❌

Normal view

There are new articles available, click to refresh the page.
Today — 25 January 2026Main stream
Before yesterdayMain stream

Seattle-area startup Included acquired by Phenom in HR software deal

✇GeekWire
By: Lisa Stiffler
14 January 2026 at 19:59
Included co-founders, from left: Raghu Gollamudi, Laura Close and Chandan Golla. (Included Photo)

Seattle-area startup Included announced Wednesday that it has been acquired by Phenom, a global human resources company based in Pennsylvania. Terms of the deal were not disclosed.

Included launched five years ago in the wake of George Floyd’s murder and the widespread move by companies nationwide to better support racial and ethnic diversity throughout their operations. The startup initially focused its data analytics on DEI-related efforts, but expanded to support employee retention and engagement, faster hiring timelines, and managing performance evaluations.

Raghu Gollamudi, Included’s co-founder and CEO, called the acquisition “a major accelerator for our vision.”

“By integrating Included into Phenom’s Applied AI platform, we’ll bring more Native AI and Agentic AI into people analytics — so teams can move from static dashboards to insights that are timely, actionable, and embedded in how work actually happens,” Gollamudi said on LinkedIn.

Included has less than 15 employees, according to LinkedIn data. Jennifer Lyons, spokesperson for Phenom, said via email that “a majority of Included employees have become Phenom employees.”

She added that Included will not continue as a standalone brand. “Phenom has a successful history of natively integrating acquisitions into our broader Applied AI platform,” she said. “This approach helps existing customers of both companies succeed.”

Included was created by a trio of co-founders:

  • Gollamudi, who won Startup CEO of the Year at the 2022 GeekWire Awards, previously co-founded privacy tech startup Integris Software, which sold to OneTrust in 2020. Earlier in his career, he was a principal development lead at Microsoft for nine years.
  • Chandan Golla, the company’s chief product and customer officer, was vice president of products at Integris and worked at eBay for more than a decade.
  • Laura Close, the startup’s chief business development officer, previously worked in career consulting and in support of labor organizations. Close is now CEO of Close Cohen, a job search and executive coaching firm.

Included raised $7.3 million from investors that include FlyingFish, SignalFire, Ascend, Trilogy Equity Partners and Alumni Ventures.

While Phenom would not provide details on the deal, Lyons said, “Investors are pleased.”

Editor’s note: Story updated Jan. 15 to correct the funding total and include comments from Phenom regarding the status of former Included employees, Included’s integration and investor response.

Paramount files lawsuit against Warner Bros. amidst controversial Netflix merger

✇TechCrunch
By: Lauren Forristal
12 January 2026 at 12:06
As two major streaming platforms — Warner Bros. and Netflix — prepare for a merger, concerns continue to be voiced about the implications of the deal, which represents more consolidation in the media business.

액센추어, 영국 AI 기업 패컬티 인수···400명 AI 전문가 확보 및 CTO 체제 변화

✇CIO
6 January 2026 at 21:42

액센추어가 영국 AI 스타트업 패컬티(Faculty)를 인수하기로 합의했다고 6일 밝혔다. 인수 금액은 공개되지 않았다. 컨설팅 업계 전반이 AI 전문성을 빠르게 강화하려는 상황에서 이번 거래는 주목할 만한 움직임으로 평가된다.

액센추어에 따르면 영국에 기반을 둔 패컬티의 직원 400명은 ‘AI 네이티브 전문가’로, 향후 액센추어의 컨설팅 조직에 통합된다. 이를 통해 액센추어는 고객에게 ‘높은 수준의 AI 역량’을 제공할 계획이다. 아울러 패컬티의 AI 의사결정 인텔리전스 플랫폼인 ‘프런티어(Frontier)’도 액센추어 내부 서비스에 통합할 계획이다.

액센추어 회장 겸 최고경영자 줄리 스위트는 “패컬티와 함께 신뢰할 수 있고 고도화된 AI를 고객 비즈니스의 핵심으로 가져오려는 전략을 한층 더 가속할 것”이라고 설명했다.

이번 인수에서 이례적인 점으로 꼽히는 부분은 패컬티의 현 CEO인 마크 워너가 액센추어 글로벌 경영위원회에 최고기술책임자(CTO)로 합류할 예정이라는 점이다. 이 내용이 확정될 경우, 수백 명 규모의 기업이 전 세계 약 80만 명의 직원을 둔 대형 컨설팅 기업의 핵심 이사회 직책을 맡게 되는 셈이다.

현재 액센추어는 CTO로 라젠드라 프라사드를 공식적으로 기재하고 있다. 프라사드는 그룹 최고경영자–기술 부문이라는 또 다른 직책에 집중하기 위해 CTO 역할에서 물러날 가능성이 있는 것으로 보인다. CIO닷컴은 새로운 역할에 대해 액센추어와 패컬티에 확인을 요청했지만, 기사 작성 시점까지 답변을 받지 못했다.

AI 중심 재편

전통적인 기술 기업 인수는 대개 특허, 제품, 고객이 지닌 가치에 의해 결정된다. 그러나 AI 기업의 경우 현재는 인적 전문성 역시 그에 못지않게 중요한 요소로 부각되고 있다.

패컬티는 이러한 요소를 모두 갖춘 기업으로 평가된다. 패컬티는 2014년 당시 하버드대 양자물리학 연구원이던 마크 워너가 ASI 데이터 사이언스라는 이름으로 공동 설립했다. 이후 2019년 사명을 패컬티로 변경했다. 이는 스캔들로 논란이 된 케임브리지 애널리티카의 모기업 SCL 그룹을 통해 동일한 인턴십 프로그램에 참여했다는 의혹과 거리를 두기 위한 시도였던 것으로 해석된다. 패컬티 측은 해당 의혹을 강하게 부인해 왔다.

이후 패컬티는 영국 정부와의 협업을 통해 공공 부문에서의 프로젝트 수행 경험을 축적했다. 대표적으로 코로나19 팬데믹 기간 동안 병원 입원 수요와 인공호흡기 필요량을 예측하는 데 활용된 NHS 조기경보시스템(EWS) 구축에 참여했다.

이 같은 이력은 최근 액센추어의 방향성과도 맞물린다. 액센추어는 지난 1년간 AI 중심의 조직 개편을 진행해 왔다. 지난 6월에는 다섯 개 사업부를 ‘리인벤션 서비스(Reinvention Services)’라는 단일 조직으로 통합하며 ‘AI 시대를 위한 자사 재창조’ 전략을 추진했다. 이와 동시에 직원들을 ‘리인벤터’라고 부르기 시작했다.

액센추어는 오픈AI와 앤트로픽과의 협력도 구축했다. 이를 통해 수만 명의 직원이 두 기업의 챗봇과 에이전트형 기술을 활용하고 이를 확산하는 교육을 받게 될 예정이다.

스위트는 이번 인수 발표와 함께 “우리는 세계에서 가장 AI에 기반한, 고객 중심의 전문 서비스 기업이 되기 위한 플레이북을 만들어가고 있다”라고 언급했다.
dl-ciokorea@foundryco.com

Accenture to acquire UK AI startup Faculty

✇CIO
6 January 2026 at 15:11

Accenture has announced that it has agreed to acquire UK AI startup Faculty for an undisclosed sum, a potentially significant move in a consultancy sector currently scrambling to add greater artificial intelligence expertise.

According to Accenture, Faculty’s UK-based workforce of 400 “AI native professionals” will be integrated with its consulting teams, allowing the company to offer its customer base “world‑class AI capabilities.” The company will also integrate Faculty’s AI decision intelligence platform, Frontier, into its services.

“With Faculty, we will further accelerate our strategy to bring trusted, advanced AI to the heart of our clients’ businesses,” commented Accenture chair and CEO, Julie Sweet.

One detail that marks the acquisition as unusual is that Faculty’s current CEO, Marc Warner, will reportedly join Accenture’s Global Management Committee as chief technology officer (CTO). If confirmed, this means that a company employing a few hundred people will take a key board position in a huge consulting outfit with nearly 800,000 employees worldwide.

Accenture still lists its CTO as Rajendra Prasad, who will presumably step back from this role to focus on his other day job as the company’s Group Chief Executive – Technology. CIO.com contacted Accenture and Faculty to confirm the new roles, but had no response by publication time.

AI reinvention

Traditional tech acquisitions are usually motivated by the value offered by a company’s patents, products and customers. With AI companies, just as important right now is human expertise.

Faculty offers all of these. Co-founded in 2014 as ASI Data Science by then Harvard quantum physics research fellow Warner, it was renamed Faculty in 2019. This might have been an attempt to disassociate it from allegations, which it strenuously denied, that it was part of the same internship program as scandal-hit company Cambridge Analytica, through the latter’s parent company, SCL Group.

Since then, Faculty has established a solid reputation through its work with the UK government, including the creation of an NHS Early Warning System (EWS) system used to predict hospital admissions and ventilator requirements during the Covid pandemic.

This dovetails well with Accenture’s direction; it has spent the last year undergoing an AI makeover. In June, the company folded five business units into a single division, Reinvention Services, as part of a plan to “re-invent Itself for the Age of AI.” At the same time, it started calling its employees “reinventors”.

The company has also formed alliances with OpenAI and Anthropic which will see tens of thousands of its employees trained to use and promote both companies’ chatbot and agentic technologies.

“We are writing the playbook for how to be the most AI-enabled, client-focused professional services company in the world,” said Accenture CEO Sweet in this week’s announcement of the acquisition.

Every M&A deal has a cyber delta: Close it before hackers do

✇CIO
6 January 2026 at 08:38

When mergers and acquisitions grab headlines, the cybersecurity posture of the involved organization is rarely scrutinized, unless one of the parties suffers a breach. But once the deal is done, a key factor that determines how well two companies become one is the gap between what they believe is the state of their security posture and what actually holds up under scrutiny.

We call this the cyber delta.

The unique attributes of a deal, such as compressed timelines, regulatory hurdles and political and market factors, make it virtually impossible to reduce that gap to a single risk score or cyber delta metric. But we can pinpoint the common risk vectors that occur in cases where the companies envision some level of IT consolidation and/or governance.

In a world where adversaries are opportunistic and regulations unforgiving, cyber due diligence can’t remain a late-stage checkbox. It needs to be a strategic pillar of how deals are evaluated, structured and executed.

While every transaction is different, here are some common problems.

Legacy risk

Legacy systems often carry the highest risk — not because they’re old or broken, but because no one truly understands them anymore. Unpatched servers, outdated middleware, forgotten databases and unsupported operating systems often become liabilities after the deal closes.

Traditional due diligence frequently overlooks this kind of technical debt.

To surface it, security teams need configuration-level visibility to determine key issues such as whether critical systems are running end-of-life software, administrative interfaces are exposed externally or if patches can be applied without breaking core dependencies.

This level of scrutiny can’t wait for post-merger integration. It must be baked into early risk modeling before the deal is done.

Risk assessment misalignment

A large organization buying a much smaller one or a highly regulated company buying one in a less regulated space will have very different risk profiles, so the goal isn’t necessarily parity, it’s unification. But even if you don’t unite all the technologies, you still need a unified view of risk.

Establishing open lines of communication across teams is essential to establishing measurable baselines for both sides. That provides a framework for measuring progress and spotting where the biggest gaps are. The goal is to agree on what “good” looks like, what needs fixing and where the priorities are.

Security scores or shared risk indexes can help, especially when you’re trying to compare two environments that work differently. It’s less about having one perfect KPI and more about knowing what you’ve got, what it’s going to take to secure it and how you’ll track that over time.

Security maturity misalignment

Another common risk is the mismatch in security maturity between the acquiring organization and its target. One company might have rigorous asset inventories, patch SLAs and automated detection; the other may be operating with ad hoc response plans and minimal logging. This misalignment creates serious friction — and risk — during integration.

Each security team should understand the other company’s threat modeling, incident response and vulnerability triage processes. They also need to identify where alignment is mandatory (e.g., access controls, endpoint protection) and where temporary coexistence is acceptable.

While every deal has a different integration blueprint, most can be split into two broad categories. First is full integration, which requires collaboration across each company’s security teams to map interdependencies between systems, understand identity sprawl and simulate interconnectivity to identify points of weakness that could ripple through both environments.

Second is partial integration or a standalone operation. In these cases, the focus shifts to interface points. Are APIs between the two firms secured and rate-limited? Are shared systems — like CRMs or collaboration tools — properly monitored and segmented? Security diligence should also reflect the business function of the acquired entity. A dev team’s cloud environment presents different risks than a customer service platform handling PII.

Compliance by inheritance

You’re not just acquiring infrastructure — you’re inheriting obligations. A target’s security program may be sufficient to avoid breaches but still fall short of current regulatory standards. To avoid latent compliance risk:

  • Map systems to relevant regulatory frameworks (e.g., GDPR, HIPAA, CCPA, SEC cybersecurity disclosure rules)
  • Review how sensitive data is classified, encrypted and audited
  • Flag high-risk areas such as weak authentication, unmonitored data transfers, legacy encryption, etc.

These issues often stay hidden until audits, legal inquiries or customer complaints surface. Addressing them proactively avoids painful surprises.

Technology culture clash

When a cloud-native company is acquired by a company that is less so, the due diligence process must align with the velocity and architecture of modern development. Risks often lie in the operational details, such as cloud infrastructure concerns around over-permissive IAM roles and misconfigured storage buckets.

CI/CD pipelines require examination to ensure build processes are secure and secrets aren’t stored in plain text or version control. APIs and integrations need assessment to confirm tokens are properly scoped and revocable, with endpoints protected by rate limiting and authentication. For IoT and edge devices, critical considerations include whether firmware updates are available and signed and whether remote management ports are exposed.

Security culture clash

When two companies come together, you’re not just dealing with different tools — you’re dealing with different ways of thinking about risk. One team might have a solid process for tracking and prioritizing issues. The other might be in constant firefighting mode, just trying to keep up.

Trying to force everyone into one framework right away usually doesn’t work. A better move is to start with shared visibility. Get both sides looking at the same data and using the same language when they talk about risk. The next step is to focus on the areas where the two environments actually touch — things like identity, access and shared infrastructure. That’s where misalignment causes the most problems.

Security leaders don’t need to have it all figured out on day one. They just need people to see the same picture and be willing to work on it together.

Global deals, local risk

Cross-border M&A introduces another layer of complexity. Different regions carry distinct legal, technical and cultural definitions of risk. A European company may prioritize data sovereignty and breach notification timelines; a U.S. firm may focus more on operational resilience and insurance coverage.

Smart security teams build region-specific exposure profiles that account for local laws and regulatory disclosure requirements, threat actor activity by regions and technical norms and enforcement capacity. Global harmonization isn’t always possible, but understanding the landscape in advance helps prevent surprises down the road.

Gaining an advantage by reducing the cyber delta

There will always be some level of uncertainty in M&A cybersecurity. But the organizations that work actively to shrink the cyber delta will have an operational edge.

Don’t let a breach become part of the deal.

This article is published as part of the Foundry Expert Contributor Network.
Want to join?

Seattle-area tech company sues New York acquisition advisor, alleging botched $5.2M deal

✇GeekWire
By: Todd Bishop
29 December 2025 at 11:51

A Kirkland, Wash.-based tech company is suing its New York-based acquisition advisor, alleging it was pushed into a $5.2 million acquisition that was supposed to generate $1 million annually but has instead required ongoing cash infusions just to stay afloat.

The lawsuit, filed on behalf of SmarTek21, a longtime technology consulting services firm, accuses TGP GP Management of “egregiously defective due diligence” in its May 2025 acquisition of IT Avalon, another U.S.-based tech consulting company.

According to the complaint, Tortuga Growth Partners, a New York-based private equity firm, acquired a minority stake in SmarTek21 in 2024. Its affiliate, TGP GP Management, a management and acquisition advisory firm, entered into an agreement to advise SmarTek21 on acquisitions and related matters.

TGP responded in a statement: “TGP strongly disputes the allegations in this complaint and stands by the comprehensive due diligence process conducted for the IT Avalon acquisition.”

The lawsuit was filed Dec. 18 in King County Superior Court in Seattle by Totem Lake Investments II, the majority owner of SmarTek21. Totem Lake Investments is led by SmarTek21 CEO Alkarim Lalji. The suit seeks at least $6 million in damages, plus punitive damages and other relief.

According to the complaint, TGP almost immediately began pressuring SmarTek21 to acquire IT Avalon, as a complementary business that would augment SmarTek21’s existing model and diversify its customer base. The suit says TGP represented that IT Avalon would generate at least $1 million annually in free cash flow, before other benefits from the combination.

The complaint alleges that TGP’s principal Ashray Prasad dismissed concerns raised by SmarTek21 executives about IT Avalon’s deteriorating finances in the days before closing. According to the suit, Prasad repeatedly called Lalji urging him to close the deal — placing many of these calls while Lalji was undergoing treatment for a serious medical condition.

The lawsuit alleges TGP pursued the IT Avalon acquisition out of “enthusiasm for transaction fees, publicity, and the appearance of quick deal-making.”

According to the suit, IT Avalon’s revenue had been declining since 2022, and its operating income had dropped significantly, while its vendor relationships deteriorated.

TGP structured the deal so that any working capital shortfall would be offset against future earnout payments to IT Avalon’s sellers. But that proved worthless, the suit alleges, because IT Avalon had almost no chance of hitting the revenue targets that would trigger those payments.

In its statement, TGP disputed these claims.

“IT Avalon is a strong technology business with valuable client relationships,” it said. “The combined entity now benefits from an expanded client base, talented personnel, and a robust pipeline of opportunities. We intend to vigorously defend against these baseless claims.”

The dispute illustrates the complicated nature of private equity-led technology roll-up strategies, in which smaller companies are combined to create larger platforms.

The acquisition of IT Avalon in May was the second in six months for SmarTek21, following its earlier combination with Retro Rabbit, a South Africa-based product design firm, according to a press release by Tortuga Growth Partners announcing the IT Avalon deal at the time.

“We are building a category-defining platform,” said TGP’s Prasad, who is also a member of SmarTek21’s board of managers, in the press release. He added that the completion of the second acquisition over that time frame reflected “the momentum behind SmarTek21’s growth.”

According to the company’s public materials, SmarTek21 provides product engineering and enterprise software services to Fortune 250 clients in industries including financial services, healthcare, and telecom. It says it has more than 650 associates across the U.S., India, and South Africa.

IT Avalon, founded in 2012, provides technology consulting services to clients in financial services, healthcare, gaming, and hospitality. The May press release announcing the deal described the company as having a 95% client retention rate.

Lalji and SmarTek21 did not respond to requests for comment. See the full complaint below.

SmarTek21 v. TGP Management by GeekWire

Joon Care, a Seattle-based mental health startup serving youth, acquired by Handspring Health

✇GeekWire
By: Lisa Stiffler
11 December 2025 at 13:25
Joon Care CEO Emily Pesce (left) and Amy Mezulis, Joon co-founder and former chief psychologist. (Joon Care Photo)

Seattle-based mental health startup Joon Care has been acquired by Handspring Health, a New York-based health tech company. Terms of the deal were not disclosed.

“The acquisition is a major step toward building the most clinically rigorous and digitally engaging platform for youth and family mental healthcare in the country,” said Sahil Choudhry, co-founder and CEO of New York-based Handspring, in a LinkedIn post.

Joon launched in 2019 to provide online care for teens and young adults, pairing digital tools with virtual therapy sessions. The company serves patients 13- to 26-years-old who need help with anxiety, depression, disordered eating, sexual and gender identity, academic problems and other challenges. The course of therapy typically runs 16 weeks. The company’s program emphasizes its use of evidence-based care strategies and patient assessments to track progress.

Joon spun out of Seattle’s Pioneer Square Labs (PSL) and raised an initial $3.5 million round in 2020. Two years ago, it announced an additional $6 million investment, which would provide two to three years of operations, CEO Emily Pesce said at the time.

Handspring said in a press release that it would be integrating the companies’ “expert teams,” but did not say if all of Joon’s employees would be retained. The company has roughly 50 employees, based on information on LinkedIn.

GeekWire reached out to Pesce and will update the story if we hear back.

Handspring launched in 2021 and has raised $18.2 million, according to PitchBook. It also provides virtual therapy and online support, serving a slightly larger demographic with patients from 8- to 29-years-old.

Both companies operate multi-state platforms. Joon is licensed to provide care in Washington, Oregon, California, Texas, New York, Delaware and Pennsylvania. Its treatment is covered by 16 insurance companies, according to its website, and includes national giants Aetna and UnitedHealthcare.

Joon also launched a partnership in 2023 with the City of Seattle to provide free care to clients who are referred to the startup through the city’s human services programs. The collaboration appears to be ongoing, and Handspring said it would continue serving families under Joon’s existing contracts with government agencies, as well as treatment covered by insurance companies.

Pesce was a finalist for Startup CEO of the Year at the 2023 GeekWire Awards.

Bitsight buys dark web security specialist Cybersixgill for $115M

✇TechCrunch - Dark Web
By: Ingrid Lunden
14 November 2024 at 10:32
More consolidation is afoot in the world of cybersecurity. Bitsight, a cybersecurity startup last valued at $2.4 billion when ratings firm Moody’s took a stake in the business and became its largest shareholder in 2021, is acquiring Cybersixgill for $115 million. Boston-based Bitsight’s focus is cyber risk management. It works with enterprises to assess their […]

3 Approaches to Security Testing for Third Parties

✇Synack Blog
By: Rajesh Krishnan
7 July 2022 at 13:10

What You Should Consider Before Launching a Security Test for Your Third Parties and Vendor

A paradox of cybersecurity’s function in business is that businesses provide value by creatively sharing and using information, but cybersecurity benefits from less sharing and access to data. 

This holds doubly true in the area of third-party security for large organizations that must adhere to stricter regulations, such as banks and government agencies. It is nearly impossible to conduct business without frequently and openly sharing valuable information with, or via, third parties. 

Drug developers rely on clinical research partners for essential data. Banks exchange information with credit agencies, other banks, regulators and more. All of this drives software development and infrastructure changes constantly, and some percentage of those changes introduce security vulnerabilities that are detected late in the process, which poses risk for the organizations. 

Many feel that they get more security “bang-for-the-buck” through third-party testing—testing the software of others. A 2022 study by the Ponemon Institute found that while 75% of respondents are concerned about the risk of ransomware linked to third parties, only 36% of organizations evaluate their own security and privacy practices. An earlier 2019 Ponemon study found that if it were a third party that caused a data breach, the cost increased by more than $370,000 (raising it to $4.3 million). Shoring up third-party defenses clearly has benefits for multiple parties (and your customers).

How Synack Customers Test Third Parties

Synack has seen customers try different approaches for testing third parties. Tests are either 1) encouraged, 2) required or 3) coordinated. 

In the first model, third parties are strongly encouraged to get a security test from Synack and share the results with their partner, usually the larger of the two companies. It’s not forced; ultimately, it’s up to the third party to decide if their relationship benefits from a security test. 

In the second model, security testing is a requirement for a relationship to be contractually completed. Finally, the Coordinated Testing model is the one Synack sees growing the fastest. In this model, the larger company with several third parties to test purchases tests on behalf of other companies and mandates testing. Usually, they specify the testing intensity as well, by choosing a basic Synack test or a more comprehensive offering. This secures testing resources and makes it easier to share data via a testing platform built for it. 

Issues to Consider when Testing Third Parties

Whichever model you prefer, there are several things to consider. First, what is the chargeback model, if any, for security tests? Does the third party pay, the first party or someone else? Does the payment happen up front or in a later, internal accounting?  The latter helps execute testing faster, which is ultimately what many companies want to reduce risk earlier.

Next, what legal agreements need to be in place? All Synack customers have clear contracts with Synack that cover testing. In some cases, an identical contract is needed with a third party, but more frequently, it’s a simpler agreement. Consult with your legal team to find the simplest but most effective way to expand testing on your assets, regardless of where they reside. 

Finally, there is information sharing. Do vulnerabilities found on a third party get reported to the primary party? In most cases, the primary party simply wants to know that vulnerabilities are not present, which can be done with patch verification reports. Synack’s robust role-based access control system and reporting allow for any choice along this spectrum to be securely shared according to the wishes of the companies. Information can be shared via a final report, access to the Synack Portal (with real-time information about testing efforts and results) or both.

Whatever you choose, third-party security testing to clean up potential vulnerabilities advances the ultimate goal for many companies: safer users and data. 

The post 3 Approaches to Security Testing for Third Parties appeared first on Synack.

❌
❌