Finance and payments are gearing up for a new future. And they’re spending big to do so.
During the first half of the year, the cybersecurity industry recorded over 215 mergers and acquisitions (M&A) collectively worth over a hundred billion dollars. But the more consequential signal was buried beneath the transaction count. Artificial intelligence (AI) security, machine identity, industrial infrastructure, browser protection, behavioral fraud detection and automated remediation are increasingly appearing on buyers’ shopping lists.
The enterprise attack surface is expanding to new targets: AI agents, industrial equipment, cloud applications, browsers, application programming interfaces (APIs) and automated software. At the same time, attackers are exploiting something more fundamental than technical vulnerabilities: how people and machines behave within interconnected digital systems.
That shift is turning cybersecurity M&A into a useful leading indicator.
See more: Wall Street’s New Cybersecurity Threat Starts With a Phone Call
Fraud and Cybersecurity Are Becoming the Same Problem
Cybersecurity buyers are assembling platforms capable of connecting signals that historically lived in separate tools. Identity data alone may not reveal an attack. Neither may behavioral data, network telemetry, browser activity or application logs. But correlated together, those signals can show that an authenticated employee is behaving unusually, an AI agent is accessing unexpected information or an industrial device is communicating with a system it normally does not.
Visa’s planned $2.4 billion acquisition of BioCatch, announced last week (Aug. 3), makes this emerging trend difficult to ignore. BioCatch already serves more than 350 banks across 21 countries, protecting users with its AI) and machine learning-based solutions that analyze thousands of application, behavioral, device, and network signals like keystrokes and device handling to separate legitimate users from fraudsters.
PYMNTS Intelligence collaborated with Visa DPS on “The Issuer Risk Playbook,” which found that 42% of bank and non-bank issuers rank fraud and disputes as either their biggest or second-biggest platform-related operating cost after employees.
The security industry is also moving closer to where employees actually work. Akamai this July completed its acquisition of browser-security company LayerX for approximately $205 million, while CrowdStrike announced a $420 million deal for Seraphic earlier this year. Both transactions expand security controls directly into browsers, and are designed to help protect employees that increasingly interact with corporate information through SaaS applications, cloud services and web interfaces rather than software running entirely inside managed corporate networks.
Sixty-eight percent of financial institutions increased their fraud-detection budgets year over year, according to the 2025 “State of Fraud and Financial Crime in the United States,” a PYMNTS Intelligence report produced in collaboration with Block. That spending comes as 46% of institutions report increasingly sophisticated fraud schemes, up from 35% a year earlier.
Read more: AI Gives Cybersecurity a Backlog CFOs and CISOs Can’t Patch Away
AI Is Creating New Enterprise Identities That Need Defending
Few trends are showing up more clearly in the deal market than AI security. Technology companies account for the overwhelming majority of disclosed cyber acquisition spending, but buyers are not simply acquiring generative AI tools to make security teams more productive. Increasingly, they are buying technology designed to secure AI itself.
The common problem is straightforward. As companies deploy AI agents that can read databases, execute workflows, write software and communicate with other applications, enterprises are effectively creating a new population of digital workers. Those workers need permissions. Permissions create identities. And identities create attack surfaces.
Databricks agreed to acquire Panther Labs as it builds what it describes as a security lakehouse. Rubrik bought identity-orchestration provider Strata to help organizations maintain authentication during cyber disruptions. Cisco’s WideField deal, which closed July 31, connects identity and session information with Splunk’s security analytics.
The industry is effectively trying to assemble a fuller picture of what is happening within complicated digital environments. Enterprises need to know what assets exist, what software is running inside them, how they communicate and whether vulnerabilities somewhere in the technology supply chain could disrupt physical operations.
That makes the cybersecurity M&A boom about more than consolidation. It is a preview of a security architecture built for a world in which humans share access with machines, applications extend far beyond corporate networks, cyberattacks can disrupt physical infrastructure and fraud can begin without a conventional breach.
The companies acquiring those capabilities now are betting that tomorrow’s most valuable security platforms will not merely identify malicious software. They will understand who—or what—is acting, what it is trying to do and whether that behavior should be trusted before the damage occurs.
Findings in the report “Payment Protection: Why Firms Still Aren’t Real-Time Ready,” produced by PYMNTS Intelligence in collaboration with Plaid, reveal that 57% of firms in payment-heavy industries face more fraud.
