Why a Cisco-Axonius Deal Makes Sense, and Why It Might Not

•
January 5, 2026    

Cisco has leaned heavily on acquisitions to become the world’s third-largest security vendor, trailing only Microsoft and Palo Alto Networks in annual cyber revenue.

See Also: Going Beyond the Copilot Pilot – A CISO’s Perspective

The San Jose, California-based networking giant organically built out a network firewall business, then got into SD-WAN by spending $1.2 billion on Meraki in 2012 and $610 million on Viptela in 2017. A year later, Cisco bought its way into identity with the $2.35 billion purchase of unified access security and multi-factor authentication provider Duo Security.

Cisco made its biggest splash in March 2024 with its $28 billion acquisition of Splunk, giving the company a market-leading position in both observability and SIEM. Along the way, Cisco has made dozens of tuck-in security acquisitions, buying emerging startups with capabilities in everything from securing artificial intelligence apps to protecting enterprise communications to enforcing policies across public cloud environments.

Now, Cisco is eyeing what would be its third-largest cybersecurity acquisition ever, Calcalist reported: a $2 billion buy of New York-based asset management vendor Axonius. The Israeli business publication said Sunday the two sides are in advanced negotiations. Axonius denied the Calcalist report, while a Cisco spokesperson told Information Security Media Group it stands by and confirms the Axonius statement (see: Deepwatch, Axonius Carry Out Steep Layoffs Amid Surge in AI).

“Axonius is not in talks to be acquired by Cisco,” a company spokesperson told ISMG in an emailed statement. “Our strategy is to build a durable, independent company. We are focused on execution, serving our customers and continuing our growth. That is where our attention is.”

Could Axonius Help Address Cisco’s Security Slump?

Despite the size of Cisco’s security unit, the company has struggled to grow the business organically. In the company’s most recent fiscal quarter, which ended Oct. 25, Cisco’s security sales fell to $1.98 billion, down 2% from $2.02 billion the year prior. Of the 19 publicly traded security vendors tracked by Omdia, Cisco was the only one with falling sales (Trend Micro and Rapid7 were next-worse with 2% growth).

Cisco said its decline in security sales was partly driven by Splunk customers shifting from fewer on-premises deals to more cloud subscriptions, as well as a revenue drop for Cisco’s prior generation products.

Axonius’s offering could complement the threat intelligence, detection and response capabilities Cisco inherited from its acquisition of Splunk, which the company has since integrated with its own XDR tool. Axonius said it focuses on minimizing the attack surface, managing software and application lifecycles, unifying exposure findings and unifying IAM program management and security.

Axonius most directly competes against Armis, which 13 days ago agreed to be acquired by ServiceNow for $7.75 billion. Armis’ offering is somewhat broader than Axonius’ offering, and includes on-prem and SaaS-based OT and IoT security, medical device security, and vulnerability prioritization and remediation. Armis is also significantly larger than Axonius, disclosing $300 million in ARR while the later has just $100 million (see: Why ServiceNow Is Eyeing a $7B Buy of Venture-Backed Armis).

Axonius’s growth in recent years has been fueled by $200 million in Accel-led Series E extension funding in March 2024 at a $2.6 billion valuation, as well as the acquisition of medical device security startup Cynerio for more than $100 million in July. The Cynerio transaction helps Axonius manage and secure the entire clinical environment from traditional IT infrastructure to connected medical devices.

The company in November laid off just under 100 people, or approximately 11% of its workforce, in what a company spokesperson called “a difficult, but strategic business decision to sharpen our focus for future growth.” Axonius has been led since its inception by New York-based Dean Sysman, who spent more than five years in Israel’s Unit 8200 military intelligence branch and rose to the rank of captain.

Competing and Winning Against Palo Alto Networks

Buying Axonius could be a growth catalyst for Cisco in the increasingly competitive security operations landscape and provide a much-needed shot in the arm around revenue as Cisco cross-sells Axonius’s asset management technology to its base of more than 300,000 customers. And with Armis exiting the market, Axonius is now the largest and most mature standalone asset management firm available.

Owning Axonius would give Cisco a stronger head-to-head position against Palo Alto Networks around security operations, with the latter building XSIAM organically in October 2022, buying IBM QRadar’s SaaS business for $1.14 billion in September 2024 and transitioning those customers to XSIAM, and agreeing in November 2025 to buy next-gen observability platform Chronosphere for $3.35 billion.

Cisco already has the observability and SIEM pieces to compete against Palo Alto Networks – with a significant market share advantage to boot – courtesy of Splunk. Palo Alto Networks already offers attack surface management through Cortex Xpanse – which is based off the company’s 2020 buy of ASM pioneer Expanse for $800 million – and adding Axonius would give Cisco feature parity in that market.

But with Cisco’s acquisition of Splunk being less than two years old, attempting to digest another multi-billion purchase in the same operating segment in such short order could lead to integration challenges and distract Cisco from extracting as much value from the Splunk deal as possible. Cisco has struggled over the years with driving growth in acquired assets, and stacking multiple deals could amplify the challenge.

Getting into asset management with Axonius poses a risk given the current underperformance of Cisco’s security business relative to peers, but failing to take decisive action means Cisco could get shut out of the critical asset management market entirely or face a longer and significantly more complicated path to getting a foothold in the space.