Dealmaking in Europe’s cybersecurity sector could receive a boost from increasing defence spending as policymakers grapple with the implications of hybrid warfare.

“Investor appetite in cybersecurity software and infrastructure assets has recently rebounded, resulting in a sharp rise in transaction volumes and valuations,” Jaime Sendagorta, director at GP Bullhound, said.

European cybersecurity deals boomed in 2024, with 172 transactions worth a combined EUR 12.6bn, according to Mergermarket data. The aggregate deal value grew more than 3.6x from 2023, which in turn was up 14% from a sluggish result in 2022.

The result for 2024 takes the silver medal in the historical record. The gold goes to 2021, when 178 deals worth EUR 15.7bn crossed the line. This came before the Russian invasion of Ukraine in February 2022.

Despite the boom in activity last year, the year to date (YTD) is off to a slow start, with just 28 deals crossing the line. This is significantly lower than usual – the average YTD result for 2016 to 2024 is for 37 deals at this stage of the year.

Although the YTD25 result is underwhelming, a deeper dive shows some significant deals, including Tines Security Services of Ireland, which secured USD 125m in a Series C round at a unicorn valuation in February. The company enables corporate information technology (IT) teams to use artificial intelligence (AI) to build, run, and monitor mission-critical workflows, while improving their security.

Investment capital is available for European cybersecurity start-ups, but there is a “clear lack of capital” to scale them, according to David Martin, co-head of Tikehau Capital Iberia, which runs a cybersecurity fund. Having said that, reducing the risk of attacks is critical for public administrations, as well as for corporates in areas such as financial services, healthcare, and telecoms, he said.

NATO firewall

Sponsors have been taking an interest in the sector. For example, Thoma Bravo announced a deal to buy UK-based Darktrace in an all-cash deal worth USD 4.9bn in April 2024. The scheme of arrangement became effective in October.

Meanwhile, large IT services players are also active in the space, Sendagorta said, adding that most of the consolidators are based in the US.

Corporates around the world are seeking to strengthen their capabilities by buying smaller cybersecurity players. One example in Spain was the acquisition of Innotec Security by Accenture in 2023. The target had 500 cybersecurity professionals at the time of the deal.

Strong demand for cybersecurity services underpins the deal activity by both sponsors and corporates. The field is expected to grow by 12% in terms of compound annual growth rate (CAGR) in Europe, Sendagorta said, adding that regulatory demands, increased connectivity, and the shift to digital operations are all significant factors.

At the same time, the European member states of the North Atlantic Treaty Organization (NATO) are thinking hard about how to raise defence spending. Germany is leading the way, by loosening its debt brake and creating a fund for defence spending.

Spain is one of the laggards, with defence spending well below the current target of 2% of gross domestic product (GDP). The country’s centre-left prime minister, Pedro Sánchez, is struggling to convince his hard-left allies or the centre-right opposition to support increased defence spending in a 2025 budget.

In mid-March, Sánchez called for a broader definition of defence, including cybersecurity and actions to fight climate change. He said that Russia offers a “hybrid threat” to countries like Spain, with little risk of Russian troops crossing the Pyrenees.

Indra in focus

Sánchez’s government has also been seeking to turn Indra Sistemas into a national champion for cybersecurity. The  State Company for Industrial Investments (SEPI) owns 28% of the listed company after investing in the company in 2014 under Sánchez’s predecessor.

Indra plans acquisitions to help it reach EUR 750m in EBITDA and EUR 6bn in revenues by 2026. It also wants to find a partner for its Minsait division as it seeks to sharpen its focus on cybersecurity and other high-tech areas.

Other examples of upcoming deals in Spain include cybersecurity and cloud services company Evolutio, owned by sponsor Portobello, which is working with Natixis for a possible sale. Evolutio registered around EUR 30m in EBITDA last year, a figure expected to reach EUR 35m this year. A deal was slated for this year, according to a report from October 2024.

In other European markets, Link11, a Frankfurt-based cybersecurity company, is working with Stephens to help find a new co-investor. The company had annual recurring revenues (ARR) north of EUR 20m in 2024, based on a scalable and recurring sofware-as-a-service (SaaS) model.

Looking further ahead, Italian digital-transformation company Impresoft, owned by sponsor Clessidra, is attracting strong interest from potential suitors. Impresoft reached EBITDA of EUR 30m last year. It has been growing with deals, including the cybersecurity provider Qinet. A process could come in 2026.

Although deal activity in the YTD has been disappointing, the buzz in the market suggests that the dealmaking over the full year could be more impressive.