CyberArk Could Not Scale Alone So Palo Alto Stepped In

“This is precisely why industry must change the paradigm,” Nikesh Arora said earlier this year. “Shifting away from today’s fragmented security landscape and towards consolidation.” That view now defines Palo Alto Networks’ latest move: the $25 billion acquisition of Israeli cybersecurity company CyberArk.

The transaction is the largest in Palo Alto’s history and the most expensive deal ever for an Israeli firm, exceeding even Intel’s $15.3 billion acquisition of Mobileye in 2017. CyberArk, a publicly traded leader in privileged access management (PAM), has built a position at the center of enterprise identity security, securing administrator credentials, service accounts, and machine identities across over 10,000 organizations worldwide.

Arora’s position has been consistent. He has said publicly that billion-dollar revenue companies should not remain independent. “They should be part of a bigger entity that allows for the leverage and scale required to create large amounts of cash flow and a high market cap.” The CyberArk acquisition reflects that belief, and it brings to Palo Alto a product suite that operates at a control point the company previously lacked—identity.

While Palo Alto has spent more than $1.5 billion over the past decade acquiring firms in cloud security, endpoint protection, SOAR, and AI model governance, identity has remained a gap in its platform. With CyberArk, it now adds privileged access management, identity access management, machine identity control, and identity governance capabilities to a product stack that already spans firewalls, SASE, EDR, CNAPP, and SIEM.