Bank of America has announced plans to acquire MDSec Consulting Limited, the Macclesfield-based offensive-security firm that has spent more than a decade running red-team engagements for governments and banks. Financial terms were not disclosed; the deal is expected to close in the fourth quarter of 2026 after regulatory approvals.
Who MDSec Is
MDSec's roughly 65 consultants specialize in deeply technical application, mobile and hardware security testing and targeted red-team attacks. The firm is an NCSC-approved CHECK company and a Bank of England-recognized CBEST provider, making it one of a small pool of vendors qualified to simulate advanced attacks against UK critical financial infrastructure.
Strategic Fit In The North Of England
Bank of America already runs a substantial UK footprint, with more than 1,400 employees in Chester — including one of its cyber threat operations centers. Kris Fador, the bank's chief information security officer, said MDSec's team will slot in to extend leading cybersecurity capabilities in the UK and globally. MDSec co-founder Dominic Chell called the deal an opportunity to scale the firm's technical ambitions inside a global financial institution.
Banks Are Buying Cyber Talent
The deal fits a pattern of banks and payments giants absorbing specialist security vendors rather than renting them. Visa's $2.4 billion BioCatch acquisition, announced days earlier, hardened its behavioral-biometrics posture, while Okta's Permiso buyout targeted identity threat detection. Enterprises are simultaneously stress-testing themselves against AI-driven threats showcased at Black Hat 2026.
Reporting based on coverage from Bank of America's newsroom, SecurityWeek and Finextra.