Palo Alto Networks to buy container security startup Twistlock, which had raised $63M+, for $410M, and serverless security startup PureSec, which raised $10M
Ron Miller / TechCrunch :
Context & Ripple Effects
This deal lands less than a year after Palo Alto Networks' first move into cloud infrastructure security, the $173M RedLock acquisition for cloud instance monitoring, and months after Twistlock's $33M Series C valued its container-security business at a fraction of today's price. Buying Twistlock and PureSec together signals Palo Alto wants both containers and serverless covered in one sweep rather than piecemeal.
The pattern only intensified afterward: DevOps-pipeline risk firm Cider Security, data-security startup Dig Security, and enterprise-browser maker Talon Cyber Security all followed into Palo Alto's portfolio, making this 2019 double-deal an early template for how the company builds its cloud-native security stack.
First-order effects
- Twistlock's and PureSec's container- and serverless-security products are folded into Palo Alto's portfolio, giving its existing firewall and cloud customers a native answer for workloads they were previously securing with point tools.
- Twistlock exits having turned just over $63M raised into a $410M sale, while PureSec's $10M-backed team joins alongside it — both founders and investors cash out to a single buyer.
Second-order effects
- Independent container-security vendors lose their most credible acquirer-neutral positioning and face pressure to either scale toward their own exits or compete against a bundled Palo Alto offering inside shared enterprise accounts.
- Cloud providers and Kubernetes-platform vendors see a major security incumbent claim the workload-protection layer, raising the bar for any partner or reseller strategy built around standalone container-security tooling.
Third-order effects
- If the subsequent Cider, Dig, and Talon deals are any guide, network-security incumbents will keep buying their way into cloud-native layers rather than building them, consolidating what was a field of startups into platform suites.
- The premium over capital raised here — roughly six times Twistlock's total funding — sets a reference price for cloud-native security exits, shaping how founders and VCs in the category negotiate.
The trend: Legacy network-security platforms are assembling cloud-native security stacks through serial acquisition, with Palo Alto Networks' cadence of container, DevOps, and data-security purchases setting the pace.