Growing Threats Trigger Increases in M&A in $60 Billion Global Cyber Security Market. Cyber Security M&A Deals Exceed $22 Billion Since 2008.
Driven primarily by an increase in cyber threats, increasing awareness by organizations, and continued increases in regulation, global cyber security spending is expected to reach $60 billion in 2011, and is forecast to grow at 10 percent every year during the next three to five years. These increases are fueling growth and activity in mergers and acquisitions (M&A) in the cyber security space.
According to a report released today by PwC, merger and acquisition deal activity in the cyber security space has exceeded $22 billion globally since 2008. Driven mainly by Intel’s $7.68 billion acquisition of McAfee, which closed in February 2011, total deal value increased by over 70% in the first half of 2011 versus full year 2010.
PwC’s report, “Cyber Security M&A: Decoding deals in the global Cyber Security industry,” said the first half of 2011 brought 37 deals valued at over $10 billion, representing a 70 percent increase compared to full year 2010.
“The market is undergoing significant change in many segments and is attracting investment from many different types of companies including IT companies, defense contractors, technology businesses, professional services firms, telecommunications firms and financial investors,” Barry Jaber, PwC’s security industry leader noted in the report.
“Against the backdrop of heightened awareness of hacks and deliberate attacks on institutions by semi-organized groups, the cyber security market is undergoing significant change and attracting investment from sectors that span technology, telecommunications, defense, professional services and financial investors,” said Rob Fisher, PwC’s U.S. technology leader for transaction services.
Acquirers Paying a Premium
In terms of deal valuation multiples, the valuation multiples in cyber security deals have been high, with both mean and median deal value-to-EBITDA ratios at around 15 times from 2008 to the second half of 2011. “Deal value-to-revenue ratios were around 2-3 times over the same period. While these figures have been adjusted to omit some inflated values, they are clear indicators that acquirers are willing to pay a premium to buy cyber security companies,” the report notes.
In most regions, the private sector accounts for the majority of cyber security spending, while the U.S. is the notable exception where government spending is almost equal to the private sector. The strong U.S. technology industry combined with the fact that the U.S. defense and intelligence budgets are significantly larger than in any other country are key market drivers.
The U.S. market leads in value with the majority of deals (over 50 percent) involving acquirers or targets based in North America. Europe accounted for approximately a quarter of deal value and a third of deal volume over the same period.
“The U.S. is a unique market with significant cyber security spending in the public sector, particularly by intelligence and defense agencies,” said PwC’s Jaber.
A market research report published by INPUT in December 2010 forecasts federal investment in information security to increase to $13.3 billion by 2015 at a compound annual growth rate of 9.1 percent, nearly twice the rate of overall federal IT spending.
Driving Future Cyber Security M&A Deals
Mobile, cloud, and heightened user awareness are likely to be primary drivers of cyber security deals moving forward. Additionally, defense contractors are recognizing the need to expand their offerings, both to provide additional security services and in the development of a wide range of cyber weaponry that will be used for both offensive and defensive purposes against others’ networks and technology.
“Deal activity in cyber security is expected to continue to grow given the fragmentation of the market and the attractive growth outlook,” Jaber added. “Technology and IT companies are making acquisitions to differentiate their offerings while defense firms continue to do deals to diversify away from shrinking defense budgets.”

For more than 10 years, Mike Lennon has been closely monitoring the threat landscape and analyzing trends in the National Security and enterprise cybersecurity space. In his role at SecurityWeek, he oversees the editorial direction of the publication and is the Director of several leading security industry conferences around the world.
More from Mike Lennon
- ‘No Evidence’ of Cyberattack Related to FAA Outage, White House Says
- SecurityWeek to Host 2022 ICS Cybersecurity Conference October 24-27 in Atlanta
- Google Completes $5.4 Billion Acquisition of Mandiant
- Cybersecurity Firm ZeroFox Begins Trading on Nasdaq via SPAC Deal
- HUMAN Security and PerimeterX Merge on Mission to Combat Bots
- Last Call: CFP for ICS Cybersecurity Conference Closes July 15th
- Johnson Controls Acquires Tempered Networks to Shield Buildings From Cyberattacks
- Snowflake Launches Cybersecurity Workload to Find Threats Across Massive Data Sets
Latest News
- Malicious NPM, PyPI Packages Stealing User Information
- VMware Confirms Exploit Code Released for Critical vRealize Logging Vulnerabilities
- 98% of Firms Have a Supply Chain Relationship That Has Been Breached: Analysis
- Dutch, European Hospitals ‘Hit by Pro-Russian Hackers’
- Gem Security Gets $11 Million Seed Investment for Cloud Incident Response Platform
- Ransomware Leads to Nantucket Public Schools Shutdown
- Stop, Collaborate and Listen: Disrupting Cybercrime Networks Requires Private-Public Cooperation and Information Sharing
- Boxx Insurance Raises $14.4 Million in Series B Funding
