Acquisition tracker
All known MDR-related acquisitions and mergers from Q3 2024 through Q1 2026, listed chronologically.
| Acquirer | Target | Date | Deal type |
|---|---|---|---|
| Arctic Wolf | Cylance (from BlackBerry) | Oct 2024 | Technology acquisition |
| Quorum Cyber | Difenda | Oct 2024 | MDR roll-up |
| Cyderes | Ipseity Security | Q4 2024 | MDR roll-up |
| Lumifi | Critical Insight + Netsurion | Q4 2024 | MDR roll-up |
| Trustwave | Cybereason (merger) | Nov 2024 | MDR roll-up |
| Sophos | Secureworks | 2025 | Platform expansion |
| Zscaler | Red Canary | 2025 | Platform expansion |
| LevelBlue | Trustwave | 2025 | MDR roll-up |
| Bitdefender | Mesh Security | 2025 | Technology acquisition |
| WatchGuard | ActZero | 2025 | Platform expansion |
| Deepwatch | Dassana | 2025 | Technology acquisition |
| Integrity360 | Nclose | 2025 | MDR roll-up |
| Fortra | Lookout Cloud Security | 2025 | Platform expansion |
| Coalition | Wirespeed | Nov 2025 | Technology acquisition |
| Huntress | Inside Agent | Nov 2025 | Technology acquisition |
| LevelBlue | Alert Logic (from Fortra) | Jan 2026 | MDR roll-up |
| Arctic Wolf | Sevco Security | Feb 2026 | Technology acquisition |
| Sophos | Arco Cyber | Feb 2026 | Technology acquisition |
Know of a deal we're missing? Let us know.
Three patterns driving deals
1. Platform expansion
Platform vendors buy MDR to add managed services to their existing product suite. Zscaler acquired Red Canary to add MDR to its zero trust platform, and Sophos acquired Secureworks to build out enterprise MDR. For buyers, this usually means your MDR becomes a feature inside a larger product rather than a standalone service.
2. MDR roll-ups
MDR providers acquiring other MDR providers for scale and market share. LevelBlue is the clearest example, acquiring both Trustwave and Alert Logic to consolidate three MDR brands under one umbrella. These deals are about operational scale and customer base expansion, and the risk for customers is platform migration as the acquirer consolidates technology stacks.
3. Technology acquisition
The acquirer wants specific technology or talent rather than the customer base. Coalition acquired Wirespeed for its AI triage capabilities and Deepwatch acquired Dassana for cloud asset intelligence. These deals carry the highest risk of product discontinuation for the target's existing customers, since the acquirer may absorb the technology and sunset the standalone product.
What this means if you're buying MDR
With 600+ providers actively consolidating, a provider on your shortlist today might not exist independently in 12 months.
- Review assignment clauses that determine whether your contract can transfer to a new entity without your consent.
- Know your termination terms, notice periods and penalties before you need them.
- Check whether you can export detection rules, historical investigation data and log archives, because data portability is your main leverage during a transition.
- "What is your company's ownership structure?" and "Have you received acquisition offers?" are fair questions to ask during evaluation. The answer may reveal more than the words.
For practical advice on what to do when your provider announces an acquisition, see our guide on what happens when your MDR provider gets acquired.
FAQ
How many MDR acquisitions have happened recently?
18 MDR-related acquisitions closed between Q3 2024 and Q1 2026, including Zscaler + Red Canary, Sophos + Secureworks and LevelBlue + Trustwave + Alert Logic. The pace is accelerating.
Why is the MDR market consolidating?
Three forces: platform vendors buying MDR capability, MDR providers acquiring each other for scale and technology grabs for AI and automation. The market has more than 600 providers and natural market maturation is compressing that number.
What happens to customers when an MDR provider is acquired?
Existing contracts are usually honored through renewal, but platform migrations, team changes and pricing adjustments often follow. Review your contract's assignment and termination clauses now, before you need them.