November 2021 Cyber Funding & M&A Brief
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full November 2021 dataset — every named company, round, investor, and segment.
What November told us
November 2021 simultaneously produced the largest cyber M&A event and the largest funded round the workbook has tracked. A private equity group's $14.00B acquisition of McAfee Consumer — the take-private of the remaining McAfee Corp following the prior March carve-out of its Enterprise business — overtook April's Proofpoint take-private ($12.30B) as the workbook's largest cyber M&A by $1.70B. In the same month, Lacework's $1.30B Series D+ in AppSec overtook October's Invicti round ($625M growth) as the workbook's largest funded round by more than 2x. Two simultaneous workbook records — one on M&A, one on funded — inside the same calendar month is a density the data set does not have a prior parallel for.
M&A breadth around McAfee Consumer ran high. OpenText acquired Zix at $860M in Email — a strategic public-cyber buyer absorbing a mid-cap email security vendor. GBG acquired Acuant at $736M in Identity, extending identity-verification consolidation that TransUnion had advanced through September and October. Schwartz Group acquired XM Cyber at $700M in Detection/Response. Four nine-figure M&A events inside one month, with cumulative disclosed value reaching roughly $16.30B across the four — the largest single-month disclosed cyber M&A value the workbook had tracked through November 2021, ahead of April's $13.27B (anchored by Proofpoint) and March's $12.32B (anchored by Auth0).
Funding activity ran $2.99B across 24 rounds — the largest disclosed funded month of 2021 through this point, overtaking October's $2.92B reading. Below Lacework, Socure raised $450M Series D+ in Identity (the company's second tracked event after a $100M Series D+ in March 2021), Armis raised $300M P/E funding in IoT (its second 2021 round after February's $125M), Contrast Security cleared $150M Series D+ in AppSec, Expel cleared $140.3M Series D+ in Detection/Response, and Drata raised $100M Series B in GRC. Three of the funded events tied to Lacework, Socure, and Armis collectively reached $2.05B — 69% of the month's disclosed funding concentrated in three companies. AppSec carried the segment count with nine November transactions across funded rounds and M&A combined, anchored by Lacework and Contrast Security on the funded side.
Stage and segment breakdown
| Stage | Count |
|---|---|
| Seed | 4 |
| Series A | 6 |
| Series B | 6 |
| Series C | 1 |
| Series D+ | 5 |
| P/E Funding | 1 |
| Acquisition | 17 |
| Top segments | Transactions |
|---|---|
| AppSec | 9 |
| Identity | 5 |
| Detection/Response | 4 |
| Data | 3 |
| Training | 3 |
| GRC | 3 |
Two deals worth your attention
Private equity group's $14.00B acquisition of McAfee Consumer. A private equity group agreed to take McAfee Consumer (the remaining McAfee Corp following the March 2021 carve-out of McAfee Enterprise to STG) private at $14.00B, the largest cyber M&A event the workbook has tracked. The deal sat $1.70B above the prior workbook M&A record (Proofpoint/Thoma Bravo at $12.30B from April 2021) and brought the year's cumulative public-cyber take-private value to roughly $26.30B across Proofpoint and McAfee Consumer combined. November's M&A column carried four nine-figure transactions in total — McAfee Consumer at $14.00B, Zix at $860M (OpenText, Email), Acuant at $736M (GBG, Identity), and XM Cyber at $700M (Schwartz Group, Detection/Response) — the largest single-month disclosed cyber M&A value the data set had tracked through this point, ahead of April's $13.27B and March's $12.32B.
Lacework — $1.30B Series D+ in AppSec. Lacework raised $1.30B Series D+ for its cloud security platform, the largest funded round the workbook has tracked. The round sat above the prior workbook funded-round record (Invicti's $625M growth from October 2021) by more than 2x. Combined with Lacework's $525M Series C from January, the company's 2021 disclosed funding reached $1.825B across two rounds — the largest single-vendor in-year disclosed funding concentration the workbook tracks through this point, well above the next-largest 2021 single-vendor totals (Orca Security at $760M, Snyk at $600M, Coalition at $585M). The round is one of the clearest signals the workbook tracks that cloud workload protection was drawing growth capital at unprecedented scale through this point.
Companies we've covered before
Lacework first appeared in January 2021 with a $525M Series C in AppSec. The November 2021 $1.30B Series D+ is Lacework's second tracked event — same segment classification, a 2.5x step-up over the prior round, ten months apart. Combined, the two 2021 Lacework rounds reached $1.825B in disclosed funding, the largest single-vendor in-year disclosed funding concentration the workbook tracks through this point.
Socure first appeared in March 2021 with a $100M Series D+ in Identity. The November 2021 $450M Series D+ is Socure's second tracked event, same segment classification, and a 4.5x step-up over the prior round.
Armis first appeared in February 2021 with a $125M funding event in IoT. The November 2021 $300M P/E funding round is Armis's second tracked event, same segment classification, and a 2.4x step-up over the prior round.
Expel first appeared in May 2020 with a $50M Series D+ in Detection/Response. The November 2021 $140.3M Series D+ is Expel's second tracked event, same segment classification, and a 2.8x step-up over the prior round across roughly 18 months.
The other 39 transactions are in the data feed — including the 17 acquisitions whose values never hit the press. Get November's details and more →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains ~2,600 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.