The talks and the numbers at stake
Palo Alto Networks is reportedly in talks to acquire Clutch Security, a startup that focuses on protecting AI agents' access to enterprise systems. The proposed deal is worth $500 million in cash, to which payments tied to the achievement of subsequent milestones would be added. The news, reported by TechCrunch, is based on a person familiar with the discussions; neither Palo Alto Networks nor Clutch responded to requests for comment. According to the outlet, The Information was the first to report the existence of the talks.
Clutch is three years old and was valued at $85 million in January 2025, in a $20 million Series A round led by Lightspeed and SignalFire. According to the source, the startup is now approaching $10 million in annual recurring revenue. The proposed price would therefore correspond to about 50 times ARR, a metric commonly used to value software companies.
Why such a high valuation
The high multiple would not be an isolated case in the market for security against AI-driven attacks. TechCrunch reports that Upwind, a startup that uses AI to protect cloud infrastructure, recently rejected an acquisition offer from DataDog that valued it at about 40 times ARR. Read together, the two cases indicate that investors are awarding a premium to companies capable of guarding the new access points created by AI agents.
The acquisition strategy and the competitive landscape
If the deal goes through, it would be Palo Alto Networks' seventh acquisition this year, according to PitchBook. The group has a history of growing through acquisitions rather than in-house development and in 2026 stepped up dealmaking in response to the rise in AI-driven cyberattacks. In September it reportedly acquired Console, a startup that automates IT help desk tasks with AI agents, for $500 million in stock and cash. Other deals this year include Embrace for $325 million, Chronosphere for $2.95 billion and Koi for $231 million, according to the cited regulatory filings.
Clutch's competitors have also been subject to consolidation: Cyera, valued at $12 billion at the start of the year, reportedly acquired Oasis Security for $1 billion, while Cisco reportedly bought Astrix for about $400 million, according to Calcalist. However, essential elements remain to be verified, starting with official confirmation of the talks and the actual terms of the performance-linked payments. The data on valuation, ARR and multiples come from a single source and have not been confirmed by the companies.
