cybersecdirectory

GRC acquisitions and funding

84 acquisitions of GRC vendors since 2020 and 146 funding rounds since 2022 on record. The most active buyers are Pathlock (3), Riskonnect (2) and Zyston (2). See the GRC vendors in the directory.

84acquisitions
$750mpaid in the 7 acquisitions with a disclosed price
Browse other categories

Showing 1 to 50 of 84

DateDealAmountSource
August 2026Athena Agentic acquired MaxxsureCyber risk quantification and cyber insurance analytics platform scoring organisational riskUndisclosedReportvia SecurityWeek
June 2026Brightline Technologies acquired Security VitalsProvides cybersecurity and CMMC compliance services for defence contractorsUndisclosedReportvia SecurityWeek
May 2026Integritis acquired JS Information GovernanceData protection, information governance and regulatory consultancy for scaling UK businessesUndisclosedReportvia SecurityWeek
April 2026VerifyVASP acquired SygnaTravel Rule compliance network for virtual asset service providersUndisclosedReportvia SecurityWeek
April 2026Fortreum acquired Kovr.AIProvides a compliance platform for US defence and national securityUndisclosedReportvia SecurityWeek
March 2026Michael Hebert (via Turtle Island Technology Solutions) acquired Castellan Information Security ServicesDelivers governance, risk, compliance and preparedness advisory services across CanadaUndisclosedReportvia SecurityWeek
March 2026Koniag Cyber acquired SoundWay ConsultingProvides CMMC compliance services for defence contractorsUndisclosedReportvia SecurityWeek
January 2026Wolters Kluwer acquired StandardFusionUndisclosedReportvia SecurityWeek
January 2026Usercentrics acquired MCP ManagerGovernance platform for the Model Context Protocol used in AI workflowsUndisclosedReportvia SecurityWeek
January 2026TechnoMile acquired SIMS SoftwareIndustrial security software supporting compliance with regulatory and audit requirementsUndisclosedReportvia SecurityWeek
December 2025ID-Pal acquired NorthRowKnow your business checks and anti-money laundering compliance intelligenceUndisclosedReportvia SecurityWeek
November 2025MorganFranklin Cyber acquired Lynx Technology PartnersProvides cybersecurity and risk management services to organisationsUndisclosedReportvia SecurityWeek
October 2025Riveron acquired Eden DataAustin advisory firm with cybersecurity and governance risk compliance expertiseUndisclosedReportvia SecurityWeek
September 2025SecurityScorecard acquired HyperComplyUses artificial intelligence to handle security forms and rule keepingUndisclosedReportvia SecurityWeek
September 2025Axiom GRC acquired The DPO CentreProvides data protection officer and privacy compliance servicesUndisclosedReportvia SecurityWeek
August 2025Red Helix acquired Risk CrewProvides information security governance risk compliance consultancy and penetration testingUndisclosedReportvia SecurityWeek
August 2025Diginex acquired FindingsCybersecurity and compliance automation company$305mReportvia SecurityWeek
August 2025Continuous acquired SycorrProvides security and compliance services for financial institutionsUndisclosedReportvia SecurityWeek
July 2025Bureau Veritas Cybersecurity acquired Institute For Cyber Risk (IFCR)Danish firm specialising in governance, risk, compliance, offensive security and trainingUndisclosedReportvia SecurityWeek
June 2025Cytracom acquired TentaclePlatform for cybersecurity assessments, third-party risk and GRC programmesUndisclosedReportvia SecurityWeek
May 2025Tyto Athene acquired StackArmorFedRAMP, FISMA and CMMC compliance acceleration with cloud security automationUndisclosedReportvia SecurityWeek
May 2025SurgeONE.ai acquired MGL ConsultingCompliance services for broker-dealers, advisers and commodities firmsUndisclosedReportvia SecurityWeek
May 2025Scytale acquired AudITechCompliance and trust automation softwareUndisclosedReportvia SecurityWeek
May 2025Proofpoint acquired NucleiCompliance archiving and AI data enrichment for workplace communicationsUndisclosedReportvia SecurityWeek
February 2025Drata acquired SafeBaseProvides a trust center platform for security reviews$250mReportvia SecurityWeek
January 2025Case IQ acquired LextegrityProvides compliance analytics and automation software for monitoring fraud and corruptionUndisclosedReportvia SecurityWeek
November 2024Health Catalyst acquired Intraprise HealthCybersecurity risk management platform and services for healthcareUndisclosedReportvia SecurityWeek
October 2024RKON Technologies acquired Bridge Security AdvisorsSpecialises in cloud security, governance risk compliance and identity access managementUndisclosedReportvia SecurityWeek
September 2024Hummingbird acquired LogicLoopUndisclosedReportvia SecurityWeek
July 2024ACA acquired Encore ComplianceAI-driven risk management services and compliance software for financial firmsUndisclosedReportvia SecurityWeek
July 2024360 Advanced acquired AberrantGives outsourced IT providers one place to handle their protection dutiesUndisclosedReportvia SecurityWeek
June 2024Riskonnect acquired CammsCloud-based governance, risk and compliance software platform with IT risk servicesUndisclosedReportvia SecurityWeek
June 2024Dedagroup acquired Quod OrbisRisk management and compliance software solutionsUndisclosedReportvia SecurityWeek
March 2024Fscom acquired FMConsultRisk and compliance solutions provider to asset managers in UK and IrelandUndisclosedReportvia SecurityWeek
February 2024Thoma Bravo acquired EQSCloud software for corporate compliance and investor relations tasksUndisclosedReportvia SecurityWeek
February 2024Spirit Technology Solutions acquired InfoTrustDelivers assurance, governance, risk handling and compliance offerings$22.5mReportvia SecurityWeek
February 2024Archer acquired Compliance.aiProvides AI-driven regulatory change management solutions for compliance and riskUndisclosedReportvia SecurityWeek
January 2024Dynatrace acquired RunecastLessens risk, secures and keeps hybrid multicloud setups compliantUndisclosedReportvia SecurityWeek
December 2023DeepSeas acquired GreyCastle SecurityCovers governance, security work, personal data and breach handlingUndisclosedReportvia SecurityWeek
October 2023Zyston acquired Blue LavaProvides security program management software as a serviceUndisclosedReportvia SecurityWeek
September 2023SafeBase acquired StacksiA tool using machine learning to automate security formsUndisclosedReportvia SecurityWeek
August 2023Zyston acquired ComplyifyHandles security risks and rule keeping through artificial intelligenceUndisclosedReportvia SecurityWeek
July 2023Board of Cyber acquired TrustHQFrench risk mitigation and compliance firmUndisclosedReportvia SecurityWeek
July 2023Anatomy IT acquired MarsdenAdvisorsMIPS business unit providing value based care servicesUndisclosedReportvia SecurityWeek
May 2023GeoComply acquired OneComplyProvides licensing and compliance management platform for regulated marketsUndisclosedReportvia SecurityWeek
April 2023Drumz acquired Acuity Risk ManagementIntegrated risk management software and services$4.5mReportvia SecurityWeek
April 2023Cinven acquired ArcherIntegrated risk management software covering enterprise and operational risk, IT and security risk, compliance, audit, third-party governance and operational resilience.UndisclosedReportvia SecurityWeek
March 2023ScalePad acquired ControlMapTool for overseeing rules, dangers and legal duties at outsourced IT firmsUndisclosedReportvia SecurityWeek
February 2023eBay acquired 3PM ShieldAI-based marketplace compliance monitoring to stop counterfeit and illegal goodsUndisclosedReportvia SecurityWeek
January 2023Vanta acquired TrustPageAutomates security reviews for compliance and trust managementUndisclosedReportvia SecurityWeek

Acquisitions come from SecurityWeek's monthly M&A round-ups from 2021 onwards, from Cybersecurity Ventures' quarterly M&A reports for 2020, and a few from Wikipedia lists. Funding rounds from 2022 onwards come from Return on Security's weekly Security, Funded newsletter. These are dated to the month. A few deals added from the news are dated to the day. Smaller deals may be missing. Each Report link goes to the announcement or story the source cites, and the via link to the round-up or newsletter issue. Amounts are in US dollars. The category is what the bought or funded company sells.