absolute if you negotiate well. Luna: Speaking of practical takeaways, I think this episode gave a really useful framework for understanding why these deals happen and what they mean for buyers. If today was actually useful to you, the way these stay ad-free is listener support. You can find us at buy me a coffee dot com slash fexingo. It's a simple way to keep the conversations going without any sponsors. Lucas: Yeah, we really appreciate that. It keeps us independent and focused on what matters for our listeners. So back to the M&A landscape — I want to talk about one more deal that's interesting. In February, Wiz, the cloud security company, acquired Lacework for about five hundred million. That's a consolidation play within the cloud security category itself. Luna: Lacework was a unicorn that had raised over a billion dollars. So the fact that it sold for five hundred million shows that the market is correcting from the overvaluation of 2021 and 2022. Lucas: Exactly. And it shows that even well-funded companies can struggle to achieve standalone scale. Wiz, which was valued at twelve billion in its last funding round, used the acquisition to absorb Lacework's technology and customer base. It's a classic roll-up strategy. Luna: So the consolidation isn't just the big platforms buying small point players. It's also mid-tier companies merging to create stronger challengers. Lucas: Right. And that's healthy for the market. It means there will be multiple large platforms competing, not just one or two. Palo Alto, CrowdStrike, Microsoft, Cisco, Wiz — they're all building broad portfolios. The endgame is probably three to five major platforms that dominate the enterprise security space. Luna: And then the startups will focus on the bleeding edge — AI security, quantum-safe cryptography, maybe even security for autonomous systems. Lucas: That's exactly the pattern. The platforms own the commoditized layers, and startups innovate at the frontier. The M&A cycle ensures that innovation gets absorbed into the platforms over time. It's not perfect — there are real risks around concentration and lock-in — but it's the market's way of balancing scale and innovation. Luna: So for a listener who's a security professional or a business leader, the key takeaway is: understand where your vendor is in this lifecycle. Are they likely to be acquired? Are they acquiring? That affects your roadmap and your negotiating power. Lucas: Absolutely. And stay informed. The M&A landscape shifts quickly. A vendor you rely on today could be part of a larger platform next quarter. That's not necessarily bad, but you want to be aware of it so you can plan accordingly. Luna: Well, we'll keep tracking the deals and the trends. Thanks for listening, everyone. Lucas: Yeah, until next time.