Invariant Labs
2025
Undisclosed
Why
Expand AI agent security.
Impact
Core of Snyk's AI security push.
Outcome
All Invariant employees joined Snyk.
Snyk
CybersecurityFounded 2015- HQ today: Boston, Massachusetts, United States & London, United Kingdom
Reviewed by Swet Parvadiya
Company data updated: October 2026
Acquisitions
Snyk Acquisitions
3
Major Deals Covered
What are Snyk's biggest acquisitions?
This page covers 3 major deals from 2020 to 2025, each with its price where disclosed and the reason behind it.
- Major deals covered
- 3
- First deal
- 2020
- Most recent
- 2025
| Company | Year | Price | Purpose |
|---|---|---|---|
| DeepCode | 2020 | Add AI-based static code analysis. | |
| Enso Security | 2023 | Enter ASPM. | |
| Invariant Labs | 2025 | Expand AI agent security. |
- What companies has Snyk bought?
- Major acquisitions by Snyk documented here include Invariant Labs (2025), Enso Security (2023) and DeepCode (2020).
- What is Snyk's most recent acquisition?
- The most recent Snyk acquisition documented here is Invariant Labs, in 2025.
Enso Security
2023
Undisclosed
Why
Enter ASPM.
Impact
Launched Snyk AppRisk.
Outcome
Integrated into AppRisk.
DeepCode
2020
Undisclosed
Why
Add AI-based static code analysis.
Impact
Basis of Snyk Code and DeepCode AI.
Outcome
Integrated as Snyk Code.
Snyk's Growth & Acquisition Strategy
Snyk is repositioning around securing AI-driven software development. It bought Zurich-based Invariant Labs in June 2025 to research threats to AI agents, such as Model Context Protocol (MCP) vulnerabilities and tool poisoning, and is building an AI-native security platform alongside its existing scanners. The board approved a 2025 reorganisation aimed at free cash flow and profitability, and has been searching for a permanent CEO with deep product and AI experience.
How Snyk Makes Money
Snyk sells subscription software (SaaS). A free tier for individual developers and open-source projects drives bottom-up adoption; paid Team and Enterprise plans are priced mainly by the number of contributing developers and the products used. Revenue comes from four core scanning products (Snyk Open Source for dependencies, Snyk Code for proprietary code, Snyk Container and Snyk IaC), plus the AppRisk application security posture management (ASPM) layer and newer AI security offerings built on the 2025 Invariant Labs acquisition. Enterprise deals are sold directly and through cloud marketplaces such as AWS. In 2025 the United States produced 65% of revenue and the UK 8%.
Snyk Acquisitions FAQ
What was the landmark acquisition of DeepCode in 2020?
In August 2020, Snyk acquired Swiss AI code analysis pioneer DeepCode, an ETH Zurich spinoff. DeepCode used symbolic AI and machine learning to scan source code 50x faster than legacy SAST engines, powering Snyk Code.
What was the acquisition of Enso Security in 2023?
In June 2023, Snyk acquired Tel Aviv-based Enso Security, the pioneer of Application Security Posture Management (ASPM). The acquisition formed the technological core of Snyk AppRisk, enabling enterprise CISOs to discover and manage application risks at scale.
What was the acquisition of FossID in 2021?
In May 2021, Snyk acquired Swedish software compliance firm FossID, integrating its advanced C/C++ scanning engine and comprehensive open-source license compliance detection into Snyk Open Source.
What was the acquisition of CloudSkiff (driftctl) in 2021?
In October 2021, Snyk acquired French startup CloudSkiff, creators of the open-source tool driftctl, embedding infrastructure-as-code (IaC) drift detection directly into Snyk IaC to prevent cloud security misconfigurations.
What was the acquisition of Manifold in 2021?
In January 2021, Snyk acquired Canadian developer marketplace platform Manifold, absorbing its engineering team to accelerate developer platform self-service, API integrations, and CLI onboarding.
What was the acquisition of Helios in 2024?
In early 2024, Snyk acquired Tel Aviv-based cloud-native runtime observability platform Helios, using its OpenTelemetry distributed tracing to map application runtime behavior back to source-code security flaws.
How did the DeepCode acquisition give Snyk an AI advantage over competitors?
DeepCode's proprietary symbolic AI provided explainable, mathematically provable code analysis that avoids generative AI hallucinations, allowing Snyk Code to achieve industry-low false positive rates.
How does Snyk integrate acquired technologies into its platform?
Snyk rapidly deprecates standalone brand names, re-architecting acquired software to integrate directly into its unified developer workflow, CLI, and single enterprise reporting dashboard.
What is Snyk's M&A strategy under CEO Peter McKay?
Snyk pursues disciplined programmatic acquisitions targeting innovative developer tooling, specialized language scanners, runtime telemetry, and AI security startups that expand its total addressable market.
How did Snyk's acquisitions expand its coverage across the software lifecycle?
Acquisitions transformed Snyk from a single-product open-source scanner into a full-stack platform covering open-source dependencies (FossID), custom code (DeepCode), infrastructure scripts (CloudSkiff), application posture (Enso), and runtime telemetry (Helios).
What is the role of open-source stewardship in Snyk's acquisitions?
When Snyk acquired tools with passionate open-source communities (like driftctl), it continued supporting free open-source releases while commercializing enterprise governance modules.
What future M&A areas is Snyk targeting?
Snyk is targeting emerging startups specializing in LLM application security (OWASP Top 10 for LLMs), prompt injection defense, and autonomous AI agent runtime security.
Related M&A Histories
Compare corporate acquisition records, deal values, and strategic targets
Explore Snyk
Core profile pages, founders and related research hubs for this company.