Why Palo Alto Is Making a $25B Bet on Identity

The rise of agentic AI and credential-based ransomware attacks has fueled Palo Alto Networks’ interest in acquiring CyberArk for $25 billion, said CEO Nikesh Arora.

See Also: Identity and Access Management (IAM) Market Guide 2025

Arora said the long-fragmented identity security market is now ripe for platform consolidation with the emergence of AI agents requiring real-time permissioning and governance. Bringing privileged access to all identities rather than just a few high-risk users will help Palo Alto Networks lead in a world in which machine identities and agentic AI dominate the threat landscape, Arora said.

“From our vantage point, CyberArk is the only and largest player in the identity security space, and hence it allows us the opportunity to enter the identity security space,” Arora told investors Wednesday morning. “This would allow us to accelerate our platformization by adding a net new platform for identity security.”

The CyberArk deal is expected to close in the first half of 2026, and will immediately boost both Palo Alto Networks’ revenue as well as the company’s gross margins, said Chief Financial Officer Dipak Golechha. More significantly, Golechha said buying CyberArk help boost Palo Alto Networks’ free cash flow per share by August 2027, even before considering potential revenue synergies (see: It’s Official: Palo Alto Networks to Buy CyberArk for $25B).

Palo Alto Networks’ stock is down $10.24 – or 5.28% – to $183.60 per share, which is the lowest the company’s stock has traded since May 22. CyberArk’s stock, meanwhile, is up $3.19 – or 0.73% – to $437.67 per share, which is the highest the company’s stock has ever traded since going public in September 2014.

Why Identity is Palo Alto Networks’ Next Cyber Frontier

Palo Alto Networks’ growth from a next-gen firewall vendor into a broader platform was timed with a market shift, Arora said. The company entered into SASE when remote work exploded with the onset of COVID-19, got into XDR with the rise of advanced threat detection, and is now entering the identity security space in the face of AI and credential-based attacks, he said.

“The deal allows both of us to go address this space with a novel set of solutions, and actually finally solve the identity security market and deliver the much needed platformization that is going to be required in this space,” Arora said.

The rise of AI-driven threats and the heavy use of credential theft in cyberattacks created an inflection point in identity security, Arora said. The CyberArk deal offers Palo Alto Networks the rare opportunity to acquire a mature, domain-leading company rather than build from scratch. Identity will now be a core Palo Alto Networks platform alongside network security, SASE, cloud security and security operations (see: Why Palo Alto Networks Is Eyeing a $20B+ Buy of CyberArk).

“The next chapter on our multi-platform journey is going to be identity security,” Arora said. “We think that’s a very large opportunity. And as agents and agentic AI continue to evolve, we’re going to see the opportunity in that direction, going back to the space of identity.”

Arora sees the current identity market as fragmented, composed of disconnected components such as identity governance, privileged access, machine identity and now agentic identity. Privileged access management was historically used only for system administrators, but the convergence of identity and access management and PAM cost structures now allows PAM to be scaled across every employee.

“Every organization is navigating a surge of identities – human, machine and increasingly, AI – and we believe every one of those identities must be secured with the right level of privilege control at all times and across all environments,” CyberArk CEO Matt Cohen told investors Wednesday morning. “With Palo Alto Networks, we’ll be able to innovate faster.”

Arora compared traditional IAM to a badge that lets employees into a building but has no idea what they do once inside, which he said is insufficient in a world where 88% of ransomware attacks stem from credential theft. He said identity must shift from access management to real-time identity security, where every user, device and system is continuously monitored and treated as potentially privileged.

“The question I ask myself, ‘Why can’t 100 million users have privileged access? What stops us at 8 million?'” Arora said. “And the answer lies in the fact that 20 years ago, the cost to deliver the privileged access was much higher than the cost to deliver identity security. Today, technology has enabled us to deliver that at a much cheaper cost.”

How Palo Alto Networks, CyberArk Will Come Together

AI agents are a new security frontier since they require permissions, behave unpredictably, and can act across systems like humans or machines, making them high-risk actors in enterprise environments, he said. The risk with AI agents is not just about access at login, but what happens afterward around what tasks are executed, where lateral movements occur, and how permissions are enforced or abused.

“Every one of these agents is going to be unsupervised,” Arora said. “Unsupervision creates the opportunity for security challenges. In that context, every one of these agents must be treated like a privileged agent or a privileged user, and we believe that CyberArk is well-positioned to expand into the opportunity that is going to be presented by agentic AI.”

Although CyberArk serves large enterprises, deployment of the company’s solutions is often limited to a fraction of employee populations, which Arora would like to see change. Over time, the combined company plans to build a full-spectrum identity security platform that tightly integrates with Palo Alto’s existing offerings such as XSIAM. This would provide next-gen capabilities for securing machine identities and agentic AI, he said.

“The average number of users per [CyberArk] customer is anywhere from 500 to 2,000 on an employee base of tens of thousands,” Arora said. “Why can’t they deliver the capability – not just for 500 or 1,000 users? Why can’t we expand the capability to 20,000 users in an enterprise? So, that’s Matt and me working together with the product team to make sure we can create that expansion capability.”

Arora said the CyberArk integration will preserve autonomy in product development while aligning on a joint roadmap. From there, Arora said Palo Alto will gradually incorporate CyberArk into the company’s sales machinery as they have done with SASE and security operations in previous years. The operational integration focused on backend systems, finance, and IT will occur last to minimize distractions, he said.

“Seven years ago, I didn’t know anything about cybersecurity, let alone integrating small acquisitions,” Arora said. “I didn’t know how the industry works. So in seven years, hopefully I built the credibility and credit with our investors that we know how to do this. We’ve learned, and we’ll get this next one done too.”