Why AI Labs, HR Giants Are Emerging as Cybersecurity Buyers | #hacking | #cybersecurity | #infosec | #comptia | #pentest | #ransomware

•
October 23, 2026    

Image: Shuttershock
Last week was no different than many others in the cybersecurity M&A front, with identity governance and vulnerability remediation startups getting acquired by larger organizations.See Also: 79% of SOCs Use AI. Only 36% Have It in Their Workflows.
What’s notable about last week’s deals wasn’t the sellers. It was the buyers. Most early-stage startups exit to a large cybersecurity platform providers, tech behemoths or occasionally a late-stage startup with lots of venture backing. But the buyers last week had very different backgrounds. One was a sovereign AI provider, the second operates a human content management platform, and the third is a frontier AI lab.
Workday kicked the week off by acquiring C1.ai to give people and AI agents the right access to CRMs, code repositories, finance systems and cloud infrastructure from the day they join to the day they leave. C1.ai – formerly known as ConductorOne – was founded in 2020, employs 161 people and has raised more than $100 million, having most recently closed a $79 million Series B round led by Greycroft (see: ConductorOne Hauls in $79M to Modernize Identity Security).
That same day, The Information reported OpenAI was in early talks to buy Trail of Bits, a firm that finds and fixes vulnerabilities in open-source software. Trail of Bits, founded in 2012, employs 106 people and has been led since its inception by Dan Guido, who spent 17 months as a threat intelligence lead in the Federal Reserve. The talks come seven months after OpenAI bought Promptfoo for a similar purpose.
Two days later, Cohere announced plans to purchase a Czech startup led by the former CEO of Avast to enhance its capabilities around autonomous vulnerability discovery and remediation. The Toronto sovereign AI provider said the proposed acquisition will help Aisle deploy close to customer environments and continue model-agnostic benchmarking while integrating deeper with Cohere’s stack (see: Cohere to Acquire AI Vulnerability Remediation Firm Aisle).
“We know now how to find vulnerabilities,” Aisle COO and CISO Jaya Baloo told ISMG last week. “We already had a vulnerability backlog. There was never a shortage, even before AI, of vulnerabilities we knew we needed to fix. That was always there. The problem was the fixing, and that fixing problem was why we initially built Aisle in the first place.”
The Anatomy Of Three Unusual Cyber Deals
The most unusual buyer of the trio is Workday since workforce management platforms have typically left identity and security to partners rather than building or buying first-party capabilities. There are some examples of larger organizations buying both HR platforms and identity firms such as Oracle buying PeopleSoft, Thor and Oblix all in 2005, and Rippling building its own identity management.
Now that Workday is playing in the identity governance space, it’ll have to navigate maintaining strong relationships with third-party identity platforms that rely on HR data while offering a competing tool of its own. Security vendors are more likely to pursue deep integrations and joint road map planning when their third-party partner isn’t competing with their core business.
Although both Promptfoo and Trail of Bits find and fix vulnerabilities, the two OpenAI targets take very different approaches to this challenge. Promptfoo takes a technology-centric approach, with its open-source software tool offering LLM application evaluation, prompt engineering regression testing, and automated red teaming. Promptfoo runs inside an organization’s local machine or their CI/CD pipeline.
Conversely, Trail of Bits takes a people-centric approach with consulting and research focused on software assurance, blockchain auditing, cryptography and full-stack AI/ML pipeline reviews. Organizations hire Trail of Bits engineers for deep architectural reviews, threat modeling and bespoke exploit development.
Four months before the acquisition reports, Trail of Bits partnered with OpenAI to work on a software-patching initiative, Patch the Planet. Staff from Trail of Bits work on open-source projects, such as the popular programming language Python, to find, review and fix bugs, with the help of OpenAI Codex tools, including models specialized for cybersecurity, according to The Information.
“We had a lot of existing relationships in the open-source community and have earned their trust over more than a decade of work,” said Guido in a promotional video announcing Patch the Planet. “Codex enabled our team to ship things in a day that would have otherwise taken us weeks of time.”
Becoming part of Cohere will provide Aisle with access to first-party models, deep engineering resources and the capability to support sovereign AI with open-weight options, Baloo told ISMG last week. Being inside Cohere will give Aisle access to model internals and enable performance tuning for workflows, which she said will accelerate delivery of features and improve detection and remediation performance.
“Having access to a model, being able to go at the ground level to design some of the things that we would need to accelerate that and then supplement them by adding cybersecurity pieces for their customers, the governments and critical infrastructure, that is incredibly exciting for us,” Baloo said last week.
Like C3.ai, Aisle is now part of a broader organization that directly competes against many of its existing third-party partners. Baloo said last week that Aisle will stay committed to benchmarking models from providers other than Cohere and will stay honest about the strengths and weaknesses discovered. The company intends to continue supporting customer-preferred models, Baloo said.
“We want to meet customers where they are, not where we think they should go,” Baloo told ISMG last week. “It’s hard to predict how this product evolves, so there might be changes down the line. But for now, we should honor our commitments and keep expectations managed, and ideally show them that we can give them choices.”
Cybersecurity acquisitions are likely to be one-offs for AI labs and HR systems rather than part of a sustained strategy. It’ll be interesting to see how the pace of innovation and R&D investment changes for these startups as they transition from independence to being part of a larger tech operation where speed might trump security.
For sellers, the rise of non-traditional buyers presents another exit opportunity in a climate where IPOs are exceedingly scarce and private equity money is pretty much sitting on the sidelines. They certainly won’t look a gift horse in the mouth.

——————————————————-
Click Here For The Original Source.

Related