Global cyber security M&A activity declined in 2022

Cyber security merger and acquisition (M&A) deal activity was subdued in 2022 with decline more prominent in value terms. 

This is according to analyst firm GlobalData, which shared M&A deal volume was down 14.6 per cent for the year while deal value fell 56.7 per cent in comparison to 2021.

There were a total of 410 global merger and acquisition deals in the cybersecurity space during 2022, with the disclosed value of these deals standing at $48.3 billion, the analyst firm said.

Total M&A deal value remained above $100 billion in 2021, but 2022 failed to sustain that momentum.

“However, there were no deals valued more than $10 billion announced in 2022. Resultantly, there was a massive [year-on-year] drop in total deal value in 2022,” GlobalData lead analyst Aurojyoti Bose said. 

“Although overall M&A activity remained subdued for the sector, the decline is more prominent in terms of value than volume, suggesting that investors were increasingly cautious in committing to big investments amid volatile market conditions.”

M&A deal value reached an all-time high in 2018, hitting $126.7 billion, while 2021 was a record year in terms of deal volume. This was mainly due to big ticket deals such as the acquisition of McAfee for $14 billion by a consortium and Thoma Bravo’s purchase of Proofpoint for $12.3 billion. 

Kicking off 2022, Google beefed up its cyber security muscle with a US$5.4 billion acquisition of Mandiant, the company responsible for unveiling the SolarWinds attack. 

The all-cash deal, valued at US$23.00 per share, saw Mandiant's 600 security consultants and more than 300 intelligence analysts join Google Cloud as the latter looks to "advance its security" offerings.

On a local scale, during 2022 the New Zealand market saw merger and acquisition activity between Palmerston North-based MSSP Advantage and Nspire Technolgies; CyberCX made a series of acquisitions during 2022 including New Zealand MSSP Cyber Research NZ, Consegna and Tracer Cloud.

In its first acquisition in the NZ region in 11 years, Fujitsu purchased cyber security company InPhySec to strengthen its security services capabilities and provide Fujitsu’s New Zealand customers with access to specialist security consulting and managed services. 

In October, consulting firm Deloitte Australia added to its cyber security armour, purchasing Sydney-based cyber consultancy Hacktive. 

Sydney-headquartered IT services company Avocado Consulting snapped up Melbourne security specialist Cyberisk.

In July Publicly listed cyber security provider Cipherpoint acquired managed IT and security services company Excite IT for $3.25 million.

In May Orro Group acquired Brisbane-based IT services provider RIOT Solutions to further develop its cyber security and digital network capabilities. 

Brisbane-based managed service provider (MSP) Wyntec bought cyber consulting firm Layer 8 Security for an undisclosed sum, creating a wholistic end-to-end cyber security and IT services firm in April. 

In order to boost its application, security, data and artificial intelligence (AI) capabilities Canon Business Services ANZ (CBS) bought Microsoft partner Satalyst in January.