Strategic consolidation and leadership in technology M&A
The year 2025 has been decisive for the Spanish technology ecosystem, with the cybersecurity sector consolidating itself as one of the key drivers of growth and resilience in mergers and acquisitions (M&A). Driven by the acceleration of digitalisation and regulatory pressure — marked by the NIS2 directive and the Artificial Intelligence Act— Spanish cybersecurity companies have not only attracted the attention of local investors, but have also become strategic assets for international corporations and private equity (PE) funds.
In this analysis, we break down the most significant transactions of the year, showing how venture capital and corporate investment are shaping a more robust digital defence ecosystem en España. Además, destacamos el papel de our specialist financial advisers, who have positioned Baker Tilly as a leader in transaction advisory services in the technology, media and telecommunications (TMT) sector during 2025.
Boom in M&A and the entry of private equity
Unlike previous years dominated by venture capital (VC), 2025 has been a year marked by corporate M&A and the strategic presence of private equity. The Spanish market has moved from a phase of initial growth to a process of consolidation of ‘national champions’.
Nazca Capital and Ravenloop: MDR specialists
One of the most significant transactions was Nazca Capital's entry into Ravenloop, a specialist in managed cybersecurity services (MSSP) and managed detection and response (MDR). This acquisition reflects the trend among private equity funds to invest in companies with recurring revenues, high customer retention and scalable technology. For Nazca, Ravenloop is not only a financial investment, but also a platform for future acquisitions (buy-and-build, consolidating its presence in a critical market niche.
Minsait (Indra) and expansion in Latin America
Spanish giant Minsait (Indra) strengthened its cybersecurity division with the purchase of Brazilian company Rust Consultoresa cross-border operation that combines:
- Geographical expansion: Rust positions Minsait in Brazil, Latin America's largest cybersecurity market.
- Specialisation in auditing and consulting: Rust's capabilities expand Minsait's comprehensive (360º) cybersecurity offering, especially in regulatory compliance.
Hiberus and Telefónica Tech: portfolio optimisation
Another notable example was Hiberus's acquisition of Telefónica Tech's business in Chile, Colombia and Mexico. This carve-out allows Hiberus to incorporate specialised talent and a premium portfolio, reflecting the trend towards portfolio optimisation and the importance of M&A advisors in complex international transactions.
Cross-border M&A: Spain on the global radar
Spanish companies no longer just export services; they export high-level intellectual property. Two transactions illustrate this reality:
- Lumu acquires Maltiverse: US company Lumu has acquired Spanish threat intelligence platformthreat IntelligenceMaltiverse, integrating its ability to correlate massive threat feeds. The deal demonstrates that Spanish cybersecurity engineering is competitive on a global scale.
- Ory acquires BoxyHQ: In the field of open source and corporate identity management, the acquisition highlights the value of ‘security by design’ solutions and the protection of critical infrastructure.
The dynamism of the sector would not be possible without the support of specialised financial advisors. In 2025, Baker Tilly established itself as the leading technology M&A advisor in Spain for transactions in the TMT sector, facilitating the purchase and sale of technology companies and advising on the growth and consolidation strategy of cybersecurity companies.
Venture capital boosts cybersecurity
Although M&A dominated the headlines, venture capital maintained a steady flow of investment towards high-potential start-ups:
- Zynap: A leader in cyber intelligence, it received funding rounds from Edan Ventures, KFund and Kibo Ventures, highlighting the intersection between cybersecurity and data analysis as an area of high international growth.
- Equixly: With investment from 33N Ventures, it focuses on API security, a critical vector in microservice architectures.
- Heuristik: Specialising in biometrics and digital identity, it is expanding its secure identification solution in sectors such as healthcare.
- Steryon and 8Layers: Startups advancing network security and infrastructure protection in the face of increasing industrial cyber espionage.
Strategic acquisitions trends in 2025
When analysing the year's movements, three key trends among buyers can be identified:
- Supply chain security : Following global incidents, monitoring supplier and partner networks is prioritised.
- Integration of AI into cyberdefence: Companies such as Maltiverse, Ravenloop, and Zynap incorporate artificial intelligence to automate incident response.
- IT/OT convergence: The acquisition of industrial security specialists reflects the need to protect factories and connected critical infrastructure.
The M&A market in 2025 reflects greater maturity compared to the 2021-2022 cycle. Valuations are adjusted to EBITDA in M&A and efficient growth in VC. Cybersecurity is consolidating its position as a strategic expense, indispensable for CEOs and boards of directors, given the reputational and financial impact of ransomware attacks.
Spain, leader in cybersecurity and M&A
2025 closes as a historic year for cybersecurity in Spain. The influx of private equity funds such as Nazca, the ambition of corporations such as Indra and Hiberus, and the success of start-ups such as Zynap and Maltiverse paint a picture of a competitive and robust ecosystem.
The role of specialised M&A advisors, led by Baker Tilly, has been decisive in guiding the purchase and sale of technology companies in complex transactions. The trend for 2026 points to further consolidation, especially around generative AI applied to cybersecurity and cloud data protection, positioning Spain as a benchmark for digital security in southern Europe.