Governance & Risk Management
,
Managed Detection & Response (MDR)
,
Managed Security Service Provider (MSSP)
Combined Entity Targets MSSP, MDR, Cyber Consulting and Incident Response Dominance
LevelBlue plans to purchase a managed detection and response mainstay its CEO previously led for more than a decade to scale its managed security business.
The Dallas-based managed security services company said its proposed acquisition of Chicago-based Trustwave will make LevelBlue the world’s largest pure-play MSSP with more than 2,000 employees and $1 billion in annual sales. The Trustwave transaction will help LevelBlue sell MDR services to the U.S. government and give the company a stronger footprint in countries like the United Kingdom and Japan.
“Their recent certification in FedRAMP and StateRAMP of their MDR platform is unique in the industry,” LevelBlue chairman and CEO Bob McCullen told Information Security Media Group. “So for us, that was very exciting, because we have a large federal practice in partnership with AT&T, and so that’ll be a great enhancement to our go-to-market strategy in the federal sector.”
The deal represents a homecoming of sorts for McCullen, who was chairman and CEO of Trustwave from March 2005 to August 2015, when Trustwave was acquired by Singapore telecom conglomerate Singtel for $770 million. Singtel in January 2024 sold Trustwave for just $205 million to MC2, the private equity arm of former Secretary of Homeland Security Michael Chertoff’s advisory firm The Chertoff Group (see: Chertoff Group Arm to Buy Trustwave From Singtel for $205M).
Then in November 2024, Trustwave agreed to merge with struggling endpoint security firm Cybereason, with the joint entity being majority-owned by Cybereason investor SoftBank. But Cybereason terminated the Trustwave deal in March 2025 after then-CEO Eric Gan resigned due to a messy spat with investors. Trustwave has been led since November 2020 by Eric Harmon, who had been DXC’s EVP of operations (see: Cybereason CEO Eric Gan Out Following Scuffle With Investors).
Why LevelBlue Was Interested in Buying Trustwave
McCullen said his familiarity with Trustwave positioned LevelBlue advantageously to reengage when the Cybereason merger fell through. In addition to Trustwave’s valuable certifications for federal contracts, Trustwave’s global operational infrastructure, particularly in the UK and Australia, made the acquisition an opportunity to expand LevelBlue’s international footprint and enhance its global operations, he said.
“I still know a lot of the folks there, and we really watched some of the capabilities grow, especially around MDR,” McCullen said.
Trustwave’s established general and administrative infrastructure will be particularly valuable, McCullen said, as LevelBlue and Aon – which LevelBlue agreed to buy last month – were both recent carve-outs still building out those capabilities. Rather than seeing redundancies as obstacles, McCullen sees them as an opportunity to reallocate skilled staff toward forward-looking initiatives like next-gen MDR services (see: LevelBlue Buys Aon Cyber Unit for Global IR, Litigation Help).
“Our number one priority is making sure our operations teams, consulting and managed services are functioning very well together,” McCullen said. “And then number two would be the back-office systems that make us more efficient in terms of customer communications, in terms of sales and marketing, all the G&A functions.”
The integration brings together best-in-class incident response teams from Aon, Trustwave’s SpiderLabs, and LevelBlue, creating one of the industry’s most comprehensive IR and pen testing teams. McCullen emphasized that this unification would allow for greater threat visibility, faster malware analysis, and advanced threat-hunting techniques powered by intelligence gathered across all three organizations.
“The three categories that we’re focused on here are MSSP, MDR, and IR, and we’re currently leaders in all three,” McCullen said. “The combining of the three companies will extend that lead. In MSSP, LevelBlue was a clear leader, certainly in the U.S. and probably internationally as a pure-play. And for MDR, this will really strengthen our enterprise and mid-market offerings.”
What LevelBlue, Trustwave Customers Gain from the Acquisition
Trustwave brings advanced database and email security services – areas where LevelBlue previously had no offering. Meanwhile, McCullen said LevelBlue contributes a robust MSSP and transformation consulting practice, especially in helping clients move from legacy systems to cloud-based SASE models. And the Aon Cyber team adds incident response leadership and litigation support, McCullen said.
“We’re a leader in managed SASE services, and so we’ll continue to focus on that,” McCullen said. “That’s one of the fastest-growing areas in the security industry. Number two is managed services, to continue to be more efficient, to be able to deliver global solutions at scale. Number three would be MDR. Our MDR capabilities with Trustwave’s we think will be very exciting for our customers.”
As a result of the acquisitions, McCullen said Aon customers gain services like remediation and MDR that the company didn’t offer directly. Customers of Trustwave – which has recently focused on MDR – gain access to MSSP services, SASE solutions, and larger operational scale. LevelBlue customers benefit from new email and database security services and enhanced MDR options, especially for government clients.
“It will provide a full suite of services that the Aon cyber team wasn’t offering directly,” McCullen said. “Similar for Trustwave, they were focused more on MDR, and some of the LevelBlue consulting services will bring MSSP back into the fold. Their SASE will be a nice benefit for their install base, along with our just much larger scale and capacity to do larger opportunities.”
LevelBlue was predominantly North America-centric, with smaller operations in the UK and Australia. In contrast, Trustwave provides a well-established presence in Asia-Pacific, including Japan and Singapore, and operational centers in India and the Philippines. Aon’s cyber team, while primarily U.S. and U.K.-based, complements this footprint. Together, the merged entity will significantly expand LevelBlue’s reach.
“LevelBlue was obviously very strong in North America,” McCullen said. “We have a small presence in Australia, in the U.K. Trustwave strengthens all three of those, and adds Japan. And then Aon was also strong in North America and the U.K.”
