Estimated reading time: 5 minutes · Last updated:
Momentum Cyber’s Q3 figures show a surge of deal activity that has put 2026 on track for roughly 450 cybersecurity acquisitions, with Q3 reporting 117 announced transactions. Financing activity has not kept pace: Momentum Cyber desk-calculated annualized financing rounds sit at 754, down from 820 the prior year. That split — rising M&A and cooling financing — is driven by buyers racing to add native-AI capabilities and to defend against agentic AI attack vectors. Momentum Cyber’s dataset and executive commentary are reported as first reported by Dark Reading, which relayed Eric McAlpine’s assessment of the urgency behind many of the purchases.
We have just never seen a pace like this before,
Eric McAlpine, founder and CEO, Momentum Cyber
Key takeaways
- Q3 deal count: Momentum Cyber reports 117 cybersecurity M&A transactions in Q3 2026.
- Full-year M&A trajectory: Momentum Cyber projects about 450 cybersecurity acquisitions in 2026, up from 404 in 2025.
- Financing trends: Financing is slower: annualized rounds are 754 in 2026 versus 820 in the prior year.
- AI-security spike: AI security acquisitions reached 40 in the first three quarters of 2026, versus 10 for all of 2025.
Table of contents
Volume and value: 2026 is running hotter for M&A than financing
Momentum Cyber’s Q3 numbers point to a clear divergence between deal volume and funding. The firm’s tally of 117 announced M&A transactions in Q3 puts the year on pace to reach about 450 deals, up from 404 in 2025. By contrast, the annualized figure for financing rounds sits at 754 in 2026 compared with 820 the prior year, a sign investors are writing fewer but larger checks and taking a more selective stance.
The 2025 comparator matters because that year already set records: 404 acquisitions and an aggregate spend the prior reporting pegged at $97 billion on startup purchases. Large, headline purchases have already reshaped expectations — Google’s purchase of Wiz for $32 billion in 2025 remains the market’s largest recent transaction — and smaller strategic buys this year, such as Cyera’s $1 billion acquisition of Oasis Security, are following that playbook of capability aggregation.
Why AI is compressing the cycle for buyers and builders
Dealmakers describe a new tempo in which product cycles, buying decisions and exits are accelerating because AI capabilities now act as both feature and strategic moat. Eric McAlpine, Momentum Cyber’s founder and CEO, captures the urgency: he told reporters that buyers are prioritising AI-first capability, and that many acquirers do not need a product to be fully agentic to be of interest.
Venture partner Zane Lackey of Andreessen Horowitz described the trend as multiple investment cycles packed into one, saying the pace of innovation, purchase decisions and M&A activity is "wildly compressed" compared with prior cloud cycles. That compression shows up in the surge of AI-specific security deals: Momentum Cyber has counted 40 AI-security acquisitions in the first three quarters of 2026, versus 10 for the whole of 2025, and in the rapid emergence of narrowly defined subsegments that Momentum Cyber maps across twelve sectors and 62 sub-sectors.
Market signals, stock moves and private equity behaviour
The scramble for AI capability has played alongside sharp equity moves earlier in the year that briefly unsettled the market for cybersecurity assets. Between Jan. 28 and Feb. 23, 2026, Momentum Cyber’s reporting cited steep share declines: CrowdStrike fell 26%, JFrog 42%, Tenable Holdings 20% and Zscaler 28%. Those losses mostly reversed later in the year — CrowdStrike is reported up 127% year to date, JFrog up 72% and Tenable up 68%, while Zscaler remained slightly down, off 3% since the start of 2026 — signalling investor confidence returning to parts of the sector.
Private equity behaviour also matters: McAlpine says some firms held portfolio companies through the market turbulence and that this pullback constrained the supply of assets that might otherwise have come to market. He predicted a timing shift, saying "in six months from now" private equity sellers would resume activity; that comment implies a near-term uplift in available targets for strategic buyers and PE firms alike.
| Metric | 2025 | 2026 (reported or projected) |
|---|---|---|
| Total M&A deals | 404 | about 450 (projected) |
| Q3 M&A transactions | — | 117 |
| Annualized financing rounds | 820 | 754 |
| AI-security acquisitions (period) | 10 (all of 2025) | 40 (first three quarters 2026) |
| Notable disclosed deal sizes | $97 billion total spend (2025) | Google–Wiz $32 billion (2025); Cyera–Oasis $1 billion (2026) |
How the case for and against more M&A stacks up
The case for
- Buyer urgency to add AI-native protection and to guard agentic workloads will keep strategic M&A elevated; Momentum Cyber projects roughly 450 deals in 2026.
- Hyperscalers, frontier labs and non‑traditional buyers are entering the market, increasing available strategic buyers beyond classic cybersecurity firms.
- Selective financing with larger checks could produce better‑capitalised startups that are immediate acquisition targets.
The case against
- Private equity sellers paused during early‑year volatility; Momentum Cyber and Eric McAlpine expect that withholding to delay some deals and compress supply until sellers re-enter the market.
- Equity volatility remains a wildcard after sharp moves in early 2026 that briefly depressed valuations for public cyber companies.
- A rapid incubation cycle raises integration risk as acquirers rush to combine AI features faster than they can operationalise them.
What to be careful about
- Acquirers may overpay for nascent AI capabilities whose operational value remains unproven, raising integration and write‑down risk.
- Private equity holdbacks have reduced the pool of sellable assets in 2026, which could temporarily inflate valuations for the available targets.
- Rapidly rising AI-automated attack techniques could force one-off defensive purchases that do not produce durable revenue.
The bottom line
Momentum Cyber’s Q3 numbers and executive commentary show a market reweighting: companies and non‑traditional buyers are racing to acquire AI-native security capabilities even as financing activity thins and concentrates. That mismatch is already visible in the year‑to‑date counts — 117 Q3 deals, a projected ~450 total for 2026, and 40 AI‑security acquisitions through the first three quarters versus 10 in 2025 — and it is shaping transaction strategy across strategic buyers, hyperscalers and private equity. For practitioners and observers, the practical takeaways are simple: expect continued dealmaking driven by AI feature needs, watch for supply shifts as sellers re-enter the market, and follow Momentum Cyber’s subsequent releases for refreshed counts and taxonomy updates.
What to watch
- Watch whether private‑equity portfolio company sales rebound around April 9, 2027; Eric McAlpine predicted activity would resume “in six months from now” from his Oct. 9, 2026 comments.
- Watch for Momentum Cyber’s next quarterly market review to see updated counts and methodology; no date has been set for that release.
- Watch for Momentum Cyber’s revised taxonomy that Eric McAlpine said could appear "next year" to see whether the firm collapses its categories into the proposed mega groups; no date has been set.
Frequently asked questions
How many cybersecurity M&A deals did Q3 2026 record?
Momentum Cyber reports 117 announced cybersecurity M&A transactions in Q3 2026 and projects the year could reach about 450 deals overall.
Is venture funding slowing while acquisitions rise?
Yes. Momentum Cyber’s figures show annualized financing rounds at 754 in 2026 versus 820 the prior year, while M&A volume is tracking higher than 2025 levels.
Which large acquisitions illustrate the trend?
Recent large deals cited in Momentum Cyber’s coverage include Google’s $32 billion purchase of Wiz in 2025 and Cyera’s $1 billion buy of Oasis Security in 2026; Cisco also made strategic buys of Astrix Security and WideField Security.
Related reading
