Despite growing macroeconomic challenges in 2022, tech giants continued to broaden their cybersecurity portfolio, with large security vendors building up their platform approach through acquisitions.

Here is a look back at the top security deals of 2022:

Google’s Mandiant Buy

Google completed its Mandiant acquisition in September in an all-cash deal valued at around $5.4 billion. Google is integrating Mandiant into its cloud platform while retaining the brand.

Google Cloud CISO Phil Venables said Mandiant will bring proactive defense to the tech giant’s existing security portfolio and called the deal “complementary and compelling.” Mandiant CEO Kevin Mandia envisions its merger into Google Cloud will enable amplification and further automation of the security powerhouse’s capabilities to stop the most current attacks while remaining controls agnostic.

Analysts expected the deal to exemplify Google’s ambitions in the cybersecurity market and better its position to compete with Microsoft and Amazon Web Services (AWS) over cloud security.

SentinelOne Snapped Up Attivo Networks

SentinelOne completed its $616.5 million Attivo Networks acquisition in May, bringing identity-based threat protection to its extended detection and response (XDR) platform. The Attivo Networks platform features agent-based identity protection, identity infrastructure assessment, identity-based vulnerability scanning and management for enterprise infrastructure, and deception services.

The acquisition will “enable us to provide cybersecurity in one of the most critical and dynamic parts of enterprise security today: the identity parameter,” and address the $4 billion and growing identity security market, SentinelOne CEO and co-founder Tomer Weingarten said of the deal. “With Attivo’s user-centric identity capabilities, we will be able to support an even more comprehensive zero-trust framework.”

Palo Alto Networks Acquires Cider Security

Palo Alto Networks completed its $195 million acquisition of Cider Security, which was initially announced in November.

Founded by Guy Flechter and Daniel Krivelevich in Israel, the application security startup raised $38 million in funding. It offers an AppSec operating system to orchestrate and implement end-to-end continuous integration, and continuous delivery (CI/CD) security through a unified platform.

Palo Alto Networks plans to integrate Cider Security’s technology into its Prisma Cloud platform to strengthen its supply chain security and code–to-cloud cloud-native application protection platform (CNAPP) capabilities.

IBM Buys Randori

IBM announced its plans to acquire attack surface management (ASM) and offensive security startup Randori for an undisclosed amount. The deal will provide IBM with better understanding of hackers by discovering the entire depth of the attack surface.

IBM plans to integrate Randori’s ASM software with the XDR capabilities of its own Security QRadar and also to strengthen IBM’s hybrid cloud infrastructure.

Randori raised $30 million from two funding rounds.

CrowdStrike Grabs Reposify

CrowdStrike acquired external attack surface management (EASM) provider Reposify.

Israel-based Repsoify was founded by Yaron Tal in 2017, and raised $8.5 million in seed money. Its core technology is to use one of the largest databases of internet-facing assets to help customers view their external attack surface with a click of a button.

CrowdStrike integrated the Reposify EASM into its Falcon Surface product.

Snyk Scoops Up Fugue

Snyk acquired cloud security posture management (CSPM) vendor Fugue to move its developer-focused security platform into the larger cloud security market. The startup raised $85 million from eight founding rounds.

Fugue last year rolled out a unified policy engine that connects cloud posture back to configuration code, using one set of policies to manage compliance and security throughout the entire software development lifecycle. In an earlier interview, Fugue co-founder and CEO Josh Stella said the unified policy engine can ensure cloud security across development and operations using 50% fewer engineering resources.

These capabilities will extend Snyk’s Developer Security Platform and enable what it calls “the industry’s first CSPM designed by and for developers.”