December 2025 Cyber Funding & M&A Brief
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full December 2025 dataset — every named company, round, investor, and segment.
What December told us
December 2025 closed the year with $1.96B in disclosed funding — the second-highest disclosed funding month of 2025 after April — and the consolidation crescendo this market had been building toward all year. ServiceNow acquired Armis for $7.775B and Veza for $1B — two transactions, both inside the IoT-and-identity convergence layer, both on the same buyer. ServiceNow, which had only sporadic cybersecurity M&A history before 2025, ended the year as the most expensive single acquirer of cyber assets after Palo Alto Networks.
Private funding stayed loud beneath the M&A. Saviynt closed a $700M Series B led by KKR — one of the largest Series B rounds in cybersecurity per this dataset — and Cyera added a $400M growth round led by Blackstone (its sixth appearance in this series). Combined, those two rounds carry 56% of December's disclosed capital and confirm that the most-funded private cyber vendors of the cycle are concentrated in identity (Saviynt) and data security (Cyera). Both companies are now sufficiently capitalized to either IPO in 2026–2027 or exit at strategic prices comparable to CyberArk's.
What 2025 ends having proven: the cyber market has reached a consolidation phase no previous year matches. Three megadeals (Google/Wiz $32B, Palo Alto/CyberArk $25B, ServiceNow/Armis $7.775B), four additional billion-plus M&A transactions, and the largest cumulative disclosed M&A total in this series' history. The implications for 2026 are structural: the universe of independent public cyber pure-plays is materially smaller entering 2026 than it was entering 2025, and the next wave of liquidity will have to come from either IPOs of the deeply-funded private cohort (Saviynt, Cyera, Chainguard, Vanta, ID.me) or another round of PE-driven take-privates.
Stage and segment breakdown
| Stage | Count |
|---|---|
| Seed | 11 |
| Series A | 8 |
| Series B | 4 |
| Series C | 2 |
| Series D+ | 1 |
| Growth Funding | 4 |
| Acquisition | 3 |
| Top segments | Transactions |
|---|---|
| Data | 6 |
| Vulnerability | 4 |
| Identity | 4 |
| GRC | 3 |
| Social Engineering | 2 |
| Fraud | 2 |
Two deals worth your attention
ServiceNow's $7.775B acquisition of Armis and $1B acquisition of Veza. On the same December announcement, ServiceNow agreed to acquire connected-asset cyber visibility platform Armis for $7.775B and identity-governance platform Veza for $1B. The pairing pulls two adjacent control planes — device identity and human/non-human access governance — inside ServiceNow's enterprise workflow platform simultaneously. Combined deal value: $8.775B, the third-largest cyber M&A value of 2025 after Google/Wiz and Palo Alto/CyberArk, and a clear statement that ServiceNow intends to be a top-three buyer of cyber assets going forward.
Saviynt — $700M Series B led by KKR. Saviynt closed a $700M Series B led by KKR — one of the largest Series B rounds in cybersecurity per this dataset. Saviynt's identity governance and administration platform now sits as the deepest-funded private identity vendor in the workbook outside of CyberArk (now Palo Alto). With CyberArk's exit and Veza's exit both in 2025, Saviynt becomes the de facto independent identity-platform leader entering 2026 — and a near-certain platform-acquisition target or IPO candidate.
Companies we've covered before
Armis first appeared in February 2021 with a $125M growth round in IoT, and across five appearances accumulated more than $1B in disclosed capital. The December 2025 exit to ServiceNow at $7.775B is the third-largest cybersecurity acquisition in this series' history.
Veza first appeared in April 2022 with a $110M Series C — at the time classified under Data, now under Identity as the company's product evolved. Three rounds and 44 months later, Veza exits to ServiceNow for $1B — a clean platform-consolidation arc with a visible segment reclassification along the way.
Cyera first appeared in March 2022 with a $60M growth round in Data security. Across six appearances and 45 months — including two rounds in 2024 classified under AI/LLM before reverting to Data — the December 2025 round at $400M brings cumulative disclosed capital to over $1.6B, the deepest-funded private data security vendor in the workbook.
The other 31 transactions are in the data feed — including the 3 acquisitions whose values never hit the press. Get December's details and more →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains ~2,600 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.