A bank bought a pentest shop and a pipeline vendor bought detection rules

Twenty-one cybersecurity-related M&A deals were announced in July 2026, according to SecurityWeek's monthly roundup ^[1]. Two of them matter more than their undisclosed price tags suggest, because they move consolidation off the platform layer and into services and detection content.

Bank of America said it plans to acquire MDSec Consulting Limited, a UK-based technical information security consultancy of roughly 65 practitioners, in a deal that expands the bank's footprint in northern England ^[4][5][6]. This is not a vendor rolling up a competitor. It is an end customer buying the testing capability outright, staff included, rather than renewing a statement of work. Offensive security consultancies have long been acquired by larger consultancies and by product vendors looking for credibility; a bank taking one in-house is a different signal about where scarce red-team labour is going.

The second is Cribl's purchase of CardinalOps, an Israeli AI detection engineering startup, which puts automated detection engineering into Cribl's platform with the stated aims of improving threat coverage and lowering log management costs for enterprise SOCs ^[7][8]. Cribl is opening a Tel Aviv office off the back of it ^[9]. Detection content has usually travelled with the SIEM or the managed provider. Putting it next to the pipeline means the rules and the routing get sold together, and customers who chose Cribl to stay vendor-neutral about their data now have a supplier with an opinion about their detections.

The larger cheques still went to platform consolidation. Cyera agreed to buy Oasis Security for around $1 billion, pairing its data security platform with non-human identity governance for AI agents and service accounts ^[13]. Okta signed for Permiso Security, reportedly around $200 million, to add continuous identity threat detection ^[14]. Qualcomm bought SAM Seamless Network, reportedly for more than $100 million, to embed network security software in its chipsets and gateways; SAM's customers include AT&T and Verizon ^[15]. Barracuda took Evo Security for multi-tenant IAM and PAM aimed at MSPs ^[16], Infoblox signed a definitive agreement for Kentik ^[17], and Palo Alto Networks moved on the observability vendor Embrace ^[18].

CrowdStrike's deal is structurally the odd one: it is buying the patents and source code of XM Cyber from Schwarz Group, not the company, to fold exposure management and attack-path analysis into its own products ^[10][11]. The price is undisclosed, which is conspicuous given Schwarz paid $700 million for XM Cyber in 2021 ^[12].

On volume, July was a slower month. Twenty-one deals is 16 fewer than June's 37, a drop of about 43 percent ^[20], and below the roughly 35 deals a month implied by the more than 420 acquisitions SecurityWeek counted across 2025 ^[2][21]. Israeli targets remain overrepresented: four of the nine deals singled out in the roundup were Israeli companies ^[22].

Watch whether other large enterprises follow Bank of America and buy their assessment providers instead of contracting them, which would tighten an already thin consulting market. Watch CardinalOps pricing and portability for existing customers now that detection engineering sits inside a data pipeline vendor. And watch what remains of XM Cyber at Schwarz Group once the patents and source code leave ^[10].