The acquisition, Google’s second-biggest ever, signals that the Alphabet Inc. company has stepped off the sidelines of large dealmaking despite intense regulatory scrutiny. As it seeks to expand its third-place cloud-infrastructure unit, which sells computing power and storage via the internet, buying Mandiant will give Google a fuller range of software tools to protect clients by responding quickly to online threats. 

Building up the cloud business is one way Google is working to diversify from digital advertising, which comprises the bulk of its revenue and profit. Under Thomas Kurian, who took over as the cloud division’s chief executive officer in 2019, Google has aggressively pursued new business, working to make the service more reliable and revamping its partnerships to engineer bespoke projects for more clients. Mandiant will help Google sell a more holistic set of security programs that seek to prevent cyber intrusions and help cloud-computing customers detect and fight any attacks that do get through.

Google will pay $23 a share for Mandiant in the all-cash deal, the Mountain View, California-based company said in a statement on Tuesday. Mandiant will be organized under Google’s cloud business at the close of the acquisition, expected later this year, Phil Venables, Google Cloud’s chief information security officer, said in a briefing. He brushed off concerns that the regulatory review process may be a long slog, saying that the deal enhances competition in cybersecurity and suggesting it will pose a more serious challenge to Amazon.com Inc. and Microsoft.

Microsoft was also interested in Mandiant, but pulled out of talks more than a week ago, said two people with knowledge of the deliberations who asked not to be identified because the negotiations were private. 

Google’s cloud division sales grew 47% in 2021, but competitors maintained stubborn leads—as of the fourth quarter of 2021, Google held 10% of the cloud-infrastructure provider market, while Amazon Web Services commanded 33% and Microsoft’s Azure captured 21%, according to data from Synergy Research Group.

Kurian has targeted cybersecurity as a key area for growth, with Google buying security automation and response company Siemplify for a reported $500 million in January, meant to complement an in-house product called Chronicle. 

The deal “shows Google’s commitment to becoming a viable, competitive security vendor,” said Neil MacDonald, a research vice president at Gartner Inc. “Mandiant fills in a missing piece, which is strengthening up the security research capabilities of Google and it brings a detection and response platform to Google that Chronicle alone did not have.”

There’s been a flurry of dealmaking in cybersecurity in recent months, as governments and companies contend with a growing number of hacks and global anxiety escalates over the potential ripple effects in cyberspace from Russia’s invasion of Ukraine. Mandiant has frequently detailed nation-state hacking activity, including cyber-espionage from Russia and China, as part of its threat-intelligence offerings.

The biggest recent cybersecurity deal was private equity giant Thoma Bravo LLC’s purchase of Proofpoint for $12.3 billion last year, followed by NortonLifeLock Inc.’s purchase of Avast Plc in a deal valued at as much as $8.6 billion. 

“Organizations are facing cybersecurity challenges that have accelerated in frequency, severity and diversity, creating a global security imperative,” Kurian said in a blog post. “The cloud represents a new way to change the security paradigm by helping organizations address and protect themselves against entire classes of cyber threats, while also rapidly accelerating digital transformation.”

Mandiant has more than 600 security consultants to help clients and 300 intelligence analysts, and CEO Kevin Mandia said at the press briefing that he hopes the tie-up with Google will broaden its reach and automate expertise. 

“What excited Mandiant about this partnership with Google is we can scale our expertise and intel at Google scale to secure the cloud, and we also can automate our expertise,” Mandia said. The company can automate more by applying data about the threats some organizations are facing to defend others, he added.

The security company was founded almost two decades ago by Mandia, a former U.S. Air Force officer, and has gained a reputation for its incident-response services. Its discussions with Google, first reported by the Information website, sent shares of Mandiant up 16% at the close of trading on Monday.

But Mandiant slid more than 2% Tuesday, signaling investors had been anticipating a bidding war. Microsoft ended its takeover discussions on concerns that Mandiant’s collection of security businesses wasn’t a good enough strategic fit, according to a person familiar with the situation.

Mandiant became a stand-alone company last year when FireEye Inc. sold its security-product business for $1.2 billion to a consortium led by Symphony Technology Group. FireEye had acquired Mandiant in 2013. 

The deal will dwarf every previous Google transaction other than its 2012 acquisition of Motorola Mobility for about $12.5 billion. Still, “Google has ample capacity for a growing M&A appetite,” Robert Schiffman, an analyst at Bloomberg Intelligence, wrote in a note. The company is able to generate more free cash flow in just one month than the cost of Mandiant, he said.

For Google, the biggest challenge may lie ahead—getting regulators to sign off on the deal during numerous antitrust investigations. It took more than 14 months for Google to complete its $2.1 billion purchase of tech wearable company Fitbit because of regulatory scrutiny, and Google may be in for more of the same with Mandiant. Meanwhile, rival Microsoft has been on an acquisition tear, snapping up Activision Blizzard, Nuance Communications and 14 other businesses in the past year, according to its website.

“This deal was a shot across the bow from Google to Microsoft and Amazon,” Dan Ives, an analyst at Wedbush Securities, wrote in a note.

—With assistance from Dina Bass and Michelle F. Davis.