Quarterly Report, Q1 2024: Cyber Security Vendor M&A and Funding News
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full Q1 2024 dataset — every named company, round, investor, segment, and acquisition.
Highlights and Analysis
In Q1 2024, our team tracked 101 transactions, including 78 funding rounds and 23 M&A events. Disclosed funding totaled $2.31B, down 20% from the $2.88B recorded in Q1 2023, while round count held effectively steady (78 vs. 75). The quarter recorded no cyber IPOs and no single funding round or acquisition cleared the $500M mark — the headline pattern is selective late-stage capital paired with a high volume of mid-market strategic tuck-ins.
Early-stage activity drove the majority of transaction volume: 50 of the 78 funding rounds were Seed or Series A, a 64% share that signals continued company formation across emerging categories. Capital concentration at the top was modest, with eight rounds clearing $100M — Cyera ($300M growth), Axonius ($200M Series D+), Silverfort ($116M Series D+), Bugcrowd ($102M growth), Extrahop ($100M growth), Coro ($100M Series D+), Claroty ($100M growth), and Nozomi Networks ($100M Series D+). No round exceeded $300M.
The M&A column carried the quarter's strategic weight in volume rather than price. Twenty-three acquisitions cleared the workbook, of which six disclosed prices totaling $1.37B. The disclosed top tier — Haveli Investments' $350M take-private of ZeroFox, Wiz's $350M acquisition of Gem Security, Zscaler's $350M purchase of Avalor, CrowdStrike's $200M acquisition of Flow Security, and SentinelOne's $100M acquisition of PingSafe — points to broadening platform consolidation rather than category-defining deals.
Funding Overview
The 78 funding rounds tracked in Q1 2024 highlight a market in which early-stage formation continued at scale while late-stage capital remained selective and modest in dollar terms.
Capital concentration at the top of the market was even. Eight rounds cleared $100M — Cyera ($300M), Axonius ($200M), Silverfort ($116M), Bugcrowd ($102M), Extrahop ($100M), Coro ($100M), Claroty ($100M), and Nozomi ($100M). Below that band, growth-stage activity remained steady across SpyCloud ($110M), Wiz follow-on activity, Aembit ($25M Series A), Cyera's earlier $100M follow-on, and a long tail of $25–$60M Seed and Series A rounds. No round in the quarter exceeded $300M, and the disclosed top eight together accounted for roughly half of total disclosed funding.
What stands out in Q1 2024 is where that capital is clustering. A meaningful portion of investment is concentrating around:
- Data security and AI-aligned data tooling, where Cyera's $300M growth round leads the segment mix (15 transactions), reflecting growing enterprise demand for data-layer visibility and AI-aware data controls
- Identity and access infrastructure, which accounted for 11 transactions including Silverfort's $116M Series D+ and continued early-stage formation across the identity stack
- Operational technology and industrial control, where Claroty's $100M growth round and Nozomi Networks' $100M Series D+ — both closed in March — signal that late-stage capital is returning to OT/ICS after a multi-quarter pause
- Vulnerability and exposure management, where Axonius' $200M Series D+, Bugcrowd's $102M growth round, and a tail of vulnerability-management vendors reflect persistent buyer demand for asset visibility and continuous-control workflows
This distribution reflects a market in which capital is moving toward categories with clear enterprise demand signals — data, identity, OT, and vulnerability — rather than spreading broadly across emerging themes.
Market & Macro Signals
Several structural dynamics are visible in the Q1 2024 transaction record.
First, funding contracted year-over-year while round count held steady. Disclosed funding of $2.31B sits 20% below Q1 2023's $2.88B, while round count moved modestly higher (78 vs. 75). The shift reflects smaller average round size at the late end rather than reduced formation activity at the early end.
Second, strategic tuck-in M&A continued at high volume. Twenty-three acquisitions cleared the workbook, the broadest M&A count of any Q1 to this point. Disclosed prices stayed modest — only six deals carried disclosed values and none exceeded $350M — but the pattern signals that platform consolidators are pursuing targeted capability expansion at sustained pace.
Third, AI-aligned security entered the strategic-acquirer column. Three of the quarter's M&A deals targeted dedicated AI-security capabilities — CrowdStrike's $200M acquisition of Flow Security (data security with AI-detection capabilities), Protect AI's acquisition of Laiyer AI (LLM security), and Synopsys' acquisition of Intrinsic ID (silicon-layer identity for AI workloads). The pattern signals early platform interest in AI-defense tooling.
Finally, undisclosed M&A continued to do significant work. Of the 23 acquisitions, 17 came without disclosed prices, including recognizable strategic moves by Snyk (Helios), 1Password (Kolide), Mimecast (Elevate Security), Delinea (Authomize, Fastpath), Dynatrace (Runecast), SonicWall (Banyan Security), and Notion (Skiff). The breadth of acquirer activity signals continued platform-building across AppSec, identity, AGAS, and data security.
M&A Activity & Strategic Movement
Q1 2024 recorded 23 M&A transactions, with strategic activity distributed across data security, identity, AppSec, and detection/response. The most notable disclosed transaction was Haveli Investments' $350M take-private of ZeroFox, the quarter's largest deal alongside two equally-sized strategic acquisitions in the same price band.
Additional activity across the quarter reinforces this direction:
- Wiz acquired Gem Security ($350M), adding cloud detection and response capabilities to its CNAPP platform
- Zscaler acquired Avalor ($350M), deepening data-security and unified vulnerability management
- CrowdStrike acquired Flow Security ($200M), extending Falcon coverage into runtime data-layer protection
- SentinelOne acquired PingSafe ($100M), adding cloud-native application protection to the Singularity platform
- Snyk, 1Password, Mimecast, Delinea, Dynatrace, SonicWall, and Synopsys each completed targeted acquisitions (Helios, Kolide, Elevate Security, Authomize/Fastpath, Runecast, Banyan Security, and Intrinsic ID respectively) without disclosed pricing, signaling continued platform-building across AppSec, identity, GRC, and firmware security
Across these transactions, the pattern is consistent: acquirers are pursuing targeted capability expansion aligned with platform coherence rather than broad roll-ups. Data security, identity, and AI-aligned tooling stand out as the categories where strategic consolidation activity is concentrating.
Beyond these tracked transactions, Cisco's $28B acquisition of Splunk closed in March 2024 — accounted for in the Q3 2023 workbook column at announce — extending strategic platform consolidation across SIEM and observability into the new year.
Looking Ahead
Q1 2024 sets a measured tone for the year ahead: capital is available but selective at the late end, while strategic tuck-in M&A continues at sustained pace across platform-adjacent categories.
We expect the following dynamics to continue through 2024:
- Late-stage capital will remain selective, concentrating on vendors with demonstrable enterprise traction and clear category positioning rather than diffuse thematic exposure
- Strategic tuck-in M&A will continue at high volume, as platform vendors absorb adjacent capabilities across data, identity, and detection/response — particularly where AI-aligned tooling intersects existing control surfaces
- Early-stage formation will continue broadening, particularly in categories tied to data security, OT/ICS, and emerging AI-defense use cases
From a go-to-market perspective, the implications are clear. Vendors entering growth stages will need to demonstrate measurable enterprise traction and a coherent platform thesis to compete for late-stage capital or strategic attention. The interplay between selective capital deployment, sustained strategic consolidation, and broadening early-stage formation will continue to shape both funding outcomes and competitive positioning across the cybersecurity ecosystem.
The full Q1 2024 dataset — every named company, round, investor, segment, and acquisition — is in the data feed. Get the full Q1 2024 dataset →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains ~2,600 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.