Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Arctic Wolf completed its acquisition of BlackBerry’s Cylance endpoint-security assets on February 3, 2025. The deal was announced on December 16, 2024, at $160 million in cash, subject to adjustments, plus about 5.5 million shares of Arctic Wolf. That headline figure was not $160 million in cash paid upfront: BlackBerry later reported lower net cash at closing, private-company shares and deferred consideration.
Deal at a glance
| Question | Answer |
|---|---|
| Buyer | Arctic Wolf Networks |
| Seller | BlackBerry Limited and relevant subsidiaries |
| What changed hands? | Cylance endpoint-security assets and related liabilities—not BlackBerry as a whole |
| Announced | December 16, 2024 |
| Closed | February 3, 2025 |
| Announced consideration | $160 million in cash, subject to adjustments, plus approximately 5.5 million Arctic Wolf common shares |
| Post-acquisition branding | Arctic Wolf presents the product family under Aurora Endpoint Security |
The parties’ transaction announcement and BlackBerry’s agreement filing describe an asset transaction. It did not transfer ownership of BlackBerry or all of its cybersecurity operations.
What BlackBerry received—and why $160 million needs context
The $160 million was the stated cash consideration before purchase-price adjustments, not a report of cash delivered in full at closing. In its subsequent filing, BlackBerry said adjustments were approximately $39.1 million and reported receiving about $79.8 million in net cash at closing. It also reported 5.5 million Arctic Wolf shares with an estimated fair value of $24.6 million at the time of that disclosure. Those shares are equity in a private company, not publicly traded BlackBerry stock; their estimated accounting value should not be treated as cash or as a readily realizable market price.
BlackBerry also described additional deferred cash expected around the first anniversary of closing. One filing put the expected amount at approximately $40 million; another referred to approximately $41.1 million. These are filing-specific reported figures, so they should not be collapsed into a single exact amount. The documents cited here describe expected deferred consideration; they do not establish that it was subsequently paid.
#1 Best Overall
Accordingly, avoid adding the headline cash, estimated share value and deferred payment and calling the result cash proceeds or a definitive sale price. They represent different components and timing, and the equity figure is an accounting estimate. BlackBerry’s February 2025 filing and closing-related filing provide the relevant details.
Why the sale mattered to BlackBerry
BlackBerry had been emphasizing its remaining Internet of Things and secure-communications businesses. Selling the Cylance endpoint assets removed that product business and related liabilities while providing cash, a private-company equity interest and deferred consideration. It also left commercial ties in place: the transaction documents contemplated a non-exclusive patent license, a partner agreement for BlackBerry to resell certain Arctic Wolf offerings, and a strategic customer-support agreement. BlackBerry said it would remain an Arctic Wolf customer and reseller for large government customers, as well as a shareholder.
What that means is analysis, not a guaranteed financial outcome: the sale is consistent with a sharper strategic focus and transfers endpoint-product operating responsibility to a company centered on cybersecurity services. It may also reduce the cost and execution burden of running a standalone endpoint-security business. The filings cited here do not establish that Cylance was sold because it was failing, unprofitable or losing customers. Nor does the transaction alone prove a BlackBerry turnaround or shareholder value creation. Investors would need to assess subsequent performance of the businesses BlackBerry retained, cash generation, and any continuing commercial revenue.
BlackBerry’s post-closing commentary discusses the company’s stated direction and continuing relationship with Arctic Wolf.
Why Arctic Wolf bought the assets
Arctic Wolf framed the acquisition as a way to pair endpoint protection with its security operations and managed detection capabilities. The logic is that endpoint prevention and telemetry can complement analyst-led monitoring and response, while the acquired product line gives Arctic Wolf an established endpoint offering and customer base. The post-deal portfolio is promoted as Aurora Endpoint Security; Arctic Wolf documentation maps Aurora Endpoint Defense to products formerly known as CylancePROTECT and CylanceOPTICS.
The strategic fit does not remove execution risk. Customers may have to navigate new names, consoles, contracts, support channels or integration requirements. Legacy and on-premises environments may not map neatly to a cloud-oriented managed-service model. Organizations buying endpoint software alone may not need a broader MDR relationship, while those wanting 24/7 security operations may value one. These are issues to test against a specific deployment and contract, not conclusions that every customer will experience the same migration.
Rank #3
- Used Book in Good Condition
What Cylance customers should check now
Cylance branding has not simply vanished. Arctic Wolf documentation uses Aurora branding while retaining Cylance terminology and, in some cases, legacy console and API references. That indicates a product and brand transition, not proof that every customer has been migrated or that every component has been replaced. For example, Arctic Wolf’s API documentation retains Cylance-related service endpoint information.
Free tools Windows power users keep installed
One-click scans. No signup required.
Support dates depend on the product, version and deployment. Arctic Wolf’s lifecycle references, updated in 2026, list technical support for Aurora Protect Desktop 3.2 through May 19, 2026, Aurora Focus 3.2 through November 30, 2026, and CylanceON-PREM versions with an end-of-life date of November 30, 2026. These are product-specific dates, not a universal deadline for all Cylance installations. Check the applicable Protect Desktop, Focus and CylanceON-PREM lifecycle pages for the exact product and version in use. Dates can change; confirm them with Arctic Wolf or your reseller before scheduling an upgrade.
Before renewing or migrating, customers should establish:
Rank #4
- Which product, agent version and operating systems they run.
- Whether the deployment is cloud, hybrid or on-premises, and which console region applies.
- The applicable support and end-of-life dates and any required upgrade path.
- Who controls renewal, support and pricing—the vendor or a reseller—and whether the contract entity or terms have changed.
- Whether the current entitlement includes Aurora features or Arctic Wolf MDR, and whether those services are priced separately.
- Any changes to data-processing, privacy, data-residency or government-customer terms.
A changed product name does not by itself establish an immediate forced migration, new price or altered entitlement. Get those points confirmed in writing for your own contract.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Arctic Wolf MDR integration
Arctic Wolf documents a connector for sending Aurora Endpoint Defense logs to Arctic Wolf MDR. The documented setup requires an Aurora Endpoint Defense license and administrator access to its dashboard. In outline, sign in to the Arctic Wolf Unified Portal, open Data Collection > Cloud Sensors, choose Add Account and select Aurora Endpoint Defense. Generate and securely copy the webhook URL and token. Then, in the Aurora Endpoint Defense dashboard, open Connectors, choose Add Connector > Arctic Wolf MDR, enter the URL and token, and save.
Recommended Free Tools
The integration guide warns that each tenant needs its own configuration; do not reuse a webhook URL or token across tenants. Menu labels may change, so follow the current documentation. Log forwarding is an integration path, not evidence that MDR is automatically included in every endpoint license.
Best Value
How investors and buyers should read the deal
For BlackBerry investors, the relevant questions are not just the headline amount: how much cash was actually received and when; what conditions apply to deferred consideration; how the private Arctic Wolf equity is valued and whether it can be sold; and whether the remaining BlackBerry businesses improve in growth, margins and cash generation. The continuing reseller and support arrangements may preserve customer continuity, but their financial contribution should not be assumed without later disclosures.
For endpoint-security buyers, the acquisition is less important than the product and service terms available to their organization. Compare prevention and detection capabilities, operating-system coverage, cloud versus on-premises support, integrations, incident escalation, data residency, migration work and support policy. Also clarify whether you are purchasing endpoint software, managed endpoint defense, broader MDR, or a package of those services. Arctic Wolf’s public materials reviewed do not provide a standard list price, so request a written quote that separates licensing, onboarding, MDR, support and migration charges.
Organizations evaluating the market can compare Aurora with options such as Microsoft Defender for Endpoint, CrowdStrike Falcon, SentinelOne Singularity and Sophos Endpoint. Those are comparison candidates, not endorsements; verify current editions, service scope, prices and contract terms directly with vendors.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
