Security firms pursue acquisitions to manage proliferation of AI agents
Cybersecurity providers are acquiring startups to gain control over AI agents, which are increasingly appearing on corporate networks without security team oversight.
Large security firms are actively acquiring startups to address the challenge of identifying and securing AI agents within enterprise environments. As AI tools proliferate, organizations are reporting thousands of unauthorized agents connecting to corporate systems using service accounts and security tokens.
Since the start of the year, major vendors including CrowdStrike, Cisco, and SailPoint have acquired nine startups specializing in machine and agent identity security. Companies are prioritizing acquisitions over internal development to accelerate their product roadmaps, despite paying high premiums for firms with relatively low annual recurring revenue.
CB Insights reports that acquirers are currently paying a median of roughly 5x the total funding of their targets. As consolidation continues, industry analysts suggest that firms like Aembit, Token Security, Defakto, and Keycard remain primary candidates for future acquisition based on their current funding status and specialized technology.
While the sector experiences rapid M&A activity, major identity management firms and security incumbents continue to search for capabilities that provide real-time access control and automated discovery. Market participants expect further deals as firms attempt to govern the growing volume of non-human identities operating on enterprise networks.