Capillary Technologies: M&A Activity

The leadership read

The fraud exposed a specific vulnerability that acquisitive SaaS roll-ups routinely underweight: the internal control gap that opens between signing and full integration. SessionM closed in February 2026; Kognitiv was absorbed the prior year. A step-down subsidiary acquired recently, operating across a different jurisdiction and currency, almost certainly had not yet been brought onto Capillary's treasury authorization frameworks, identity-verification protocols, or transaction-monitoring systems. Deepfake-enabled social engineering targeting senior management impersonation is effective precisely when a newly integrated entity still runs its own finance operations under legacy controls. The €3M loss is bounded; the integration-control exposure it reveals is structural. This sits within a dense M&A period for Capillary specifically, though the 12 related signals tracked over the last 90 days span sectors from enterprise networking to healthcare and real estate, offering limited direct comparables in martech or loyalty SaaS. The pattern worth noting is broader: multi-acquisition programs that compress integration timelines create audit-surface fragmentation that threat actors have begun to exploit systematically, and Capillary's situation is unlikely to be isolated. Across companies executing cross-border acquisition programs at this pace, the pattern concentrates demand in two functional areas: financial-controls and treasury operations leadership capable of enforcing unified authorization protocols across newly absorbed entities, and cybersecurity risk functions that extend enterprise-grade threat detection and identity governance into subsidiaries before full integration is complete. Both are undersupplied relative to deal velocity in growth-stage SaaS operators expanding through acquisition into new geographies.