Invest1 publisher3 min readPublished
Eight security incumbents bought their AI security stories for about $250m each
Forrester counts eight acquirers and upwards of $2.0bn of AI security tuck-ins in 18 months. It also tells CISOs to ask their vendors whether the bought capability will be bundled into the platform or sold separately.
The Investor · Invest desk
What happened
- Forrester counts eight major security vendors spending upwards of $2.0 billion over 18 months on startups that secure enterprise AI.
- The post names five buyers, Check Point, Cisco, CrowdStrike, F5 and Palo Alto Networks, leaving three of the eight acquirers unidentified.
- On the sell side, Forrester cites sovereignty requirements an early-stage vendor cannot staff for, plus CISO budget pressure, as reasons to exit into a well-capitalized mega-vendor.
- The gap being bought is specific: Forrester says legacy tools do not understand prompt injection, model tampering or AI-specific data leakage.
Compiled by The InvestorSomething wrong?How this is made
Why it matters
- cost Forrester tells CISOs to ask whether AI security will be bundled or sold separately, and if the answer is separately, the absorbed capability arrives as a new line item on a contract the buyer already signed.
- decision Renewal timing becomes the live choice: buy the standalone tool for this contract year and carry the overlap when the platform feature ships, or wait on an integration date no vendor has published.
- exposure With three of the eight buyers unnamed, a security buyer cannot tell from this count whether their own platform vendor has bought a capability or still has to build one.
- precedent An average clearing price near $250 million sets a low bar for the next AI security tuck-in, cheap enough that any remaining large vendor can match it out of cash.
Upwards of $2.0 billion split eight ways averages about $250 million an acquirer, which works out to roughly $111 million a month of deal value across the 18 months Forrester counted [1][14][15]. Forrester did not publish the individual prices, so the average is the only per-buyer figure on offer [17]. It is small money for companies of this size, and Forrester makes the comparison itself: these deals do not match the larger transactions of 2024 and 2025, such as the Wiz and CyberArk acquisitions [3].
The stated buy-side motive is speed and staffing. Forrester describes a race to collect talent, cut time to market and hold competitive position, with acquirers wanting innovative products, PhD-level experts and early traction with Fortune 500 customers [5]. Then the blunter version: "They wanted to avoid being the only major player without an AI security story," Forrester wrote [6].
On the sell side, the alternative to a sale was funding a country-by-country compliance build that an early-stage vendor cannot spread over enough revenue [7]. A seller in that position has little leverage on price. The average price works out to about $250 million [14].
For the buyer of security software, Forrester's forecast is that model scanning, prompt filtering, agent sandboxing and AI-specific data loss prevention arrive inside the firewall, XDR or SASE suite already on the contract. The buyer would not need to stitch point solutions together [8]. The delivery caveat is Forrester's own: "Integrations take time, so none of this will come to your favorite platform on day one" [9]. The acquired companies are smaller, carry fewer products and are mostly cloud-native with full API coverage. Forrester argues that should make them quicker to absorb than past deals [10]. "The platform story isn't always unicorns and rainbows, though," Forrester wrote [11].
I think the absorption call holds on capability and is unproven on price. The evidence for that is Forrester's own advice to CISOs. Ask vendors what ships now, what ships next, whether AI security will be bundled or sold separately, and push for clarity on service levels, support and pricing [12]. Forrester does not say any acquired product has been retired, so a buyer who skips a standalone tool this year is buying a roadmap.
The counter-thesis sits in the same number. At $250 million apiece, each incumbent has bought an option on a category, and eight cheap options say the targets were cheap [14].
Two outcomes separate those readings. If the acquired capabilities ship inside existing suites at no incremental list price within a year, the point-solution budget line disappears and the consolidation case is made. If they return as separately priced SKUs, the CISO has bought a rebadged point solution from a larger vendor.
Forrester also flags where the next round of buying points. Securing generative AI is today's problem, and agents are here already. Its Security & Risk Summit keynote with Jess Burn in Austin on November 5 to 7 is titled "The CISO Of The Agentic Future" [13].
What to watch
- Identification of the three acquirers Forrester counted but did not name, and whether the count passes eight.
- Whether vendors quote AI security as included in the suite or as a separate SKU at the next renewal cycle.
- Whether agent and agentic security becomes the next tuck-in target after the November Security & Risk Summit.