10 Key Cybersecurity Startup Acquisitions In 2024: Q3-Q4

The second half of the year has seen major security industry consolidation with a number of vendors acquiring startups in data security, identity management and SaaS security.

Cyber M&A Heats Up

The cybersecurity vendor consolidation that many have been predicting for years would seem to be finally happening in 2024. A surge of deal-making between security tool makers large and small has come to the industry this year, particularly in recent months. Major acquisitions have included the $500 million buy of IBM’s QRadar SaaS business by Palo Alto Networks, Fortinet’s acquisition of cloud security unicorn Lacework and, just announced at the end of October, Sophos’ planned acquisition of Secureworks for $859 million.

[Related: 5 Major Security Vendors That Could Be Acquired By Private Equity]

While these have been among the M&A deals reshaping the security industry this year, a flood of smaller deals have been announced in recent months, as well. Key startup acquisitions have been unveiled during the second half of 2024 by a number of major security vendors including Proofpoint, Cloudflare, Netskope, Mimecast and CrowdStrike.

Data security (including security for SaaS) has been a major theme of much of the cybersecurity startup acquisition activity during the third and fourth quarters, with more than half of the recent deals including data and SaaS security as an emphasis. Other recently announced deals have been focused on segments including identity management, cloud security, attack surface management and security for collaboration.

What follows are the details on 10 key cybersecurity startup acquisitions in Q3 and Q4 of 2024.

Rapid7 Acquires Noetic Cyber

In July, Rapid7 announced it had reached a deal to acquire Noetic Cyber, a startup whose technology is aimed at bolstering the vendor’s capabilities in cyber asset attack surface management (CAASM). The deal has since closed.

Rapid7 didn’t disclose the terms of the acquisition deal.

Rapid7 called Noetic Cyber “an innovator and a leader” in CAASM, and said the acquisition of its technologies will allow the vendor to “provide more comprehensive visibility of a customer’s environment, including visibility into both internal and external assets, on-premise and in the cloud.”

The acquisition “positions Rapid7 to deliver the most productive security operations experience while making it more accessible to the teams who need it most,” Rapid7 CEO Corey Thomas said in a news release.

Fortinet Acquires Next DLP

In August, Fortinet announced the acquisition of data security startup Next DLP in a bid to bolster its SASE (secure access service edge) platform. Terms of the acquisition were not disclosed.

With the acquisition of Next DLP—which CRN had named one of the 10 Hottest Cybersecurity Startups Of 2023—Fortinet said it will enhance its Unified SASE (secure access service edge) offering as well as “improve its position in the standalone enterprise data loss prevention (DLP) market.”

Next DLP offers a platform for spotting insider risk while also detecting exfiltration of data and data loss, using a software agent that delivers a minimal impact to CPU performance and worker productivity.

Mimecast Acquires Aware

In August, Mimecast announced the acquisition of a startup, Aware, which focuses on securing workplace collaboration tools with the help of AI. Terms of the deal were not disclosed.

Mimecast said in a news release that the acquisition aims to “revolutionize how organizations manage and mitigate human-centered security risks.” The technology from Aware integrates “seamlessly” with collaboration tools, while the “key business information and insights it gathers offer unprecedented visibility into workplace collaboration,” Mimecast said.

ColorTokens Acquires PureID

In September, microsegmentation vendor ColorTokens announced its acquisition of identity and access management (IAM) startup PureID. Terms of the deal weren’t disclosed.

ColorTokens said in a news release that the deal will “significantly strengthen” the microsegmentation capabilities on its Xshield platform through the integration of a “robust” identity offering. The move will enable “identity-based segmentation” for cloud and containerized environments, IoT/OT deployments and user environments, ColorTokens said in the release.

Kaseya Acquires SaaS Alerts

In October, Kaseya announced the acquisition of cybersecurity startup SaaS Alerts in a move to further enhance comprehensive, real-time protection for user identity and security across software-as-a-service environments.

The technology behind SaaS Alerts, which specializes in monitoring and securing SaaS applications, is now integrated into Kaseya 365 User at no additional cost.

SaaS Alerts’ technology is expected to strengthen MSPs’ ability to protect small businesses and their customers from escalating cyber threats, Kaseya said. Terms of the deal were not disclosed.

Proofpoint To Acquire Normalyze

In October, Proofpoint announced reaching a deal to acquire a startup focused on data security posture management (DSPM). Terms of the deal weren’t disclosed.

In a news release, Proofpoint said it will “further enhance its human-centric security platform with Normalyze’s leading AI-powered DSPM technology.” The new capabilities will enable Proofpoint to “discover, classify and protect data at scale across SaaS, PaaS, public or multi-cloud, on-prem and hybrid environments,” the company said in the release.

Cyera Acquires Trail Security

In October, Cyera announced it has acquired Trail Security, which it described as a “next-generation” provider of data loss prevention (DLP), for $162 million.

Cyera said in a news release that its acquisition of Trail Security “significantly elevates Cyera’s AI-powered platform” through the addition of “AI-enhanced DLP technology.”

Cyera is itself a startup, having been founded in 2021, and was recently named a startup to watch by CRN. The $1.4 billion company offers an agentless DSPM tool for discovery, classification and protection of data.

Netskope Acquires Dasera

In October, Netskope disclosed its acquisition of DSPM vendor Dasera, which the SASE platform provider said would enhance data protection capabilities for its Netskope One offering. Financial terms of the acquisition were not provided.

The deal for Dasera will make DSPM available immediately on the vendor’s Netskope One platform, the company said.

Cloudflare Acquires Kivera

In October, Cloudflare announced its acquisition of cloud security startup Kivera, in a move to expand the capabilities of the Cloudflare One SASE platform. Terms of the deal weren’t disclosed.

In a post, Cloudflare said that the acquisition will enable the company to offer inline cloud application controls, “empowering Cloudflare One customers with preventative security controls for all their cloud services.” Key capabilities include “one-click” mitigation of misconfigurations and enforced cloud tenant control, Cloudflare said.

CrowdStrike To Acquire Adaptive Shield

In November, CrowdStrike said it’s significantly boosting its Falcon platform with the planned acquisition of SaaS security startup Adaptive Shield. In a post, CrowdStrike President Michael Sentonas called the acquisition “essential” for the company’s future in SaaS and artificial intelligence security.

Financial details of the deal were not disclosed. The acquisition is expected to close during CrowdStrike’s fiscal fourth quarter 2024.

With the acquisition, CrowdStrike said it will be the only cybersecurity vendor to provide a single platform for end-to-end protection against identity-based attacks across the entire modern cloud ecosystem—from on-premises Active Directory to cloud-based identity providers and SaaS applications.