LevelBlue Buys Aon Cyber Unit for Global IR, Litigation Help

LevelBlue plans to purchase a consulting business to expand the company’s incident response and digital forensics capabilities and enter new international markets.

See Also: On Demand | Global Incident Response Report 2025

The Dallas-based managed security services firm said its proposed acquisition of London-based Aon’s cybersecurity and IP litigation consulting groups will he;p LevelBlue combine cybersecurity and legal skills to create differentiated offerings for red teaming, digital forensics and IP litigation, said chairman and CEO Bob McCullen. He said the acquisition will drive more collaboration with law firms.

“I previously ran a business called Trustwave, and we built a similar practice to the Aon cyber business,” McCullen said. “And so I’m very familiar with incident response, and then leading into other managed services, which is ostensibly what LevelBlue is very strong at. We understand how to fix threat hunting, and that is core to what our customers need.”

Aon’s cyber solutions group dates back to its November 2016 buy of New York-based risk management firm Stroz Friedberg, and today employs 300 technical professionals. The business has been led since May 2024 by David Yaches, who started at Stroz Friedberg in 2014 as head of corporate development. Yaches joined Aon through the purchase, serving as chief revenue officer for the cyber business since 2023 (see: LevelBlue Leverages AI for Threat Intel Following AT&T Split).

What Sets Aon’s Approach to Incident Response Apart

McCullen saw in the Aon consulting groups a rare opportunity to integrate a world-class incident response function that would immediately scale LevelBlue’s core capabilities. The companies shared a focus on large enterprise clients, and McCullen believed this overlap would generate significant commercial synergies – particularly with their mutual relationships with Fortune accounts.

“We heard about this at least six months ago from an investment banker,” McCullen said. “And so it was an opportunity that we thought was very exciting, and it was very synergistic with LevelBlue because they deal with a lot of Fortune accounts. And the carve out from AT&T that we did also has a lot of Fortune accounts.”

The priority post-close is to merge the incident response teams immediately, he said. A significant focus will be on reconnecting Aon’s team with previously lost insurance partners, many of whom severed ties after Aon’s acquisition of Stroz Friedberg. McCullen is confident that the team’s sterling reputation, legal credentials and industry relationships will facilitate a rapid restoration of these partnerships.

“After Aon acquired the Stroz Friedberg team, they ostensibly lost all their other insurance carriers as partners, so we’ll reestablish the relationships they had with other providers,” McCullen said. “And so we think that’ll be great for both of us.”

The breadth of Aon’s digital forensics work in areas such as malware analysis, penetration testing and root cause analysis will strengthen LevelBlue’s managed detection and response practice, McCullen said. Having a world-class IR unit positions LevelBlue at the tip of the spear when breaches occur, giving them first-call access to clients and opportunities to cross-sell broader services such as MDR or consulting, he said.

“You’re the tip of the spear with IR,” McCullen said. “So, you get that first call from a customer when there’s an issue, and then you’re in a great position to offer them solutions, either consulting services or managed services, to help fix the problem. And you’ve seen other firms in the industry do that as well, whether it’s Palo or CrowdStrike or others.”

How LevelBlue Plans to Integrate Aon’s Cyber Consulting Unit

LevelBlue will integrate Aon’s case management platform into the company’s cloud platform, enhancing workflow visibility and response management for clients. And LevelBlue’s MDR tool will benefit from real-time threat data coming from the IR team’s engagements. The plan is to use machine learning to continuously feed new threat indicators into MDR, helping it auto-detect and auto-respond to threats.

“They have case management software that they’ve developed, and we’ll integrate that into our cloud platform so that all of our customers have that capability if they’re using incident response,” McCullen said. “And then, we’ll also extend our ML in our MDR platform.”

Unlike most incident response firms that separate legal and technical work, Aon brings these together under one roof. This dual-capability model is especially valuable for companies involved in M&A, where analyzing the security and IP implications of a software acquisition is critical. Many team members from Aon hold law degrees, helping them offer both technical assessments and legal compliance guidance.

“We think of it as a full-service IP capability that other incident response firms don’t typically have,” McCullen said. “It’s typically you do IP litigation and support and software analysis, or you do incident response. Here we bring that full breath, which makes us a great channel partner for law firms because law firms get involved in both.”

The Aon team already has deep relationships with law firms across the United States, Canada and the United Kingdom that LevelBlue can now tap into. Additionally, AT&T remains LevelBlue’s largest channel partner, and this deal strengthens that relationship by bringing new capabilities to AT&T’s client base. Many Aon partners overlapped with LevelBlue’s existing network, so this deal consolidates and deepens those connections.

“AT&T is our largest channel partner currently, but this expands that with relationship through not only Aon, but dozens and dozens of law firms through the U.S., Canada and in the U.K.,” McCullen said. “So, it expands our channel strategy, which is really how we’ve been super effective so far.”