Security vendors have spent the past year buying one another at a pace that would make a Gilded Age railway baron ask for a moment. Here is what the year’s biggest cyber security acquisitions did to share prices and licence bills, and whether each makes sense. Cisco and Splunk get the long treatment, because every conference bar has an opinion on it.
Status: correct as at 24 October 2026. Share prices are daily closing prices on the dates given, adjusted for later stock splits, each linked to its source. Cyber-Threat.net has not tested any of the products mentioned. This is not investment advice: we review security products, not stocks, and nothing here is a recommendation to buy or sell either.
The scorecard
| Acquirer | Target | Price | Date | Status | Share-price reaction | Licensing impact | Verdict |
|---|---|---|---|---|---|---|---|
| Wiz | $32bn cash | 18 Mar 2025 | Closed 11 Mar 2026 | Alphabet −2.2% to $160.67 on the day; $320.21 on 23 Oct 2026 | Still multicloud and sold through marketplaces; no forced bundle announced | Makes sense | |
| Palo Alto Networks | CyberArk | ~$25bn cash and stock | 30 Jul 2025 | Closed 11 Feb 2026 | −5.6% to $183.03; $380.55 on 23 Oct 2026 | Rebranded Idira; some upgrades free, agentic and machine identity cost extra | Makes sense |
| ServiceNow | Armis | $7.75bn cash | 23 Dec 2025 | Closed 20 Apr 2026 | −11.5% to $153.04 (split-adjusted) on deal reports (15 Dec 2025); $158.96 on 23 Oct 2026, about 8% below that pre-report level on 23 Oct 2026 | Armis Centrix still sold standalone | Jury’s out |
| Proofpoint (Thoma Bravo) | Varonis | $6.3bn; $49.75 a share cash | 15 Oct 2026 | Pending; H1 2027 | Varonis +2.9% to $48.72 next day; $48.88 on 23 Oct | Nothing announced | Makes sense, at a price |
| Accenture | Dragos (majority), runZero, NetRise | $4.175bn combined | 18 Jun 2026 | Closed Jul–Sep 2026 | −18% to $127.98, a fall Reuters put down to a forecast cut; $249.37 on 23 Oct | Dragos stays independent and vendor-neutral | Jury’s out |
| IonQ | Elisity | Up to $1.3bn in stock | 12 Oct 2026 | Pending; Q4 2026 | −9.1% to $36.27 on the day; $31.27 on 23 Oct | Nothing announced | Doesn’t add up |
| Cisco | Splunk | $28bn; $157 a share cash | 21 Sep 2023 | Closed 18 Mar 2024 | −3.9% to $53.34; $106.50 on 23 Oct 2026 | Price parity promised; to be excluded from Cisco’s planned November 2026 rises | Jury’s out |
| Broadcom | VMware | $69bn | Closed 22 Nov 2023 | Closed | $97.20 at close, split-adjusted ($972.00 before the 2024 split); $321.68 on 23 Oct 2026 | Perpetual licences ended; bundles introduced. CISPE alleges cost rises of “more than 1,000 percent”; Broadcom disputes this. | Makes sense for Broadcom; doesn’t add up for customers |
| Unknown buyer | Gigamon | “More than $2bn” | Reuters, 7 Oct 2026 | Rumour | Private | Unknown | Too early |
| OpenAI | Trail of Bits | Not reported | The Information, 13 Oct 2026 | Rumour | Private | Unknown | Too early |
Cisco and Splunk: the cautionary tale, checked against the evidence
The case against the deal is easily stated. Cisco paid $157 a share, about $28bn in cash, for a SIEM and observability vendor whose customers were already grumbling about ingest-based bills. Cisco’s shares fell from $55.50 to $53.34 on the announcement, and a 2023 ETR survey of 64 large joint customers found 22% likely to look for alternatives. Cisco now carries $59.5bn of goodwill on its balance sheet, a figure nobody books out of modesty.
Now the evidence. On share price, the bear case has aged badly. Cisco closed at $49.27 on completion day and at $106.50 on 23 October 2026, after a record peak in May. That is more than double. But Splunk did not do the doubling. Fiscal 2026 revenue rose 12% to $63.3bn, carried by AI networking; security grew about 2%, to $8.23bn, and observability 4%, to $1.1bn (Cisco, 12 August 2026). Cisco itself said a 14% fourth quarter in security had “a little bit of anomaly” in it, helped by large on-premises deals, and guided to high single-digit growth for fiscal 2027. Splunk’s move to cloud has been a drag on revenue, because customers chose cloud faster than Cisco planned.
On licensing, Cisco has done the opposite of what the cynics expected. Splunk promised “net price parity” through the transition. When Cisco told partners it would raise list prices on networking and security software by a mid-single-digit average from 7 November, CRN reported on 24 October that “Splunk technology will be excluded”. Splunk has added activity-based pricing for its Machine Data Lake alongside ingest and workload models, and showcased it at .conf26. Analysts quoted by TechTarget (18 September 2026) said customers still worry about costs, which is the natural resting state of a Splunk customer.
On churn, nobody publishes hard numbers. Rivals say they are winning SIEM displacements (CrowdStrike, via CRN). Cisco says Splunk beat its target of 1,000 new customers in fiscal 2026 and had more competitive wins in the fourth quarter than in any other quarter of the year (earnings call, August 2026). Integration is real but unhurried. Cisco XDR and Splunk Enterprise Security were wired into a closed loop for the SOC Cisco ran at Cisco Live EMEA 2026, two years after closing.
Verdict: Jury’s out. The deal has not hurt Cisco shareholders, customers have not suffered a price shock, and Splunk is still winning business. Nor has it done what $28bn was meant to do, which is turn Cisco into a fast-growing security company. “Bad idea” overstates it. “Expensive idea, still paying off slowly” is closer to the evidence.
Broadcom and VMware: what a licensing shock looks like
For contrast, consider the deal where licensing changed most. After closing VMware for $69bn on 22 November 2023, Broadcom ended perpetual licences and moved customers onto subscription bundles. The European cloud trade body CISPE filed an EU competition complaint on 19 March 2026, saying Broadcom had signalled in January the end of its VMware cloud provider programme in Europe, and that price rises, bundling and minimum commitments “cumulatively have increased costs by more than 1,000 percent”. Broadcom said it “strongly disagrees” with the allegations, which it said “misrepresent the realities of the market”, and called CISPE “an organization funded by hyperscalers” (CRN; Ars Technica).
Shareholders have had a rather better time. Broadcom closed at $97.20 on completion day on a split-adjusted basis ($972.00 before its
The two giants: Wiz and CyberArk
Google and Wiz. Alphabet fell 2.2% to $160.67 on the day of the announcement, in a weak market. It closed at $308.70 on completion day and $320.21 on 23 October 2026. At Alphabet’s size, $32bn moves the share price about as much as a rounding error. Customers feared Wiz would become a Google Cloud upsell. So far, no: Wiz’s chief executive wrote on 29 July 2026 that Wiz remains multicloud, with marketplace buying and 300 integrations. Pricing is still by quote. Makes sense: Google bought the leading product in a category it lacked and, for now, has left it alone.
Palo Alto Networks and CyberArk. The market hated this one: shares fell 5.6% on 30 July 2025, the day after a 5% fall on the reports, and Reuters Breakingviews said it “burns value for tech cred“. Since then the stock has gone from $165.51 on the eve of completion to $380.55 on 23 October 2026, helped this week by a sector-wide rally. Former CyberArk holders who kept their 2.2005 Palo Alto shares plus $45 per share hold roughly $882 of value, against a pre-deal CyberArk price of $378.72 (our arithmetic). The bill is dilution: Palo Alto guided to about 11% more diluted shares this fiscal year (Yahoo Finance, 23 October 2026). CyberArk’s SaaS products now sell as Idira. For existing customers, modern PAM gets zero standing privilege at no extra cost, while traditional PAM customers must buy additional licences for it and for agentic identity protection. An upsell ladder, not a price shock. Arora has called making it work “existential for me“. Makes sense, so far.
The rest of the year’s cheques
ServiceNow and Armis. Shares fell 11.5% on 15 December 2025 on reports of the deal, to $153.04 on today’s split-adjusted basis ($765.20 before the five-for-one split), from $173.01 before the reports. The stock closed at $158.96 on 23 October 2026, having closed at $99.72 on completion day, amid a wider software sell-off. Armis Centrix remains available standalone. Jury’s out: the logic of putting asset data into the workflow engine is sound, but $7.75bn of debt and cash buys a lot of patience.
Proofpoint and Varonis. This is a rumour that came true. Bloomberg reported on 23 June that Varonis was weighing a sale, and the stock rose 7.1% to $35.03. Reuters reported talks on 2 September, and the shares rose 10.4%. The $49.75 offer is a 52% premium to the pre-rumour close and 53 times trailing free cash flow, on Proofpoint’s own figures. Nothing has been announced on pricing. Varonis customers part-way through its SaaS migration should get renewal terms in writing before the deal closes. That is our standard advice for any acquisition, not a reaction to anything Proofpoint has said. Makes sense, at a price.
Accenture and Dragos. Accenture is taking a majority stake in Dragos, which in turn bought runZero and NetRise. Accenture fell 18% on 18 June, a fall Reuters attributed to a weak forecast rather than the $4.175bn deal announced the same morning, so the share price says little about the acquisition either way. Dragos is to stay independent and vendor-neutral. Jury’s out, because a consultancy that owns the OT tool it may recommend has to prove that neutrality.
IonQ and Elisity. A quantum computing company is buying a microsegmentation vendor, all in stock, on the theory that “Q-Day is coming much faster than predicted“. IonQ fell 9.1% on the day and closed at $31.27 on 23 October, below the deal’s $33.07 floor. The share count is set by IonQ’s 20-day average price before closing and stops rising at that floor, so if the shares stay down, Elisity’s holders will receive less than the headline value, which itself includes a $150m earnout. Doesn’t add up: the two products share a slide deck more convincingly than a roadmap.
Predicted deals: rumours, labelled
- Gigamon (rumour, Reuters). Elliott and Siris are exploring a sale that could value it at more than $2bn, Reuters reported on 7 October 2026, citing people familiar with the matter. The process is early.
- OpenAI and Trail of Bits (rumour, The Information). Early talks, The Information reported on 13 October (via TNW); no price, and the talks could fail.
- More large deals at Palo Alto (speculation, ours). Arora said success with CyberArk would give him “the license” for more large acquisitions. Nobody has named a target.
What buyers should do
If a vendor you rely on is being acquired, ask for renewal caps, price protection and the right to keep your current SKUs before the deal closes. Read the acquirer’s licensing FAQ, not the press release. And note that the two deals most often cited as warnings went opposite ways: Cisco held Splunk prices, while Broadcom rewrote VMware’s licensing from top to bottom. The acquirer’s habits predict your bill better than the size of the cheque does.
Share prices are closing prices on the dates stated, and past moves say nothing about future ones. Cyber-Threat.net has not tested the products named and this is not investment advice. Nothing here is a recommendation to buy, sell or hold any security.