MSSP LevelBlue to Purchase Cybereason for Global XDR Growth

LevelBlue plans to purchase a struggling endpoint security provider to add more capabilities around extended detection and response, threat intelligence, digital forensics and incident response.

See Also: On Demand | Ransomware in 2025: Evolving Threats, Exploited Vulnerabilities, and a Unified Defense Strategy

The Dallas-based managed security services company said its proposed acquisition of San Diego-based Cybereason will give organizations stronger threat detection, faster response and broader global coverage. The deal comes two months after LevelBlue bought Trustwave, which had agreed in November 2024 to merge with Cybereason before Cybereason terminated the deal in March 2025 (see: Trustwave, Cybereason Merge to Form an MDR Security Stalwart).

“The addition of Cybereason is a strategic leap forward in our mission to become the most complete cybersecurity partner,” said LevelBlue Chairman and CEO Bob McCullen. “By combining Cybereason’s world-class XDR and DFIR capabilities with our artificial intelligence-powered MDR and incident response, we can deliver unified protection that’s proactive, scalable and purpose-built for today’s fast-evolving threats.”

Cybereason Finally Finds Home After Years of Floundering

Cybereason, founded in 2012, employs 573 people and saw its valuation plummet 90% from $3.3 billion in July 2021 to just $300 million in April 2023. That same month, Cybereason replaced founding CEO Lior Div with SoftBank executive Eric Gan. In March, Gan resigned and was replaced by CFO Manish Narula after Gan came up short in his battle to wrestle control of Cybereason away from a pair of investors (see: Cybereason CEO Eric Gan Out Following Scuffle With Investors).

“Joining LevelBlue marks an exciting new chapter for Cybereason,” Narula said in a statement Tuesday. “This acquisition strengthens our collective capabilities across XDR, MDR, offensive security, DFIR and cybersecurity consulting services, enabling us to unlock additional value for our clients and their counsel and cyber insurance partners globally.”

Narula previously spent more than five years at Arm – where he oversaw M&A and venture investments – as well as nearly seven years at Microsoft, where he led internal strategy and M&A approval talks. As part of the transaction, Cybereason financial backers SoftBank and Liberty Strategy Capital will become investors in LevelBlue, with former U.S. Treasury Secretary Steve Mnuchin joining LevelBlue’s board.

As of February 2025, Gan and his family office owned about 6.8% of Cybereason’s shares, while Liberty Strategic Capital – where Mnuchin is managing director – and SoftBank Vision Fund respectively owned about 6.6% and 20%, according to a lawsuit Gan filed against Liberty and SoftBank. SoftBank Vision Fund is a segment of SoftBank Group, which Gan said owned about 31% of Cybereason’s outstanding stock (see: Cybereason CEO Sues to Halt Deadlock Over Critical Funding).

“Cybersecurity is now inseparable from economic security and national resilience,” Mnuchin said in a statement Tuesday. “LevelBlue has rapidly established itself as a leader in integrated managed security services, and I look forward to helping guide its growth at a time when organizations worldwide are seeking trusted partners who understand the complexity of today’s threat landscape.”

Cybereason’s headcount has fallen by nearly 60% over the past 3.5 years from a peak of 1,374 employees in March 2022, IT-Harvest found. Gartner in 2022 named Cybereason a leader in endpoint protection, but the company was downgraded to a visionary in 2023 and a niche player in 2024. This year, Cybereason got the lowest execution ability score amid “multiple organizational structure and leadership changes.”

“Cybereason’s strength in XDR and digital forensics is a fantastic added capability that enables us to better serve our customers with deeper threat visibility, faster response and greater confidence in the face of evolving cyberthreats,” LevelBlue Board Member Shawn Hakl said in a statement Tuesday. LevelBlue executives weren’t available for additional comment to Information Security Media Group.

LevelBlue-Cybereason Deal Comes Amid EDR-MDR Consolidation

LevelBlue said Cybereason’s advanced XDR complements Trustwave’s MDR offering and aids LevelBlue’s MDR service, providing faster, more accurate detection and response, helping clients reduce dwell time and contain threats before they spread. Cybereason’s DFIR technology and services creates extensive global coverage, technology-agnostic forensic expertise and intelligence-driven speed, LevelBlue said (see: LevelBlue, Trustwave Unite to Form $1B Managed Cyber Goliath).

Unifying Cybereason’s research team with Trustwave SpiderLabs gives clients deeper visibility into emerging threat actors and attack techniques, paired with actionable insights, LevelBlue said. And Cybereason’s strong presence in Japan, where it is among the largest providers, expands LevelBlue’s global footprint and regional delivery capabilities, according to the company.

“Cybereason’s advanced XDR platform, backed by a world-class team and global reputation for innovation, is the perfect complement to LevelBlue’s AI-powered managed detection and response,” McCullen wrote in a blog. “Cybereason achieved a perfect score in the 2024 MITRE ATT&CK Evaluations, proving the technology’s unmatched precision and effectiveness against today’s most complex cyberthreats.”

LevelBlue is currently the world’s largest pure-play MSSP with more than 2,000 employees and $1 billion in annual sales. In addition to Trustwave and now Cybereason, the company in August bought London-based Aon’s cybersecurity and IP litigation consulting groups to expand the company’s incident response and digital forensics capabilities and enter new international markets (see: LevelBlue Buys Aon Cyber Unit for Global IR, Litigation Help).

A changing competitive landscape, economic pressures and evolving customer needs for security have driven a wave of acquisitions between EDR and MDR firms. Sophos in February bought MDR provider Secureworks for $859 million to boost its threat intelligence, detection and response, and MDR provider Arctic Wolf bought the struggling Cylance endpoint security business from BlackBerry for $160 million (see: MDR, EDR Markets See Wave of M&A as Competition Intensifies).

“You’ve got a lot of competition for what is a successful market,” Forrester Vice President and Principal Analyst Jeff Pollard told SMG in February. “But whenever you get that much competition, it’s going to mean M&A happens, because you just need to consolidate.”