For George Kurtz, CEO and cofounder of CrowdStrike, cybersecurity is not just about software. “What we do at CrowdStrike is as old as time,” he told Fortune. “It’s good versus evil. It’s a human nature story embodied in technology.”
That human-versus-machine battle has only become more urgent. The rise of generative AI has expanded both the number of cyber threats and the sophistication of cybercriminals. Against this backdrop, mergers and acquisitions, a defining feature of the cybersecurity sector carry more weight than ever. 2025 has already seen some of the industry’s largest deals, including Palo Alto Networks’ $25 billion purchase of CyberArk and Google’s proposed $32 billion takeover of Wiz.
CrowdStrike, which went public in 2019, is no stranger to M&A. On Thursday, it announced a $290 million acquisition of Madrid-based data observability startup Onum, alongside its fiscal Q2 2025 earnings. The company beat expectations but issued a softer-than-expected revenue outlook, sending its shares down about 4% in after-hours trading.
Speaking exclusively with Fortune, Kurtz emphasized that CrowdStrike’s strategy is rooted in discipline. “We like to get things at the right stage,” he said. “When you look at some of these other acquisitions, like CyberArk, you’re talking about a 20-year-old technology company with a lot of integration risk. These are big companies, and I’ve seen the movie before. When I was at McAfee, we acquired 21 companies, and never quite got them integrated… So, when it comes down to it, we’re maniacally focused on the customer experience, on making sure we’re disciplined enough to get this stuff integrated. We have a great track record of doing that.”
Onum marks one of CrowdStrike’s first deals since its much-publicized IT outage in 2024. Kurtz said the incident didn’t derail its M&A agenda but forced a pause. The company continued talking with startups, entrepreneurs, and investors, while raising its bar for potential acquisitions. The Onum deal, he noted, came together in just three months.
Why Onum
Onum, backed by Dawn Capital and Insight Partners, specializes in real-time pipeline detection an ability to analyze and flag threats in data as it is being ingested into company systems. That capability fit neatly into CrowdStrike’s ambition to expand Falcon, its flagship platform, into a next-generation SIEM (security information and event management) and AI-native SOC (security operations center).
“If you think about the data we have, we started becoming the Reddit of security data for all these AI models,” said Kurtz. “The more data we get in, the larger the moat we actually have, and the greater the opportunity we have to solve bigger and broader problems from an AI perspective. That’s really driving our vision for AI-native SOC. It’s a natural extension.”
The vision also extends into protecting AI agents, autonomous systems with access to workflows, data, and identities. “Our goal is to secure every AI agent,” Kurtz said. “An AI agent is basically superhuman… it has all of the exposure that we’re protecting against.”
Onum’s Fit Inside Falcon
CrowdStrike framed the deal as an evolution of Falcon Next-Gen SIEM into the “definitive data foundation” for agentic security and IT operations. Kurtz described Falcon as “the operating system of cybersecurity,” with data as its fuel. “Onum is both a pipeline and a filter, which will stream high-quality, filtered data directly into the platform to drive autonomous cybersecurity at scale,” he said. “This is how we stop breaches at the speed of AI while giving customers complete control over their entire data ecosystem – well beyond cybersecurity.”
Onum’s stateless, in-memory architecture enables it to deliver speed, scale, and efficiency advantages over rivals. According to CrowdStrike, Onum can:
- Deliver five times more events per second than its nearest competitor.
- Reduce data storage costs by up to 50% through smart filtering.
- Enable 70% faster incident response with 40% less ingestion overhead by starting detection before data even enters Falcon.
That approach eliminates one of the most persistent obstacles in SOC transformation: data migration. By embedding Onum’s pipeline technology directly into Falcon, CrowdStrike said it can remove reliance on third-party tools and reduce onboarding friction.
Pedro Castillo, founder and CEO of Onum, framed the deal as a natural progression of his company’s mission. “Onum was founded on the belief that pipelines should do more than transport data, they should transform data into real-time intelligence,” Castillo said. “By joining CrowdStrike, we can deliver this vision at unprecedented scale to accelerate SOC transformation on a global scale.”
He added: “Together, we’re not just combining technologies — we’re shaping the future of security operations. By uniting Onum’s data pipeline innovation with CrowdStrike’s leadership in cybersecurity, we will empower organizations with unmatched visibility, speed, and resilience in a digital-first world.”
CrowdStrike’s Deal History
Onum is the ninth acquisition for CrowdStrike since 2017. Previous deals include Humio, acquired in 2021 for $400 million, and Flow Security, bought in 2024 for a reported $200 million. For Kurtz, catching companies at the right moment is key.
“There are some companies that are obviously richly-valued,” he said. “I think some of these companies don’t realize that they are starting to move into zombieland: You look at their last round valuation, and it might be great for them, but it’s expensive and it’s not necessarily actionable for a lot of companies, even ours. So, you start to hit these big, multi-billion dollar valuations with not a lot of ARR, relatively speaking, and your pool of buyers dramatically shrinks. That’s why we like to catch them in the sweet spot of where we can add value, and that value accrues to CrowdStrike’s shareholders.”
Kurtz warned that generative AI has “democratized destruction.” Sophisticated knowledge once held by a few experts is now widely available, compressing the window defenders have to react. “The biggest thing is that you’re really compressing the timeframe that the good guys have to be able to deal with these problems, because the bad actors are moving so much faster now,” he said.
One thing, he added, is certain: “We know there’s going to be a greater need for security tomorrow than there is today.”
