Bank of America
A major bank acquiring UK offensive-security consultancy MDSec to build in-house red-team capability.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Bank of America, founded in 1904 and based in Charlotte, North Carolina, announced in August 2026 that it is acquiring MDSec Consulting, a UK penetration-testing and offensive-security consultancy, to build in-house red-team and offensive-security capability rather than rely solely on external firms.
It is a defensive-scale move by a major bank rather than a market-facing security product.
Innovation Matrix Assessment
Acquiring an outside firm for penetration-testing capability rather than developing security tooling in-house.
One of the world's largest banks, with substantial resources to integrate and scale acquired security expertise internally.
The announced MDSec acquisition (August 2026) is a notable, if singular, move into cybersecurity M&A.
An internal capability build via acquisition, not a market-facing security innovation.
MDSec has a strong industry reputation in penetration testing, lending credibility to the acquired capability.
Relevant primarily to Bank of America's own security posture rather than to the broader CISO market, since the capability is not sold externally.
Why CISOs Should Care
Bank of America is acquiring MDSec Consulting (UK infosec/penetration-testing consultancy), announced August 2026, signaling the bank is building in-house offensive-security and red-team capability rather than relying solely on external firms.
What Makes It Different
As a major global bank bringing a specialist penetration-testing consultancy in-house, Bank of America differs from typical financial-sector security buyers by directly owning offensive-security expertise rather than only purchasing it as an outside service.
The Matrix Verdict
38/100 — INCUMBENT
A major global bank absorbing a respected boutique offensive-security consultancy (MDSec) to strengthen internal red-team and penetration-testing capability, a defensive-scale move rather than a market-facing security product.
Editorial Note: Claims vs. Verified Findings
Bank of America's primary business is global banking and financial services; the MDSec acquisition builds internal security capability and is not a cybersecurity product offering to external customers.
Sources
- Bank of America Newsroom
- Coverage of the Bank of America-MDSec Consulting acquisition (August 2026)
Alternatives to Bank of America
CyCognito
Agentless attack surface management platform that maps organizations' entire external footprint, including subsidiaries and shadow assets, using graph-based…
Armis (a ServiceNow company)
Agentless asset intelligence platform discovering and assessing every connected IT, OT, IoT and medical device, now part of…
CybelAngel
External attack surface management and digital risk protection platform that scans the open, deep, and dark web for…
watchTowr
Singapore-based platform combining external attack surface management with continuous automated red teaming to validate whether exposures are actually…
Zafran Security
New York and Tel Aviv-founded exposure management company that maps attack paths across existing security tools to focus…
Axonius
New York-based CAASM pioneer that aggregates data from hundreds of existing tools to build a unified, agentless asset…