CrowdStrike has reached an agreement to acquire core technology assets from XM Cyber, the Israeli cybersecurity firm that was purchased by German retail and technology conglomerate Schwarz Group for approximately $700 million in 2019, according to a Calcalist report. The deal marks a notable return of XM Cyber’s intellectual property to the cybersecurity industry’s front lines, channeled through one of the sector’s most prominent publicly traded players.
The transaction underscores a broader trend of established cybersecurity vendors absorbing specialist attack-surface management capabilities as enterprise threats grow more sophisticated. XM Cyber, founded in 2016 by veterans of Israel’s intelligence community, built its reputation around attack-path management — technology that maps how an adversary could move laterally through a corporate network to reach critical assets. That capability is now set to be integrated into CrowdStrike’s Falcon platform.
From Schwarz Group Back to the Cyber Sector
XM Cyber’s journey reflects the complex lifecycle of Israeli technology exits. When Schwarz Group — the privately held German conglomerate best known for operating the Lidl and Kaufland retail chains — acquired the company in 2019, the deal was widely viewed as an unusual pairing: a bricks-and-mortar retail empire absorbing a niche cybersecurity innovator. Schwarz had been building out an internal technology and cloud division, and XM Cyber was intended to serve both internal security needs and a broader commercial customer base.
Five years on, the decision to sell the technology to CrowdStrike suggests Schwarz is rationalising that portfolio, potentially concluding that operating a standalone cybersecurity product business sits outside its core strategic priorities. Financial terms of the current transaction were not disclosed. CrowdStrike’s share price has experienced significant volatility over the past twelve months, including fallout from a high-profile global software outage in mid-2024 that temporarily weighed on customer sentiment, though the company has since reported continued growth in annual recurring revenue, which stood at approximately $4.2 billion as of its most recent fiscal year.
Attack-Path Intelligence as a Platform Differentiator
For CrowdStrike, the acquisition of XM Cyber’s technology represents a calculated expansion of its exposure management capabilities. Attack-path management addresses one of the more persistent gaps in enterprise security: understanding not merely whether vulnerabilities exist, but which combination of weaknesses an attacker could chain together to cause the most damage. This context-aware approach is increasingly valued by chief information security officers who are under pressure to prioritise remediation efforts across sprawling, hybrid cloud environments.
The integration of XM Cyber’s graph-based attack simulation engine into the Falcon platform could allow CrowdStrike to offer customers a continuous, automated picture of their exploitable risk surface — a capability that differentiates the platform from point-in-time vulnerability scanners. Analysts have noted that the exposure management segment is one of the faster-growing areas within enterprise security spending, as organisations shift from reactive incident response toward proactive risk reduction. The deal also reinforces Israel’s standing as a primary source of advanced cybersecurity intellectual property, with the country producing a disproportionate share of globally acquired security technologies relative to the size of its economy.
CrowdStrike has not provided a formal integration timeline, and it remains to be seen how quickly XM Cyber’s capabilities will be made available across the Falcon customer base. As enterprises continue to grapple with the challenge of governing complex technology deployments — a pressure explored in our coverage of AI governance challenges — the appetite for unified platforms that consolidate visibility and control is only expected to grow. Investors tracking the broader cybersecurity sector will also be watching whether this acquisition signals further consolidation activity among mid-tier vendors, a dynamic that has been building momentum across the technology industry and is explored in our analysis of market concentration risks.