Fortinet Buys Virtue AI: Agent Security M&A in 2026

Fortinet announced on August 17, 2026 that it has acquired Virtue AI, adding agentic red-teaming, agent protection, continuous AI validation and real-time guardrails to its AI-Native Security Fabric.¹ Terms were undisclosed and, Fortinet said, immaterial to its business.¹ Axios had reported Meta hiring three of Virtue AI's four co-founders seven and a half weeks earlier.²

It is one of at least nine agent- and AI-security deals announced in 2026, and the second in a fortnight involving an agent red-teaming company. What follows is what Fortinet actually bought, what the comparable deals cost, and why the founder timeline bears on both questions.

TL;DR

• The deal: Fortinet (NASDAQ: FTNT) announced on August 17, 2026 that it had acquired Virtue AI, a startup working on AI runtime protection, automated AI validation and security for autonomous systems.¹ Financial terms were not disclosed, and Fortinet said the consideration was immaterial to its business.¹
• What it adds: agentic system red-teaming across more than 50 sandboxed environments and 14 high-stakes domains, including simulated prompt-injection and MCP-based attacks against leading agent frameworks.¹
• The continuous part: automated red-teaming that runs across hundreds of attack vectors and more than 1,000 risk categories, with multimodal testing and on-demand reporting for security, risk and compliance teams — all vendor figures, none independently verified.¹
• The number everyone will quote: Fortinet quotes Gartner projecting that the market for securing AI ecosystems and AI agents will expand from $2.8 billion in 2026 to $16.4 billion by 2030.¹³
• The pattern: nine agent- or AI-security deals were announced between January and August 2026. Six have confirmed closings; Oasis Security and Permiso Security had not closed as of August 24, and OpenAI/Promptfoo has no announced closing date either way. Five are tabulated below; the rest sit just outside the boundary.¹⁴⁵⁶⁷ Anaconda bought Enkrypt AI — a closely comparable red-teaming and guardrails company — thirteen days before Fortinet moved.⁸
• The context that reframes it: Virtue AI's founding bench had already thinned. Axios reported on June 25, 2026 that Meta Superintelligence Labs was hiring co-founders Bo Li, Dawn Song and Sanmi Koyejo along with other team members.² Four days later Virtue AI named Sohaib Shaikh chief executive and confirmed that Li and Koyejo were leaving.⁹ Fortinet's announcement names no Virtue AI personnel at all.¹

What You'll Learn

• Exactly what Fortinet bought, in Fortinet's own words
• Why agentic red-teaming is a different product from LLM guardrails
• Who had already left Virtue AI before Fortinet bought it, and why that matters
• The 2026 agent-security acquisition timeline, with dates, values and deal status
• Where the pattern started, in 2024 and 2025, before anyone said "agentic"
• What the Gartner $16.4 billion figure does and does not say
• What consolidation means if you are the one shipping agents

What Fortinet Actually Bought

Virtue AI is not a prompt-filtering company. Fortinet's press release groups the acquired capability under what it calls Virtue AI's "Guardian Agent abilities" and breaks it into four named pieces.¹ The distinctions matter, because each maps to a different failure mode.

Agentic system red-teaming. Testing autonomous agents for exploitable weaknesses across more than 50 sandboxed environments and 14 high-stakes domains. Fortinet specifically names simulated prompt-injection and MCP-based attacks against leading agent frameworks.¹

Agent protection, governance and visibility. Discovery of unsanctioned AI applications and agents, scanning of MCP tools and source code for hidden risks, monitoring of agent behavior, and blocking malicious tool calls before they act.¹

Continuous AI validation. Identifying new risks across every model update and fine-tuning of policies, while generating audit-ready evidence. This is the part that runs across hundreds of attack vectors and more than 1,000 risk categories.¹

Real-time guardrails. Enforcement of customizable policies across text, images, video, audio and AI-generated code.¹

Only the last of those four is what most people picture when they hear "AI security." The first is purely agent-specific; the middle two are hybrids — unsanctioned-app discovery is classic shadow-IT work pointed at a new class of asset, and continuous validation is triggered by model updates as much as by agent behaviour.

Worth stating plainly: every number in that list — 50 environments, 14 domains, 1,000 risk categories — is Fortinet's description of a vendor taxonomy Virtue AI defined itself. None of it has been independently validated, and there is no industry standard against which "risk category" means anything comparable between vendors.

"AI is fundamentally changing enterprise computing, and security must evolve just as quickly," said Ken Xie, Founder, Chairman of the Board, and Chief Executive Officer at Fortinet. "Virtue AI's technology will advance our vision for continuous AI assurance, helping customers govern and protect AI systems throughout their lifecycle while operating them confidently at enterprise scale."¹

Fortinet frames the acquisition as an extension of FortiAIGate, which the release says it shipped "earlier this year" to safeguard large language models from "prompt injections, data leakage, model poisoning, excessive resource consumption, and other emerging AI-specific risks."¹

The stated logic is that FortiAIGate secured the model; Virtue AI secures what the model does once it has tools.

Why Agent Red-Teaming Is a Separate Product

Distribution explains why platform vendors want this capability. It does not explain why they keep buying it instead of building it. That part is technical.

An LLM guardrail evaluates a payload — a prompt going in, a completion coming out. It is a stateless classification problem, and the commercial answer to it is another model doing the classifying.

That approach is commercially mature but not reliable. A systematization of jailbreak guardrails accepted to the 2026 IEEE Symposium on Security and Privacy found that no single guardrail excels across security, efficiency and utility together, and that LLM-based guardrails filter prompt injections only modestly.¹⁰

Which is the point — guardrails remain a product people pay for precisely because they are unfinished, and Fortinet bought a set of them here as one of Virtue AI's four capabilities.¹ Unfinished is not the same as insufficient in kind, though, and that is the distinction the rest of this section turns on.

An agent is a loop. It plans, calls a tool, reads the result, and plans again. The dangerous state is often reached several steps in, through a sequence where no individual message is obviously malicious. Fortinet's own framing acknowledges this: the attack surface now "includes prompts, models, agents, Model Context Protocol (MCP) tools, application programming interface (API) calls, and AI infrastructure."¹

That is why Virtue AI's headline capability is measured in sandboxed environments rather than in blocked strings. You cannot test a loop with a classifier. You have to let the agent actually attempt the consequential action — somewhere the consequences do not land — and watch what it does.

The framework layer is where this gets uncomfortable. At Black Hat USA 2026, Check Point Research disclosed roughly a dozen vulnerabilities in the orchestration plumbing of the major agent frameworks.

The two published tallies do not match. Check Point's own recap counts 12 CVEs across four frameworks — LangChain, CrewAI, Google ADK and Microsoft Agent Framework.¹¹ The Register, which spoke to the researchers, reported 11 vulnerabilities across six, adding LangGraph and AutoGen.¹²

The two are not counting the same unit, and CVEs and vulnerabilities do not map one to one. Not every finding got an identifier at all: The Register reports that Microsoft paid a $10,000 bounty and fixed its bug without issuing a CVE, because the framework was not generally available when the flaw was found, and that Google issued neither a complete fix nor a CVE.¹²

Neither side has published a reconciliation of the two tallies, so "roughly a dozen findings across four to six frameworks" is the defensible summary.

Researcher Shahar Tal listed the bug classes to The Register as "insecure deserialization, server-side request forgeries, path traversals, use-after-free" — bugs that had nothing to do with the model at all.¹² We covered that research, and the count discrepancy, in agent framework vulnerabilities at Black Hat 2026. A guardrail sitting in front of the model does not see any of it.

The visibility problem compounds it. Many enterprises cannot fully enumerate the agents already running inside their own environment, which is the gap we walked through in the AI agent visibility gap.

Virtue AI's "discovers unsanctioned AI applications and agents" line is aimed squarely at that.

Who Was Still There When Fortinet Bought It

The announcement coverage treated this as a straightforward capability purchase. The seven and a half weeks before it complicate that.

Virtue AI was founded by four researchers well known in adversarial machine learning: Bo Li, Dawn Song, Sanmi Koyejo and Carlos Guestrin. It announced $30 million in combined seed and Series A funding on April 15, 2025, led by Lightspeed Venture Partners and Walden Catalyst Ventures, and joined by Prosperity7 among others.¹³

Bo Li was also the company's chief executive.¹³ That founding bench had thinned considerably by the time Fortinet moved.

Axios reported on June 25, 2026 that Meta Superintelligence Labs was hiring Li, Song and Koyejo along with members of Virtue AI's broader team, with Li and Song reporting into Nat Friedman and Koyejo into Rob Fergus, head of Meta's FAIR lab.²

Axios called it "the latest example of hiring a discrete team as opposed to an entire company," and said the terms of the arrangement were not disclosed.² It did not say what, if anything, Meta took beyond the people, and neither company has since said.

Four days later, Virtue AI announced that Sohaib Shaikh — who had joined as head of sales in April 2026 — would take over as chief executive, and confirmed that Bo Li and Sanmi Koyejo were exiting the company.⁹ Carlos Guestrin still lists himself as Virtue AI's chief scientist on his Stanford page.¹⁴

Note precisely what each source establishes. Virtue AI's own release confirms two departures, Li and Koyejo.⁹ The third, Dawn Song, rests on Axios's report of Meta hiring her; Virtue AI has not published anything about her status.²⁹ So: two confirmed exits, a third reported and uncontradicted, and one founder still in place.

Either way, when Fortinet announced the deal on August 17, the company it bought was being run by a chief executive of under two months' tenure, and its founding CEO's departure had been confirmed seven weeks earlier.²⁹

Fortinet's release is conspicuously consistent with that. The only person quoted is Ken Xie, and the deal is described in terms of "Virtue AI's technology."¹ There is no Virtue AI executive quote, no "About Virtue AI" boilerplate, and no team-retention language of any kind. No Virtue AI employee, past or present, is named anywhere in it.

Before drawing the obvious inference, two things need saying.

"Immaterial" is a disclosure standard, not a price. Fortinet booked $6.80 billion in revenue in fiscal 2025.¹⁵ A transaction can be immaterial to a company that size and still cost well into nine figures.

The phrase is routine in tuck-in announcements and tells you very little about what was actually paid. Anyone — including us — who reads "immaterial" as "cheap" is inferring, not reporting. The only firm anchor in the public record is that Virtue AI had disclosed just $30 million in total funding.¹³

The causal link is ours, not Fortinet's. Fortinet's press release says nothing about the departures or about how they bore on the price, and we have not asked the company. Trade coverage of the deal has characterised what Fortinet bought as Virtue AI's technology rather than its team — the same emphasis the release itself uses — but that is a description of the asset, not a statement about causation.¹⁶ What follows is our reading.

On that reading: if the price was modest, the founder exodus is the most economical explanation available, and it is the one the announcement's silence about people is consistent with. It is not the only one. The company may simply have been early and small — which is what we argue about this whole cohort below — and "immaterial" may be boilerplate that would have appeared whatever the number.

The 2026 Agent-Security Shopping List

Fortinet is not early. The table below covers deals where the acquirer is a platform vendor and the target's whole product was security for AI systems or the identities they use.

Where the line falls next is a judgement call rather than a rule, and it is worth being honest about that. Cisco/Astrix and Okta/Permiso would satisfy the same tests; they are held back for the section below because their primary asset is identity infrastructure rather than agent testing, and Anaconda/Enkrypt is held back because Anaconda is not a security vendor.

Reasonable people would draw all three lines differently. Dates are announcement dates unless noted. Treat the table as a floor, not a census.

Acquirer	Target	Announced	Stated focus	Value	Status
CrowdStrike	SGNL	Jan 8, 2026	Continuous identity for human, non-human and AI identities	~$740M, predominantly cash with a portion in stock subject to vesting417	Closed during CrowdStrike's fiscal Q1 2027, quarter ended April 30, 202618
Proofpoint	Acuvity	Feb 12, 2026	AI security and governance for the agentic workspace	Not disclosed5	Completed at announcement5
Palo Alto Networks	Koi	Feb 17, 20266	Agentic endpoint security	$231M total purchase consideration19	Completed April 14, 202620
OpenAI	Promptfoo	Mar 9, 2026	Agent red-teaming and security testing	Not disclosed7	Promptfoo now describes itself as part of OpenAI; no closing date announced21
Fortinet	Virtue AI	Aug 17, 2026	Agentic red-teaming, runtime protection, validation	Not disclosed; immaterial1	Announced as completed1

Table: Agent-security acquisitions announced by major platform vendors, January–August 2026. Source: company press releases and SEC filings, as footnoted per row. Status is as of August 24, 2026.

Three things stand out.

First, not one of these press releases stated a price. Every figure in the Value column above came from somewhere other than the announcement. CrowdStrike never published the $740 million number itself; a spokesperson gave it to SecurityWeek on the day.⁴¹⁷ The Koi figure came out through Palo Alto's own quarterly filings.¹⁹ Fortinet explicitly called its consideration immaterial.¹

That is a signal about stage, not about importance — these are mostly early-stage companies being absorbed before they had time to build much revenue.

A note on the Koi number, since three different figures circulate. Palo Alto's filing at signing described total consideration of about $300 million in cash and replacement awards, subject to adjustments. The final GAAP purchase consideration at close was $231 million, with replacement equity awards attributable to post-combination service excluded from consideration.¹⁹

Those two are a signing estimate and an audited close computed on different bases, so they are not expected to reconcile by subtraction. A third figure of roughly $400 million circulated in press coverage and traces to no primary source we can find.

Second, the buyers are not all security companies. OpenAI acquiring Promptfoo is the odd one out and the most interesting.⁷ Promptfoo builds red-teaming tooling for prompt injection, data leaks and out-of-policy agent behaviour.⁷

A model provider buying an agent-testing company is a different bet from a firewall vendor buying one. It suggests security testing is becoming part of the agent platform rather than a layer bolted on top.

Third, the table is conservative. Four more deals sit just outside it, and one of them matters more than anything in it.

Start with the adjacent identity deals. Cisco completed its acquisition of Astrix Security on June 29, 2026; Cisco did not disclose terms, and the figure of roughly $400 million in circulation is Calcalist's reporting, not Cisco's.²²

Cyera announced on July 28, 2026 that it had signed a letter of intent to acquire Oasis Security for approximately $1 billion, mostly in cash.²³ Okta signed a definitive agreement to acquire Permiso Security on July 30, 2026; Okta did not disclose terms, and a source told TechCrunch the value was just under $200 million.²⁴

Neither the Cyera nor the Okta deal had closed as of August 24, 2026 — Okta said it expected to close in its fiscal Q3 2027.²³²⁴ We covered the identity thread separately in the agent identity land grab.

The fourth has nothing to do with identity and is the closest comparable in the entire article. Anaconda acquired Enkrypt AI on August 4, 2026, thirteen days before Fortinet moved.⁸

Enkrypt sells red-teaming, runtime guardrails and MCP server scanning. Anaconda's announcement says Enkrypt scanned more than 268,000 tools across 25,000 MCP servers in two months and found more than 143,000 vulnerabilities.⁸ Its red-teaming maps to a self-defined taxonomy of six risk categories and 300 sub-categories.²⁵

That is the same shape of company Fortinet bought. Two caveats: the vendors' category counts are self-defined and not comparable with each other, and Enkrypt leans harder on regulatory-compliance automation than Virtue AI's description does.

It is excluded from the table only because Anaconda is a Python data-science platform rather than a security vendor. On the merits it belongs beside the Fortinet row.

The 2024 and 2025 Precedents

The pattern did not start in 2026, and it did not start with agents.

The earliest instance we can find is Cisco's acquisition of Robust Intelligence, announced on August 26, 2024 and closed on September 23, 2024 — an AI model security platform built around automated model assessment and algorithmic red teaming, which is agentic red-teaming's direct ancestor.²⁶

We found no earlier acquisition of a model-security or adversarial-ML company by a major platform vendor, though absence of a counterexample is not proof of a first.

2025 is when it became a habit. Palo Alto Networks completed its acquisition of Protect AI on July 22, 2025.²⁷ F5 announced its acquisition of CalypsoAI on September 11, 2025 for $180 million in purchase consideration, and confirmed completion later that month.²⁸²⁹

Check Point announced its acquisition of Lakera on September 16, 2025 and closed it on October 22, 2025.³⁰³¹ Check Point never disclosed terms; the widely-repeated figure of roughly $300 million is CTech's estimate, published as an estimate rather than a confirmed price.³²

What the Gartner Number Does and Doesn't Say

Fortinet's press release cites Gartner: "the market for securing AI ecosystems and AI agents is rapidly expanding; products and tools are expected to expand from $2.8 billion in 2026 to $16.4 billion by 2030."¹ The underlying report is Forecasting the $16.4 Billion Opportunity in Securing AI, by Shailendra Upadhyay, published July 30, 2026.³

That is a 5.9x increase over four years, implying a compound annual growth rate of roughly 55%.

One limitation to declare up front: the Gartner report is paywalled, and we are quoting it exactly as Fortinet quoted it.

We have not seen its market definition or its methodology. So we cannot tell you what counts as "securing AI ecosystems and AI agents," whether the $2.8 billion is a measured 2026 figure or itself a forecast — the report's title says Forecasting — or how it treats the identity products that half this article's deals sell. Treat both numbers as a vendor-selected quotation from a document neither we nor most readers can check.

A second caution, about how this number tends to get used. Annual product spend and one-time purchase prices are different units, so "acquisition X equals Y% of the market" is not a calculation anyone should perform, and we are not performing it here.

What the $2.8 billion does support is a directional read: this is a young category, and the companies in it are early enough that revenue multiples would be the wrong lens on any of these prices. That is consistent with — though it does not prove — the near-total absence of disclosed terms.

What it does not support is the idea that acquirers are only placing small bets. Cyera's letter of intent for Oasis Security puts a roughly $1 billion price on a single company in an adjacent corner of this market.²³ That deal is neither binding nor closed, and Oasis sells identity rather than red-teaming. But a ten-figure intended price anywhere in this space is worth knowing about before you conclude from Fortinet's "immaterial" that nobody is paying up.

Some acquirers are. Fortinet, on the available evidence, was not — though as the earlier section said, what "immaterial" actually means in dollars is something Fortinet has not told anyone.

What This Means If You Ship Agents

Three practical consequences, in decreasing order of confidence.

Your agent security tooling will probably arrive as a platform feature, not a purchase. If you already run Fortinet, Palo Alto, CrowdStrike or Proofpoint, agent red-teaming is likely to show up in a renewal conversation rather than a procurement cycle. That is genuinely convenient, and distribution through an existing install base is a large part of what makes these targets worth buying.

The independent options are thinning. Every acquisition above removes a vendor that would sell to you regardless of your existing stack. If your agent platform and your security platform come from different vendors, check that the acquired tooling still supports your frameworks — "leading agent frameworks" in a press release is not a support matrix.

Nothing here fixes the underlying boundary problem. Red-teaming finds exploitable weaknesses; it does not remove the reason they exist. Agents are given tools, and tools do things.

The controls that actually reduce blast radius are the unglamorous ones: scoped permissions per tool, human approval on irreversible actions, and spend and rate limits on autonomous loops — the last of which we covered in agent cost control and session spend caps.

The Bottom Line

Fortinet paid an undisclosed, immaterial amount, and the most informative detail in the announcement is not the price — it is the phrase "MCP-based attacks against leading agent frameworks."¹

That is a vendor stating, in a press release, that the Model Context Protocol is now part of the enterprise attack surface. On the nine deals this article names, spread across eight months, the platform vendors have converged on the same conclusion: securing an agent is a different job from securing a model, and buying that capability beat building it.

The second thing worth noticing is who is missing from the release. A company founded by four prominent adversarial-ML researchers was bought for a sum its buyer called immaterial, weeks after Meta hired three of them, in an announcement that names none of them.¹²⁹

Read those two transactions together and a question falls out. Meta hired a team without buying a company; Fortinet bought the company weeks after that team was hired away. Exactly who remained at Virtue AI on August 17, and how many of them are now at Fortinet, is not something either company has disclosed — Guestrin is the one founder on the public record as still in place.¹⁴

Both parties presumably got what they wanted. Which of them bought the thing that actually mattered is not something the public record can settle.

If you ship agents, the useful takeaway is not which logo ends up on the tool. It is that the people who buy security tools for a living have concluded the loop needs its own defenses.

References

Footnotes

1. Fortinet, "Fortinet Advances Continuous AI Protection with the Acquisition of Virtue AI", August 17, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹ ↩¹⁰ ↩¹¹ ↩¹² ↩¹³ ↩¹⁴ ↩¹⁵ ↩¹⁶ ↩¹⁷ ↩¹⁸ ↩¹⁹ ↩²⁰ ↩²¹ ↩²² ↩²³ ↩²⁴ ↩²⁵ ↩²⁶ ↩²⁷ ↩²⁸ ↩²⁹ ↩³⁰

2. Axios, "Meta hires Virtue AI founders", Madison Mills, June 25, 2026. The article carries the longer on-page headline "Exclusive: Meta poaches Virtue AI bigwigs to boost security." ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷ ↩⁸ ↩⁹

3. Gartner, Forecasting the $16.4 Billion Opportunity in Securing AI, Shailendra Upadhyay, July 30, 2026 — as cited in Fortinet's August 17, 2026 press release (see note 1). The report itself is paywalled; the figures here are quoted as Fortinet quoted them. ↩ ↩² ↩³

4. CrowdStrike, "CrowdStrike to Acquire SGNL to Transform Identity Security for the AI Era", January 2026. ↩ ↩² ↩³ ↩⁴

5. Proofpoint, "Proofpoint Acquires Acuvity to Deliver AI Security and Governance Across the Agentic Workspace", February 12, 2026. ↩ ↩² ↩³ ↩⁴

6. Palo Alto Networks, "Palo Alto Networks Announces Intent to Acquire Koi to Secure the Agentic Endpoint", February 2026. ↩ ↩² ↩³

7. OpenAI, "OpenAI to acquire Promptfoo", March 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵

8. Anaconda, "Anaconda Acquires Enkrypt AI to Secure the Trillion-Token Enterprise", August 4, 2026. ↩ ↩² ↩³ ↩⁴

9. PR Newswire, "Virtue AI Announces Leadership Transition to Drive Its Mission Forward", June 29, 2026. ↩ ↩² ↩³ ↩⁴ ↩⁵ ↩⁶ ↩⁷

10. Wang et al., "SoK: Evaluating Jailbreak Guardrails for Large Language Models", arXiv:2506.10597 — accepted to the 2026 IEEE Symposium on Security and Privacy. ↩

11. Check Point, "Black Hat 2026: Check Point Research Takes the Stage", August 6, 2026 — "audited … LangChain, Google's ADK, Microsoft Agent Framework, and CrewAI. Across the four, they found 12 CVEs." ↩

12. The Register, "Prompt injection isn't the bug — AI agent frameworks are", Jessica Lyons, August 5, 2026 — Shahar Tal and Yarden Porat on 11 vulnerabilities across six frameworks, and the bug classes quoted above. ↩ ↩² ↩³

13. Business Wire, "Virtue AI Raises $30 Million in Seed and Series A Funding to Bridge the Critical AI Security Gap", April 2025. ↩ ↩² ↩³ ↩⁴

14. Carlos Guestrin, personal page, Stanford University — accessed August 24, 2026. ↩ ↩² ↩³

15. Fortinet, "Fortinet Reports Strong Fourth Quarter and Full Year 2025 Financial Results", February 5, 2026 — full-year 2025 revenue of $6.80 billion, up 14% year over year. ↩

16. Information Security Media Group, "Fortinet Buys Virtue AI for Agent and Model Runtime Controls", August 2026 — describes the deal as Fortinet acquiring "Virtue AI's technology to extend FortiAIGate." Full article is behind a registration wall; the characterisation above is taken from the page's own published summary. ↩

17. SecurityWeek, "CrowdStrike to Buy Identity Security Firm SGNL for $740 Million in Cash", January 2026. ↩ ↩²

18. CrowdStrike, Form 10-Q for the quarterly period ended April 30, 2026, U.S. Securities and Exchange Commission — goodwill note referencing the completed SGNL.AI, Inc. acquisition. ↩ ↩²

19. Palo Alto Networks, Form 10-Q for the quarterly period ended April 30, 2026, U.S. Securities and Exchange Commission — acquisitions note, Koi Security Ltd. Signing-date consideration from Palo Alto's Form 10-Q for the quarter ended January 31, 2026. ↩ ↩² ↩³

20. Palo Alto Networks, "Palo Alto Networks Completes Acquisition of Koi to Secure the Agentic Endpoint", April 14, 2026. ↩

21. Promptfoo, Press Center — accessed August 24, 2026. ↩ ↩² ↩³

22. Cisco, "Securing the Agentic Workforce: Cisco Announces Intent to Acquire Astrix Security", May 4, 2026, updated June 29, 2026 to confirm completion. Cisco did not disclose terms; the ~$400 million figure is Calcalist's reporting. ↩ ↩²

23. TechCrunch, "Cyera agrees to acquire Oasis Security for $1B to safeguard proliferating AI agents", July 28, 2026. ↩ ↩² ↩³ ↩⁴

24. TechCrunch, "Okta buys AI security startup Permiso — source says for about $200M", July 30, 2026. Okta did not disclose terms; the figure comes from a single source with knowledge of the deal. ↩ ↩² ↩³

25. Enkrypt AI, "AI Safety Risk Categories" — accessed August 24, 2026: "Enkrypt AI maps safety risks into six main categories and 300 sub-categories." ↩

26. Cisco, "Fortifying the future of Security for AI: Cisco Announces intent to acquire Robust Intelligence", August 26, 2024. Closing date of September 23, 2024 per Cisco's Form S-8 Exhibit 99.2, filed September 30, 2024: "on September 23, 2024 (the 'Closing Date'), Cisco Systems, Inc. … acquired Robust Intelligence, Inc." ↩

27. Palo Alto Networks, "Palo Alto Networks Completes Acquisition of Protect AI", July 2025. ↩

28. F5, "F5 completes acquisition of CalypsoAI, introduces F5 AI Guardrails and F5 AI Red Team", F5 company blog, September 29, 2025. ↩

29. F5, "F5 to Acquire CalypsoAI to Bring Advanced AI Guardrails to Large Enterprises", September 11, 2025. ↩

30. Check Point, "Check Point Acquires Lakera to Deliver End-to-End AI Security for Enterprises", September 16, 2025. ↩

31. Check Point, Third Quarter 2025 Financial Results, October 28, 2025 — "On October 22, 2025, Check Point closed the acquisition of Lakera." ↩

32. Calcalist (CTech), "Check Point acquires Lakera in $300 million deal to expand AI security", Meir Orbach and Sophie Shulman, September 16, 2025 — "The value of the deal was not disclosed, but it is estimated at $300 million." Check Point has not confirmed the figure. ↩