AI security acquisitions: who bought whom
Many of the independent AI security startups of 2024 and 2025 now belong to platform vendors. This ledger lists 17 deals by 15 buyers, 15 of them completed. Each row links the release or filing that says so. Two deals are pending, both with CrowdStrike, with closing expected in its fourth quarter of fiscal 2027.
The ledger
Checked 11 Nov 2026| Target | Buyer | Status | Announced | Closed | Detail | Source |
|---|---|---|---|---|---|---|
| Dreadnode | CrowdStrike | Pending | 3 Nov 2026 | Not yet | Expected to close in CrowdStrike Q4 FY27, subject to closing conditions. | CrowdStrike press release |
| Fiddler AI | CrowdStrike | Pending | 3 Nov 2026 | Not yet | Definitive agreement signed. Expected to close in CrowdStrike Q4 FY27, subject to closing conditions. | CrowdStrike investor release |
| Virtue AI | Fortinet | Completed | 17 Aug 2026 | 17 Aug 2026 | Announced as acquired. | Help Net Security |
| TrojAI | A10 Networks | Completed | 15 Jun 2026 | 15 Jun 2026 | Closing date from A10’s Q2 2026 10-Q. | A10 Networks Q2 2026 10-Q |
| Wiz | Completed | 18 Mar 2025 | 11 Mar 2026 | Wiz keeps its brand. | SecurityWeek | |
| Promptfoo | OpenAI | Completed | 9 Mar 2026 | — | Promptfoo states it is now part of OpenAI; no closing date published. Open-source tools continue. | Promptfoo about page |
| Acuvity | Proofpoint | Completed | 12 Feb 2026 | 12 Feb 2026 | Announced as acquired. | Proofpoint press release |
| SPLX | Zscaler | Completed | 3 Nov 2025 | 3 Nov 2025 | Announced as acquired. | Zscaler press release |
| Lakera | Check Point | Completed | 16 Sep 2025 | 22 Oct 2025 | Closing date from Check Point’s Q3 2025 results. | Check Point Q3 2025 results |
| Pangea | CrowdStrike | Completed | 16 Sep 2025 | 26 Sep 2025 | AI detection and response for the Falcon platform. Closing date from CrowdStrike’s 10-K. | CrowdStrike FY2026 10-K, Note 12 |
| CalypsoAI | F5 | Completed | 11 Sep 2025 | 26 Sep 2025 | Now sold as F5 AI Guardrails and F5 AI Red Team. Closing date from F5’s FY2025 10-K. | F5 FY2025 10-K, Note 3 |
| Prompt Security | SentinelOne | Completed | 5 Aug 2025 | 5 Sep 2025 | Built into the SentinelOne Singularity Platform. Closing date from SentinelOne’s 10-Q. | SentinelOne 10-Q, Note 4 |
| Aim Security | Cato Networks | Completed | 3 Sep 2025 | 3 Sep 2025 | Announced as acquired. | Cato Networks news |
| Protect AI | Palo Alto Networks | Completed | 28 Apr 2025 | 22 Jul 2025 | Capabilities contribute to Prisma AIRS. | Palo Alto Networks press release |
| Invariant Labs | Snyk | Completed | 24 Jun 2025 | 24 Jun 2025 | Announced as acquired. | Snyk news |
| Aporia | Coralogix | Completed | 23 Dec 2024 | 23 Dec 2024 | Announced as acquired. | Coralogix blog |
| Robust Intelligence | Cisco | Completed | 26 Aug 2024 | 24 Sep 2024 | Cisco blog (updated on completion) |
Announced is the date of the first release. Closed is the closing date the buyer states in a release or SEC filing; deals announced as already done close on the announcement date. Targets with their own row in the main table link to it; buyers link to the row that carries the acquired capability.
What a deal means for your shortlist
- The product may move to a platform contract. Protect AI, Lakera, Robust Intelligence, Prompt Security, CalypsoAI and SPLX are sold today inside Prisma AIRS, Check Point AI Security, Cisco AI Defense, SentinelOne, F5 AI Guardrails and Zscaler AI Security.
- Ask about standalone licences. Whether the startup's product still sells without the parent's platform is a question for the vendor in writing.
- Pending deals can change roadmaps. Dreadnode and Fiddler are not yet part of CrowdStrike; each sale is subject to closing conditions.