wladimir1804 - stock.adobe.com
Palo Alto Networks to acquire CyberArk for $25bn
The deal marks Palo Alto Networks’ entry into the identity and access management space amid the growing need to secure human, machine and emerging AI agent identities
Palo Alto Networks plans to acquire CyberArk for about $25bn, in a landmark deal that marks its entry into the identity and access management (IAM) market.
Following the acquisition, Palo Alto Networks will integrate CyberArk’s privileged access management (PAM) capabilities into its own Strata and Cortex platforms, leveraging artificial intelligence (AI) to deliver identity-aware security and real-time response across the entire enterprise.
“Our market entry strategy has always been to enter categories at their inflection point, and we believe that moment for identity security is now,” said Nikesh Arora, chairman and CEO of Palo Alto Networks.
“Today, the rise of AI and the explosion of machine identities have made it clear that the future of security must be built on the vision that every identity requires the right level of privilege controls, not the ‘IAM fallacy’,” he added.
IAM is the practice of safeguarding the digital identities of all users – including humans, devices and applications – and managing what they are authorised to access. CyberArk, an Israeli company that went public in 2014, is widely recognised as a leader in this space, particularly in protecting privileged credentials that grant access to an organisation’s most sensitive assets.
A key driver for the acquisition is the emergence of AI agents that can make decisions and perform complex tasks with limited human supervision.
The combined company aims to provide the controls to secure this AI workforce by enforcing principles such as least-privilege and just-in-time access. “Joining forces with Palo Alto Networks is a powerful next chapter, built on shared values and a deep commitment to solving the toughest identity challenges,” said Udi Mokady, founder and executive chairman of CyberArk. “Together, we’ll bring unmatched expertise across human and machine identities, privileged access, and AI-driven innovation to secure what’s next.”
Read more about identity security in APAC
- CyberArk CIO Omer Grossman talks up the company’s security-first ethos, the importance of an assumed breach mentality and how the company is addressing threats from the growing use of AI.
- Ping Identity CEO Andre Durand discusses the company’s unified roadmap, commitment to customer stability and growth plans in the evolving identity landscape following the merger with ForgeRock.
- The National University of Singapore’s Safe initiative has strengthened the security of IT systems and end-user devices while prioritising user experience through passwordless access.
- Okta has been bolstering the security of its own infrastructure and building new tools to scan customer environments for vulnerable identities, among other efforts to fend off identity-based attacks.
The deal represents a major shift for Palo Alto Networks, which has historically focused on acquiring smaller startups rather than established market leaders. It is also part of a broader trend in the cyber security industry, where customers are moving away from managing disparate point products towards integrated platforms to improve efficiency and security outcomes.
The acquisition is expected to close during the second half of Palo Alto Networks’ fiscal 2026 and be immediately accretive to the company’s revenue growth and gross margin. It marks the second-largest acquisition of an Israeli tech company after Google’s $32bn acquisition of Wiz.
IAM rival BeyondTrust weighed in on the deal, with its CEO, Janine Seebeck, noting that the move reinforces the view that identity security is foundational to modern cyber security.
“At BeyondTrust, our entire focus is, and always has been, on protecting identities and eliminating privilege-related risk,” she said. “While others expand into identity from adjacent markets, we remain committed to leading from the inside out, with identity as our core mission, not a feature.”
Other players in the IAM market include SailPoint, which is known for identity governance and administration, Okta, which is known for securing customer and employee identities, and Ping Identity, which merged with ForgeRock, an IAM supplier that counts some of the largest financial institutions as clients.
