Why Palo Alto Networks Is Eyeing a $20B+ Buy of CyberArk

•
July 29, 2025    

This year has already seen the largest cybersecurity acquisition in history, and the second-largest deal in cyber history could be just days away.

See Also: Beyond Replication & Versioning: Securing S3 Data in the Face of Advanced Ransomware Attacks

Less than five months after Google agreed to spend $32 billion on red-hot cloud security startup Wiz, Palo Alto Networks is on the precipice of paying more than $20 billion for privileged access management goliath CyberArk, The Wall Street Journal reported Tuesday. The Silicon Valley-based platform security giant could finalize a deal for Boston-area CyberArk as soon as later this week, according to The Journal.

A Palo Alto Networks-CyberArk deal would dwarf what had been the largest pure-play cybersecurity acquisition prior to 2025: private equity firm Advent and Permira’s $14 billion buy of consumer cyber vendor McAfee in March 2022. Both Palo Alto Networks and CyberArk declined Information Security Media Group requests for comment (see: Google Purchases Wiz in $32B Deal to Boost Cloud Security).

Investors in CyberArk have reacted favorably to the report, sending the identity titan’s stock up $43.76 Tuesday afternoon – or 11.43% – to $426.66 per share, which is the highest the company’s stock has ever traded since going public in September 2014. The company is currently valued at $21.51 billion. Palo Alto Networks’ stock, meanwhile, is down $6.31 Tuesday afternoon – or 3.09% – to $198.19 per share.

A Radical Departure in Palo Alto Networks’ M&A Strategy

Buying CyberArk would be a radical departure from Palo Alto Networks’ M&A strategy up until now, both in terms of the amount spent and the market involved. Palo Alto Networks has been an active buyer since Nikesh Arora became CEO in 2018, but the company almost always opts for startups with promising technology over longtime incumbents with a large customer base and go-to-market team (see: Why Would Palo Alto Networks Want Startup Apiiro for $600M?).

“We are not in the mindset of acquiring large deals,” Arora told investors in August 2022. “We’re in the mindset of looking for great product teams that we can complementarily attach to our capabilities.”

Palo Alto Networks’ lone customer-focused acquisition came in August 2024, when the company spent $1.14 billion to acquire IBM’s QRadar SaaS business and transition those customers to the company’s newer XSIAM offering. Not coincidentally, that’s the most Palo Alto has ever spent on an acquisition. The company has never even spent 10 figures on a startup – the record was $797.2 million for Expanse.

Perhaps more surprising, though, would be Palo Alto Networks entering the broader identity market – a space the company has always sworn off. While the company has played in segments adjacent to security operations such as identity threat detection and response – Palo natively built a module in March 2023 – the company has never shown an interest in getting deeper into user and device authentication.

“We’ve decided some places we want to play and we want to play to win, [but] there are some places we’re not going to play,” Arora told investors in August 2021. “We don’t want to play in identity. So, it doesn’t matter if there is an open space and there are companies out there. We’re not playing there.”

Founder and CTO Nir Zuk told ISMG in March 2025 that Palo Alto Networks has stayed away from the identity market since it’s very difficult to get organizations to replace their existing provider. Unlike endpoint agents, replacing an identity provider requires reintegrating with lots of different internal and external applications, which Zuk said is a long process most enterprises don’t want to bother with (see: Nir Zuk: Google’s Multi-Cloud Security Strategy Won’t Work).

“Even if we had the best product in the world, going into existing customers and having them replace their identity and access management would have been hard,” Zuk told ISMG in March. “And it’s not like we know how to do it.”

Why CyberArk Is More Appealing than an Identity Startup

Coughing up more than $20 billion for CyberArk would alleviate the challenge Zuk cited with getting into the identity space through building organically or buying a series of startups, which is the path Palo Alto opted for in less mature markets including cloud security. CyberArk had more than 9,700 customers – typically large enterprises – at the end of 2024, up 10.2% from 8,800 customers at the end of 2023.

CyberArk’s revenue mix is also more geographically balanced than Palo Alto Networks, owning perhaps to the fact the former has more than 65% of its workforce based outside the United States. CyberArk gets 31% of its revenue from Europe, the Middle East and Africa (EMEA) and just 50.3% from the United States, while Palo Alto depends on the Americas for 68% of its revenue and gets just 20% from EMEA.

Palo Alto Networks has long professed a desire to be in the top three of every market the company plays in. The company believes its organic and inorganic moves in endpoint security will allow Palo to take on Microsoft and CrowdStrike, while the QRadar deal will help Palo go toe-to-toe with Splunk in SIEM. Buying CyberArk would make Palo a large fish in a diffuse market led by folks like Microsoft and Okta.

Wall Street has looked favorably upon CyberArk’s effort in recent years to expand from its heritage in privileged access management to serving the broader identity market. Of the 28 public companies that derive much of their revenue from cybersecurity, CyberArk had the seventh-best performance in 2024, with its stock price increasing by 54.1%. That’s in stark contrast to Okta, whose stock price fell by 9.5% (see: A Mixed Bag for Cybersecurity Stocks in 2024 as Paths Differ).

The company has made bold moves over the past year to expand its total addressable market, spending $1.54 billion in October to buy machine identity management startup Venafi from Thoma Bravo. Then in February, CyberArk pushed into identity governance and administration – a turf long dominated by firms like SailPoint and Saviynt – with its $175 million purchase of Boston-based startup Zilla Security (see: CyberArk Bolsters Identity Governance With $175M Zilla Buy).

These acquisitions build on organic moves CyberArk made in recent years to enter adjacent markets including secrets management and identity and access management. Heading into 2025, investors expected at least 20% year-over-year growth from CyberArk’s core privileged access management business as well as at least 13% growth in the Venafi machine identity business.

The cybersecurity graveyard is littered with vendors that tried and failed to expand beyond their area of historic strength. Both Symantec and McAfee spent the back half of the 2010s trying to build platforms with offerings across many security categories. Neither effort was successful: Symantec’s enterprise unit was sold to Broadcom in 2019, while McAfee’s enterprise unit was merged with FireEye to form Trellix.

Palo Alto Networks has succeeded where other platform efforts failed, shedding its legacy as a network security vendor (though it still sells plenty of firewalls) to become a category leader in everything from SASE and XDR to cloud security and SIEM. But until now, Palo Alto Networks has always kept its distance from the broader identity market.

With the buy of CyberArk, Palo Alto Networks would enter – by far – the largest security market segment where the company doesn’t play today. Palo Alto Networks never promised to be a one-stop shop for all major security product categories, but with CyberArk in its portfolio, Palo would be really close. The promise of a complete cyber platform has never felt more within reach.