Quarterly Report, Q1 2023: Cyber Security Vendor M&A and Funding News
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full Q1 2023 dataset — every named company, round, investor, segment, and acquisition.
Highlights and Analysis
In Q1 2023, our team tracked 107 transactions, including 75 funding rounds, 31 M&A events, and 1 IPO. Disclosed funding totaled $2.88B, down 46% from the $5.30B recorded in Q1 2022, while round count contracted from 85 to 75. The quarter's sole public-market listing came from HUB Cyber Security, an Israeli data-security vendor that reached the market in March through a SPAC merger (Nasdaq: HUBC) rather than a conventional IPO. The M&A column carried the structural weight: two PE-orchestrated public-cyber take-privates anchored disclosed deal dollars and signaled continuation of the take-private dynamic that defined 2022's strategic landscape.
Late-stage capital remained available but selective. Five rounds cleared $100M — SandboxAQ ($500M Series B), Netskope ($401M growth), Wiz ($300M Series D+), Saviynt ($205M growth), and deepwatch ($180M growth) — followed by Ledger ($108M Series C), Socure ($95M), and Chain Reaction ($70M Series C). Early-stage activity drove the majority of transaction volume, with 44 of the 75 funding rounds at Seed or Series A.
The M&A column included 31 acquisitions, of which six disclosed prices totaling $3.29B. Francisco Partners' $1.7B take-private of Sumo Logic and Thoma Bravo's $1.34B take-private of Magnet Forensics together accounted for roughly 92% of disclosed M&A capital and continued the multi-quarter pattern of PE sponsors absorbing mid-cap public cyber and forensics vendors.
Funding Overview
The 75 funding rounds tracked in Q1 2023 highlight a market in which late-stage capital remained available for category leaders while early-stage formation continued at a steady pace.
Capital concentration at the top was pronounced. Five rounds cleared $100M: SandboxAQ ($500M), Netskope ($401M), Wiz ($300M), Saviynt ($205M), and deepwatch ($180M). Below that band, growth-stage activity stayed steady across Ledger ($108M), Socure ($95M), Chain Reaction ($70M), Hack The Box ($55M), Cygnvs ($55M), Descope ($53M Seed), Forward Networks ($50M), Skybox Security ($50M), and a long tail of $25–$45M Seed and Series A rounds. The disclosed top five together accounted for roughly half of total funding.
What stands out in Q1 2023 is where that capital is clustering. A meaningful portion of investment is concentrating around:
- Identity and access infrastructure, which led the segment mix with 18 transactions, anchored by Saviynt's $205M growth round and Descope's $53M Seed, reflecting continued enterprise demand across identity governance and authentication
- Quantum and post-quantum cryptography, where SandboxAQ's $500M Series B — the quarter's largest disclosed funding round — marked the first late-stage cyber round above $400M tied to quantum-resistant cryptographic infrastructure
- SASE and cloud-native network security, where Netskope's $401M growth round and Forward Networks' $50M Series D+ reinforce that converged network security and SASE platforms continue to attract late-stage capital
- Cloud security and CNAPP, where Wiz's $300M Series D+ extended its late-stage trajectory and underscored cloud-native application protection as a contested late-stage category
This distribution reflects a market in which late-stage capital is concentrating on platform leaders across identity, network security, and cloud, while early-stage formation continues to broaden across emerging segments such as quantum-resistant cryptography.
Market & Macro Signals
Several structural dynamics are visible in the Q1 2023 transaction record.
First, PE-led take-private activity returned to the M&A column at scale. Francisco Partners' $1.7B take-private of Sumo Logic and Thoma Bravo's $1.34B take-private of Magnet Forensics together totaled $3.04B — more than the quarter's disclosed funding from venture sources. The combination signals that PE appetite for mature mid-cap public cyber and forensics vendors continues to operate as a parallel acquisition channel to strategic-platform consolidation.
Second, funding contracted year-over-year while round count held within range. Disclosed funding of $2.88B sits 46% below Q1 2022's $5.30B, while round count moved from 85 to 75. The shift reflects a smaller late-stage top end rather than a collapse of early-stage formation — 44 of 75 rounds were Seed or Series A, broadly consistent with the prior quarter.
Third, strategic tuck-in M&A continued at high volume. Thirty-one acquisitions cleared the workbook this quarter. Disclosed prices stayed concentrated in the two PE take-privates, while the remaining 25 undisclosed deals included strategic moves by Cisco (Valtix, Lightspin), Rapid7 (Minerva Labs), HPE (Axis Security), Mastercard (Baffin Bay Networks), Zscaler (Canonic Security), and Vanta (Trustpage). The pattern signals continued platform-building across network security, AppSec, identity, and ratings.
Finally, MSSP roll-ups picked up at meaningful pace. Nine of the quarter's M&A transactions involved MSSP or managed-security targets, including three Abacus Group acquisitions (Gotham Security, GoVanguard) and additional consolidation across mid-market service providers. The pattern reflects continued buyer-side appetite for managed-security delivery capacity.
M&A Activity & Strategic Movement
Q1 2023 recorded 31 M&A transactions, with disclosed-deal dollars concentrated heavily in two PE-orchestrated public-cyber take-privates. The most notable transaction was Francisco Partners' $1.7B take-private of Sumo Logic, the quarter's largest deal and an extension of the multi-year PE take-private dynamic into the observability-and-SIEM cohort.
Additional activity across the quarter reinforces this direction:
- Thoma Bravo completed the $1.34B take-private of Magnet Forensics, returning the digital-forensics vendor to private ownership and extending PE-sponsored consolidation into the forensics tier
- Cisco acquired Lightspin ($200M) and Valtix (undisclosed), extending platform reach across cloud-native AppSec and multi-cloud network security
- Rapid7 acquired Minerva Labs ($38M), adding endpoint anti-evasion capabilities to its detection-and-response platform
- HPE, Mastercard, Zscaler, Proofpoint, and Vanta each completed targeted acquisitions (Axis Security, Baffin Bay Networks, Canonic Security, undisclosed activity, and Trustpage respectively) without disclosed pricing, signaling continued platform-building across SASE, threat intelligence, SaaS security, and trust-ratings
- Abacus Group, RealDefense, ProArch, and Esprinet completed multi-target MSSP and consumer-security consolidation (Gotham Security, GoVanguard, SUPERAntiSpyware, Trum, Lidera Network) reflecting continued mid-market service-provider roll-up activity
Across these transactions, the structural pattern is clear: PE-orchestrated take-privates absorbed the majority of disclosed deal value, while strategic platform acquirers continued targeted capability tuck-ins at smaller and largely undisclosed price points. Identity, AppSec, network security, and MSSP delivery were the most active consolidation categories.
Looking Ahead
Q1 2023 sets a measured tone for the year ahead: PE-led take-private activity continues to operate alongside strategic platform consolidation, late-stage capital is available but selective, and early-stage formation remains broad across identity, AppSec, and emerging cryptographic categories.
We expect the following dynamics to continue through 2023:
- PE-led take-private activity will continue testing the public cyber cohort, particularly for mid-cap vendors with durable cash flow and clear platform positioning
- Strategic tuck-in M&A will continue at sustained pace, as platform vendors absorb adjacent capabilities across network security, AppSec, identity, and detection/response
- Late-stage capital will favor category leaders with measurable enterprise traction, while early-stage formation continues to broaden across identity, AppSec, and emerging segments such as quantum-resistant cryptography
From a go-to-market perspective, the quarter's pattern is consistent with the broader cyber capital cycle: PE sponsors and strategic acquirers are both operating actively, late-stage capital favors clear category leadership over diffuse exposure, and early-stage formation continues across both established and emerging segments. The interplay between PE-orchestrated take-private activity, strategic-platform consolidation, and disciplined late-stage venture capital will continue to shape both funding outcomes and competitive positioning across the cybersecurity ecosystem.
The full Q1 2023 dataset — every named company, round, investor, segment, and acquisition — is in the data feed. Get the full Q1 2023 dataset →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains ~2,600 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.