The cybersecurity consolidation wave that delivered Google’s $32 billion Wiz purchase and Palo Alto’s $25 billion CyberArk deal has not exhausted itself. It has simply moved down the market cap ladder. Three midcap names now sit at the intersection of depressed valuations, platform hunger among large acquirers, and shareholder pressure that makes a stand-alone future look difficult to defend.
Rapid7: The Activist Has a Seat at the Table
Rapid7 (NASDAQ: RPD) is the most explicitly pressured of the three. JANA Partners, which has disclosed a stake above 14%, reached a nomination and support agreement with the board this year, placing its own director alongside existing members. JANA has pressed for governance changes, operational improvements, and potential strategic alternatives, including a sale. Prior acquisition interest from TPG, Alphabet, and Thoma Bravo has circulated since 2023.
The company is simultaneously restructuring. In August 2026, the board approved a plan to simplify operations and align resources with its core platform, including a reduction of the workforce by approximately 12%. Incoming CEO Wael Mohamed has emphasized that the company needs to go deeper in Detection and Response and Exposure Management, not wider. That focus, combined with $702.6 million in cash and investments at the end of Q2 and a full-year free cash flow target of approximately $130 million, gives a prospective buyer a clean platform to absorb.
For a private equity shop or a strategic platform consolidator, the math is hard to ignore. The stock’s collapse from its 2021 highs has compressed the entry cost far below what the underlying recurring revenue base would command in a negotiated transaction.
The platform consolidation logic driving that math has a clear leader setting the pace. Palo Alto’s platformization strategy pulled enterprise customers away from point-solution competitors and built a $21.2 billion remaining performance obligation — the same playbook a Rapid7 acquirer would be buying into.
SentinelOne: The Deal That Did Not Happen Is Still Pointing at a Deal
When Palo Alto Networks’ rumored interest in SentinelOne turned out to be cover for its $25 billion CyberArk move, SentinelOne shareholders were left holding a strategically attractive company with no confirmed buyer. The logic for a deal did not disappear with the rumor.
SentinelOne’s consistent execution and balance sheet strength make it a potential takeover candidate for either strategic or private equity buyers. Gross margin has been around 73% on a GAAP basis in its latest fiscal year reporting, with the company also reporting higher non-GAAP gross margins in recent quarters. The company was named a Leader in the 2026 IDC MarketScape for modern endpoint security. At roughly $25 per share in early October, SentinelOne trades well below its 2021 IPO valuation of about $8.9 billion, which means a buyer willing to pay a 40–50% premium would still be acquiring a market leader at a fraction of what comparable assets cleared in 2025.
CrowdStrike and Microsoft remain the two most credible strategic buyers, though a sovereign wealth fund or infrastructure-focused PE firm cannot be dismissed given the company’s government exposure.
Tenable: Quiet Recovery, Loud Strategic Value
Tenable (NASDAQ: TENB) has not generated the same acquisition headlines as the other two, but the fundamentals make it the most straightforwardly acquirable name on this list. The company carries a market cap of roughly $4.9 billion with an enterprise value around the mid-$4 billions, meaning leverage is minimal. The stock has recovered sharply, yet still trades at a fraction of its 2022 peak near $63.
Tenable’s AI-powered exposure management platform unifies security visibility across the entire attack surface, protecting more than 40,000 customers globally. It has said it holds the number-one position in device vulnerability and exposure management for eight consecutive years, and its Tenable One platform has highlighted AI initiatives with Anthropic to accelerate agentic capabilities across the platform. Wedbush Securities has flagged Tenable as a potential acquisition target in the cybersecurity space.
Tenable reports Q3 results on October 28, 2026. Any guidance raise could close the gap between where the stock trades and what a strategic acquirer would value the exposure management franchise at full platform synergies.
What Varonis Proved
Proofpoint’s agreement to acquire Varonis in an all-cash deal announced on October 15, 2026, at approximately 8.4 times trailing revenue and 53 times trailing free cash flow set a fresh valuation benchmark for data security SaaS. That transaction is evidence that the consolidators still have appetite and the financing to act. Rapid7, SentinelOne, and Tenable each offer a different risk-return profile, but all three share one quality that acquirers have been willing to pay for throughout this cycle: a durable recurring revenue base inside a threat environment that is getting worse, not better.
The valuation benchmark Varonis set also reflects how acquirers are pricing durable recurring revenue in a threat environment that keeps expanding. Palo Alto’s $21 billion in remaining performance obligations shows how contracted recurring security revenue commands a premium multiple from the market.
