Corporate America Spends a Record Deal Year Taking Itself Apart. Breaches Hit a Record $4.99 Million.

In the wake of Bill Gates' 6000-word essay warning about the AI-upheaval to come, I wanted to focus on a specific pillar of that concern: cybersecurity.

Three data points stand out, all from the past six months.

Forescout's Vedere Labs tested 50 AI models across commercial, open-source, and underground releases. A year ago, 55% of models tested failed basic vulnerability research and 93% failed at writing a working exploit. In the 2026 round, every model tested completed vulnerability research tasks and half produced working exploits with no human assistance.

Palo Alto Networks' Unit 42 pointed an agentic system at 3,915 open-source projects and confirmed 14,090 vulnerabilities in two months. 99.4% had never been reported. 40% were rated high or critical.

CrowdStrike's 2026 Global Threat Report counted a 42% year-over-year increase in zero-days exploited before public disclosure.

Smarter AI tools mean attackers are growing smarter, but so are defenders. The larger problem, then, comes from broadening opportunities for attacks to take place. Put more simply, a defender facing three known weaknesses can close three known weaknesses. A defender facing thirty possible ones has to decide which three to close first, and be wrong about the other twenty-seven at their own cost.

The second problem is when defense gets built. Security spending has historically been reactive, and IBM's 2026 Cost of a Data Breach Report puts a number on the habit: over 50% of breached organizations run AI agents for threat detection and containment, but only 18% now apply them to vulnerability management. Detection is what you do once someone is already inside. Vulnerability management is what you do so they can't get in in the first place. Defenders are reacting to attacks because proactively managing vulnerabilities is costly, operationally difficult, and requires budget for threats that have not yet materialized.

The third problem is price. IBM's framing is straightforward: attacks can be launched for thousands while breaches cost millions. The global average breach reached a record $4.99 million in 2026, up 12%. AI-enabled breaches, which now account for one in four of all malicious breaches, averaged $6 million. Organizations running AI and automation across prevention, detection, investigation, and response saved close to $2 million per breach and closed them roughly two months faster, which is the good news, and one in four organizations still have not adopted any of it.

None of this is a story about attackers having better tools. The asymmetry is structural. An attacker needs one of thirty outcomes to work. A defender has to assess all thirty, get budget approved for the ones that have not happened yet, and push each fix through a change advisory board. The attacker has no change advisory board.

The headline M&A story in 2026 has overwhelmingly been about acquisitions. Announced global deal value hit $3.19 trillion through July, up 36% year over year. Underneath them, a striking number of large US acquirers spent the same seven months taking themselves apart.

Comcast closed the Versant separation on January 2. Becton Dickinson closed the Reverse Morris Trust of its Biosciences and Diagnostic Solutions business with Waters on February 9, taking a $4 billion cash distribution and handing Becton Dickinson shareholders 39.2% of the combined entity. Aptiv completed the Versigent spin-off on April 1. Honeywell finished on June 29, distributing 316,939,750 shares of Honeywell Aerospace on a one-for-two basis and completing a three-way break-up that started with Solstice Advanced Materials in October 2025. Honeywell Aerospace replaced Conagra Brands in the S&P 500 the day it listed. S&P Global completed the Mobility separation on July 1. Middleby closed Midera on July 6.

The pipeline of expected separations is even heavier. Comcast announced the NBCUniversal and Sky spin-off in June, targeted for mid-2027, retaining up to 19.9% for a year with a stated intent to monetize it tax-efficiently. Eaton announced plans to separate Mobility in January, then revised the structure in June: the business will now be separated and combined with Dana in a Reverse Morris Trust targeted for Q1 2027. Corteva has set October 1 for the separation of its Seed business from Crop Protection. KBR has set January 4, 2027 for Trinzic.

These separations are not a rotation away from buying. Eaton disclosed integration and transaction costs tied to five acquisitions while simultaneously advancing the separation of Mobility. Comcast ran three portfolio actions in six months: one separation completed, one business sold, one spin-off announced. Lazard found the total value of completed divestitures and spin-offs above $1 billion grew 50% year over year in 2025. Buy and sell are often performed by the same corp dev teams within an organization, and in 2026 divestiture work is being largely overshadowed by the record buying year.

Not all of these deals are reaching the finish line. Kraft Heinz paused its planned separation on February 11, five months after announcing it, avoiding roughly $300 million of dis-synergies in 2026 and redirecting $600 million into the US business instead. No new timetable has been announced. A 2022 KPMG study put the cancellation rate for corporate spin-offs at about one in ten - a slightly outdated number - but one that gives an approximation for this kind of reversal.

Why This Matters for M&A Professionals
Separation work is corp dev work, but it is a different muscle than acquisition: carve-out financials, transition services agreements, stranded cost analysis, and standing up a separation management office. S&P Global's CEO described the Mobility separation as 15 months of work by two teams. Experience on both sides of the transaction is therefore increasingly valuable: acquisitions teach you how to put businesses together; separations teach you how to pull them apart without destroying value in the process.