Cybersecurity firm Rapid7 is acquiring DivvyCloud, a cloud security and governance startup, for $145M in cash and stock
Ron Miller / TechCrunch :
Context & Ripple Effects
Rapid7 has spent years converting its vulnerability-management base into a broader security company: after a $30M raise earmarked for new cybersecurity initiatives in 2014 and an IPO filing in 2015, it now has the currency to buy rather than build. The $145M cash-and-stock purchase of DivvyCloud extends it into cloud security and governance, mirroring the buy-vs-build playbook peers like FireEye used when it paid $250M for Verodin.
What makes this deal notable in hindsight is that it opened a run of acquisitions: within roughly a year Rapid7 added Kubernetes security via Alcide and then threat intelligence via IntSights, each targeting a different layer of the stack.
First-order effects
- Rapid7 gains DivvyCloud's cloud security-posture and governance technology outright, adding a workload it did not have to develop in-house while giving DivvyCloud's backers liquidity in cash and stock.
Second-order effects
- Rivals selling adjacent security tooling — FireEye among them, which had just paid $250M for Verodin — face a consolidating buyer with public-market stock to spend, pressuring them to acquire comparable cloud-governance capabilities before pricing power shifts.
Third-order effects
- The pattern held: Rapid7 followed with the $50M Alcide acquisition for Kubernetes security and the $335M IntSights deal for threat intelligence, indicating the DivvyCloud purchase was the first step in assembling a multi-product platform rather than a one-off tuck-in.
The trend: Mid-cap cybersecurity vendors are using post-IPO stock to roll up point-solution startups into consolidated security platforms, with Rapid7's acquisition cadence as a leading example.