October 2022 Cyber Funding & M&A Brief
Published by Pinpoint Search Group — the cybersecurity executive search firm that tracks every disclosed vendor funding round and acquisition in the sector.
At a glance
Get the full October 2022 dataset — every named company, round, investor, and segment.
What October told us
October 2022 carried two more large take-privates, extending the year's M&A thread to four major public-to-private transactions across the year. Vista Equity Partners acquired KnowBe4 at $4.60B in security training, and Thoma Bravo acquired ForgeRock at $2.30B in Identity. The two transactions combined for $6.90B in disclosed October M&A, and the year-to-date cumulative across Mandiant (March), SailPoint (April), Ping Identity (August), KnowBe4 (October), and ForgeRock (October) reached roughly $22B — a structural reset of the public-cyber comp set across Identity, training, and threat intelligence inside a single calendar year.
Funding activity ran $1.69B across 35 rounds, a top-tier month behind February's $2.57B and April's $1.82B. The composition was unusual: NetSPI's $410M growth round in security training and Arctic Wolf's $401M debt facility in MSSP led the funded side, and the two rounds combined for $811M — most of the month's disclosed funding. NetSPI's training-segment round is one of the larger non-acquisition events the workbook tracks inside security training; Arctic Wolf's debt event is one of the larger debt facilities for an MDR-channel vendor.
Below the two anchor rounds, Versa at $120M debt in Network Security, Securiti at $75M Series C in Data, and Immersive Labs at $66M growth in Training rounded out the funded cohort. Seventeen of the 35 funding rounds cleared at Seed or Series A — a slightly heavier early-stage distribution than September's reading. The month also marked the Quantum segment's first appearance in the workbook taxonomy.
Stage and segment breakdown
| Stage | Count |
|---|---|
| Seed | 9 |
| Series A | 8 |
| Series B | 7 |
| Series C | 3 |
| Growth Funding | 5 |
| Debt | 3 |
| Acquisition | 6 |
| Top segments | Transactions |
|---|---|
| Training | 5 |
| AppSec | 4 |
| Identity | 4 |
| Threat Intel | 3 |
| Detection/Response | 3 |
| Network Security | 2 |
New segment in the taxonomy this month: "Quantum" enters the Pinpoint segment taxonomy for the first time in October 2022. Emergent categories are added when they first appear in vendor positioning; this is the first workbook event in this classification.
Two deals worth your attention
Vista Equity Partners' $4.60B acquisition of KnowBe4. Vista Equity Partners acquired KnowBe4 at $4.60B, the largest disclosed M&A event of October and the fourth large 2022 take-private after Mandiant (March), SailPoint (April), and Ping Identity (August). The deal returned a major security training vendor to PE ownership at a price above its prior public-market trajectory and is the largest Training-segment M&A event the workbook tracks.
Thoma Bravo's $2.30B acquisition of ForgeRock. Thoma Bravo acquired ForgeRock at $2.30B in October, adding a third 2022 pure-Identity take-private to its portfolio after SailPoint in April and Ping Identity in August. With ForgeRock, Thoma Bravo had now executed three large Identity-segment take-privates inside seven months — a concentrated pattern of buyer behavior the workbook does not have a prior parallel for inside a single segment.
Companies we've covered before
NetSPI first appeared in May 2021 with a $90M growth funding event in Training. The October 2022 $410M growth round is NetSPI's second tracked event, same segment classification, and a notable 4.5x step-up over the prior round.
Arctic Wolf first appeared in October 2020 with a $200M Series D+ in MSSP, returning in July 2021 with a $150M Series D+ in the same segment. The October 2022 $401M debt facility is Arctic Wolf's third tracked event — same segment across all three — and the first major debt event for the vendor inside the workbook.
Versa first appeared in June 2021 with an $84M Series D+ in Network Security. The October 2022 $120M debt facility is Versa's second tracked event, same segment classification, and a notable shift from equity to debt financing for a Network Security growth-stage vendor.
Immersive Labs first appeared in June 2021 with a $75M Series C in Training. The October 2022 $66M growth round is Immersive Labs's second tracked event, same segment classification, and a step-down from the 2021 round consistent with broader Training-segment growth funding compression.
The other 39 transactions are in the data feed — including the 6 acquisitions whose values never hit the press. Get October's details and more →
Methodology
Every transaction in this brief was sourced from a primary public report and dedupe-checked against the master Pinpoint funding workbook, which now contains ~2,600 transactions back to May 2020. Funding totals reflect disclosed capital only; acquisition values are included where publicly available.
Each deal is classified against Pinpoint's normalized cybersecurity segment taxonomy — read directly off what the company says they protect and mapped to one of the canonical segments. The taxonomy has been maintained continuously since 2020 and currently covers roughly 55 segments. Identity, Data, Detection / Response, and Threat Intel have been tracked from the first month of the series; AppSec and GRC entered the following month; emergent categories (AI/LLM, Supply Chain, Quantum, Browser) are added when they first appear in vendor positioning. That normalization layer is what makes multi-year, cross-segment comparisons possible against an otherwise inconsistent vocabulary in the broader market.
About Pinpoint Search Group
Cybersecurity innovators work with Pinpoint Search Group to identify, attract, and land professionals that enable maturation, scale, and successful outcomes. As start-ups continue raising millions in funding and established vendors make acquisitions to round out their offerings, Pinpoint Search Group is keeping track.
Get the underlying data
The narrative above is the free version. The paid Pinpoint Cyber Funding Data feed gives you every named transaction, every disclosed investor, every segment classification — exportable, filterable, and updated as the deals close.