Cybersecurity M&A Roundup: Palo Alto and IBM Unveil New Acquisitions

Cybersecurity M&A activity ramped back up in September 2026 following a relatively quiet August, with big players in the field announcing new acquisitions to expand their offerings.

Palo Alto Networks unveiled the latest in a series of deals focused on enhancing its AI security capabilities, while IBM acquired a British cybersecurity consultancy as it seeks to expand its presence in the country.

Meanwhile, Dragos announced a double acquisition which immediately followed the completion of Accenture’s majority investment in the operational technology (OT) security specialist.

Here is Infosecurity’s cybersecurity M&A roundup for September 2026.

Palo Alto Networks Announces Another AI Security Acquisition

On September 1, cybersecurity giant Palo Alto Networks revealed it had acquired AI-native platform provider Console. The platform, which helps organizations apply AI-driven analysis and action across their enterprise operations, will be deployed by Palo Alto to build agentic workflows in natural language to enable customers to alert and remediate issues automatically.

The Console deal follows a number of other acquisitions of AI security specialists by Palo Alto in 2026, including Koi and Portkey in May.

A-LIGN Acquires Specialized Offensive and Defensive Firm Pathfynder

Cybersecurity compliance company A-LIGN announced the acquisition of Pathfynder, a specialized offensive and defensive cybersecurity firm, on September 1. A-LIGN will use Pathfynder’s expertise to help customers counter AI-enabled attacks. Pathfynder will remain a specialized team under the A-LIGN parent brand.

Pistachio Expands into Compliance Management Following Hugin.io Deal

Norwegian AI-powered human risk platform Pistachio has acquired Hugin.io, a cyber-risk management platform also based in Norway. Announced on September 2, the deal will see Pistachio broaden its offering beyond human risk to compliance management, helping organizations meet growing EU cybersecurity and data protection regulations, including NIS2 and DORA.

Kiteworks Acquires AI Data Security Firm Bonfy.AI

Kiteworks announced the acquisition of AI data security firm Bonfy.AI on September 10. The transaction will see Bonfy.AI’s platform, which classifies and enforces policy on sensitive data in real time across AI tools and other applications, incorporated into the Kiteworks control plane for secure data exchange.

Deal Agreed to Combine Two Microsoft-Focused Providers

On September 16, Quorum Cyber signed a definitive agreement to acquire managed detection and response (MXDR) provider Ontinue. Once concluded, the transaction will combine the respective expertise of the two Microsoft-focused companies to develop AI-enabled security solutions as part of a 24/7 threat detection through incident response and recovery offering.

Dragos Announces Double Acquisition

Dragos announced the acquisition of NetRise runZero on September 21, with the move coinciding with the close of Accenture’s majority investment in Dragos. The double deal forms part of the company’s extended operational technology (xOT) security strategy, which aims to protect any systems that can impact physical processes in industrial settings. The deals follow Dragos’ acquisition of Phosphorus earlier in 2026.

IBM Expands UK Cybersecurity Portfolio with Logiq Acquisition

Tech giant IBM announced the acquisition of UK-based Logiq Consulting on September 24. The deal is designed to expand IBM’s cybersecurity portfolio in the UK and advance its hybrid cloud, AI and digital sovereignty agenda.

Both companies will work together to support UK organizations to maintain control over critical data and technology environments, meet evolving security and regulatory requirements and adopt AI securely.

TRG Strengthens MSP Offering with Fentron Transaction

On September 30, managed services provider TRG announced it had acquired Fentron, a cybersecurity and advisory firm based in Ohio. TRG aims to use Fentron’s capabilities to strengthen its integrated cybersecurity offering across the enterprise endpoint lifecycle.

Following the transaction, Fentron’s team will join Inversion6, TRG’s dedicated cybersecurity division. TRM is owned by private equity firm Gemspring Capital.