Bank of America to acquire cybersecurity consultancy MDSec, deal set for late 2026

Bank of America said it plans to acquire MDSec Consulting Limited, an information security consultancy, as the bank continues to expand its capabilities in managing cyber risk. The announcement, reported in a technology-focused business brief, frames the transaction as a targeted purchase of specialized cybersecurity expertise rather than a broader technology merger.

Under the deal terms outlined publicly, Bank of America expects the acquisition to be completed during the fourth quarter of 2026. Closing is described as contingent on receiving required approvals and meeting customary conditions for transactions of this type, though no specific regulatory approvals were listed in the announcement as it circulated.

MDSec Consulting Limited is described in the report as an “information security specialist.” While the public summary did not provide additional detail on the firm’s offerings, clients, or geographic footprint, the name and categorization suggest a focus on advisory and implementation support in areas such as security strategy, risk assessment, and the operational work that helps financial institutions respond to threats and vulnerabilities.

Bank of America has been steadily increasing its attention on cybersecurity over recent years, in part because financial services are frequent targets for ransomware, phishing, and attempts to compromise customer data and internal systems. In that context, acquiring an external specialist can be a way to add experienced security practitioners and delivery capacity more quickly than relying solely on internal hiring or contract staffing.

For large banks, cybersecurity is not a standalone expense, but a core component of risk management. The ability to anticipate emerging threats, validate that controls work in practice, and respond effectively when incidents occur tends to require both technology and deep domain knowledge. Consulting firms, in particular, can provide structured assessments, frameworks, and tailored implementation support that banks can integrate into their existing governance and control environments.

The deal also comes at a time when banks face a higher bar for operational resilience and third-party risk management, especially around how security controls are measured and enforced across vendors. Acquiring a consultancy can simplify parts of that chain by bringing certain capabilities in-house, though it also shifts responsibility to the bank for integrating teams, processes, and service delivery into its operating model.

What was not disclosed in the public report includes the transaction price, payment structure (such as cash versus stock), the expected impact on earnings, and whether the acquisition is intended to be accretive in the near term. The announcement likewise did not specify how many employees would transfer, whether there are any retention arrangements, or how the acquired organization would be organized within Bank of America after closing.

Looking ahead, investors and customers will likely focus on whether Bank of America provides additional deal details as regulators review the acquisition and as the bank moves toward a fourth-quarter 2026 close. The next datapoint to watch is any further disclosure around the timeline for approvals and the scope of what Bank of America expects to gain from MDSec’s capabilities once the transaction is finalized.