Palo Alto Networks to acquire RedLock, which has raised $12M to help companies secure cloud instance, for $173M
Palo Alto Networks launched in 2005 in the age of firewalls. As we all know by now, the enterprise expanded beyond the cozy confines of a firewall long ago and vendors …
Context & Ripple Effects
RedLock's sale caps a fast arc: the startup had raised just $12M to secure cloud instances, and Palo Alto Networks is paying $173M for it — a steep multiple for an early-stage team. The deal extends a buying streak that began with the $105M LightCyber acquisition in 2017, which added behavioral attack detection to the firewall vendor's toolkit.
The pattern matters because Palo Alto launched in 2005 selling firewalls and has been systematically purchasing its way beyond them. RedLock's cloud-instance focus slots directly ahead of what came next in the same arc: the Twistlock and PureSec container and serverless deals seven months later, then identity-based workload control with Aporeto and security-as-code with BridgeCrew.
First-order effects
- RedLock's backers exit at roughly fourteen times the capital the company raised, while Palo Alto Networks immediately gains cloud-instance security posture management to sell alongside its core network products.
Second-order effects
- Rival cloud-security startups in adjacent categories — containers, serverless, workload identity — become obvious next targets, and indeed Twistlock, PureSec, and Aporeto were all acquired by Palo Alto within the following year.
- Competing enterprise security vendors face pressure to respond with their own cloud-native acquisitions rather than build, since Palo Alto is assembling the full stack faster than organic development allows.
Third-order effects
- If the cadence holds, cloud-native security consolidates around legacy network-security platforms: point-solution founders get premium exits, but independent cloud security vendors thin out as the firewall generation buys relevance in the cloud era.
The trend: Palo Alto Networks is executing a serial-acquisition strategy to transform from a firewall appliance vendor into a multi-domain security platform spanning network, cloud, and workload security.