Following the Summer months, there was a surge in cybersecurity merger and acquisition (M&A) announcements in September 2025, involving numerous high-profile vendors.
AI security was the focus of these deals, with CrowdStrike, F5, SentinelOne and Check Point seeking to expand their offerings in this space.
Another high-profile transaction was Mitsubishi Electric’s $1bn deal to buy Nozomi Networks, which will be the largest acquisition in the OT security industry upon completion.
Here is Infosecurity’s cybersecurity M&A roundup for September 2025.
Varonis Acquires AI Email Security Specialist SlashNext
Varonis announced the acquisition of AI-native email security provider SlashNext on September 2. The transaction is designed to enable Varonis to expand its data breach prevention services to customers’ emails. SlashNext’s founder, Atif Mushtaq, has joined Varonis as VP of data science following the acquisition. Varonis said it expects its revenue to be $5m higher in Q3 2025 as a result of the transaction.
Cato Networks Unveils First Ever Acquisition
SASE security firm Cato Networks announced its first ever acquisition on September 3, purchasing AI security provider Aim Security. Aim’s technologies will be incorporated into the Cato SASE Cloud Platform, assisting enterprise adoption of AI agents and public and private AI applications. The deal was unveiled as Cato revealed it had extended its Series G funding round, first announced in June 2025, with an additional $50m investment from Acrew Capital.
UltraViolet Acquires Black Duck’s Application Security Testing Business
Managed security services provider (MSSP) UltraViolet Cyber has acquired Black Duck’s Application Security Testing (AST) services business. The deal, announced on September 4, will strengthen UltraViolet’s ability to assess modern, distributed environments across multi-cloud workloads, DevSecOps pipelines and containerized deployments. The acquisition also establishes an ongoing commercial partnership between the two companies.
SentinelOne to Buy Observo AI for $225m
On September 8, SentinelOne announced its intent to acquire Observo AI. The transaction will see Observo’s AI-native telemetry pipeline management added to SentinelOne’s existing AI SIEM and data offerings. SentinelOne is expecting to pay $225m in cash and stock for Observo AI, with the transaction projected to close in SentinelOne’s third quarter of fiscal year 2026, subject to any applicable regulatory approvals.
Mitsubishi Electric Announces $1bn OT Security Deal
On September 9, Mitsubishi Electric, part of Mitsubishi Group, announced a definitive agreement to acquire Nozomi Networks for just under $1bn. This will make it the largest acquisition in the OT security industry to date. Nozomi will be a wholly owned subsidiary operating independently of Mitsubishi Electric, a manufacturer of electrical products. Mitsubishi Electric participated in Nozomi’s $100m Series E funding round, announced in March 2024, providing the foundation of this transaction, which is expected to close in the fourth quarter of 2025.
F5 to Acquire CalypsoAI for $180m
Application security specialist F5 announced its intent to acquire AI security firm CalypsoAI on September 11. CalypsoAI’s generative and agentic AI security capabilities will be integrated into the F5 Application Delivery and Security Platform (ADSP). F5 will pay $180m, primarily in cash, to acquire all issued and outstanding shares of CalypsoAI. The deal is expected to close in F5’s fourth quarter fiscal year 2025, ending September 30, 2025.
SecurityScorecard Enhances Supply Chain Risk Management Capabilities
SecurityScorecard has acquired HyperComply, AI-powered platform for security questionnaire automation and compliance management. Announced on September 15, the acquisition will see HyperComply’s capabilities combined with SecurityScorecard’s security ratings and continuous third- and fourth-party risk visibility, providing a complete picture of customers’ entire supply chain security.
DigiCert Acquires Email Authentication Provider Valimail
DigiCert announced the acquisition of zero trust email authentication solution provider Valimail on September 16. Valimail’s technology will be added to the DigiCert ONE platform, which consolidates PKI and DNS email security protocols. This is designed to further help customers stay protected against phishing, spoofing and domain-based threats.
CrowdStrike Expands AI Security Capabilities with Pangea Deal
On September 16, cybersecurity giant CrowdStrike announced the acquisition of AI security specialist Pangea for a reported $260m. The purchase of Pangea will extend the CrowdStrike Falcon platform, delivering the industry’s first complete AI Detection and Response (AIDR) service. The announcement follows a plethora of recent cybersecurity acquisition deals unveiled by CrowdStrike, including its recently announced plans to buy Onum.
Check Point to Acquire Agentic AI Security Firm Lakera
Check Point revealed on September 16 that it has entered into an agreement to acquire Lakera, one of the world’s leading AI-native security platforms for Agentic AI applications. Check Point plans to use Lakera’s tools to deliver a full end-to-end AI security stack designed to protect enterprises as they accelerate their AI journey. The transaction is expected to close in Q4 2025.
CyberBit Acquires RangeForce to Create Combined Cyber Range Platform
CyberBit announced on September 23 it had acquired RangeForce, combing two cyber range platforms for hyper-realistic attack simulation, SOC team assessment and capability-building and solo upskilling experiences. The aim is to create a single US-based organization with significant global scale.
Image credit: bluestork / Shutterstock.com