Palo Alto Networks Major Deal Breakdown

Did the acquisition target for Palo Alto Networks’ identity market entry absolutely have to be CyberArk? No, but CyberArk was the best option they had among scaled identity companies. There just aren’t that many viable targets with the right financial profile and product suite. CyberArk is a great company. I’m surprised they got it. CyberArk has more pieces of a comprehensive workforce identity offering than most other scaled alternatives. They have PAM, SSO (albeit third or fifth in the market), and they just acquired IGA with Zilla, an early-stage company. Most of the other targets Palo Alto Networks could have acquired would have required add-on acquisitions to round out the full workforce identity offering. Okta now has SSO/IGA/PAM but likely wasn't willing to sell at their current market cap of ~$17 billion. That's roughly half its all-time high, and now below CyberArk (even before the acquisition report broke). Todd McKinnon is still a relatively young CEO who looks committed for the long haul. Ping Identity could have made sense, but their product portfolio doesn’t have well-established IGA or PAM capabilities, even with ForgeRock. Palo Alto Networks likely didn’t want to be in the customer identity business, either. They do have a directory product, which is nice...but again, directory is not the way the identity market will be won. SailPoint just went public again and has had a successful return. They’re primarily an IGA company that has acquired its way into PAM, but is nowhere near the depth of CyberArk there. They don’t do SSO yet, either. Great company, not as great of a strategic fit for Palo Alto Networks. There is a long tail of smaller companies in the identity market with varying shapes and sizes of a product portfolio. Some have eight and nine figures of revenue: – Saviynt – RSA Security – SecureAuth – 1Password – Keeper – Veza – StrongDM – ...dozens more Palo Alto Networks was playing an entirely different game here. The plan wasn’t to do value acquisitions of different market leaders in multiple identity segments and slowly grow an identity business. The quest to win against both hyperscalers and large competitors like CrowdStrike needed a transformative deal.

Highlighting PANW Q3'25 earnings call, by product/market breakdown: Mega deals, SIEM/SOC, Email Security, Exposure Management, SASE, Browser Security, AI Security 👇 𝗠𝗲𝗴𝗮 𝗱𝗲𝗮𝗹𝘀 $90M, $46M, $33M – the top two driven by platformization through XSIAM (the recent ultra-large deal I recall is Akamai’s 9-figure - more of a cloud infrastructure deal tbh) ~90 net new platformization deals 𝗫𝗦𝗜𝗔𝗠 >200% ARR Growth (YoY) – crazy; that’s a hypergrowth startup metric) >$1M Average ARR – crazy again. Would love to know the median (some SIEM/SOC deals might be ridiculously high) Nikesh Arora: “XSIAM has the potential of being the game changer for both the industry and Palo Alto Networks ... By consolidating security data into a single AI-driven SOC platform, XSIAM is modernizing and disrupting the traditional SIEM market. On a trailing 12-month basis, XSIAM bookings are now approaching $1 billion.” 👀 𝗘𝗺𝗮𝗶𝗹 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 & 𝗘𝘅𝗽𝗼𝘀𝘂𝗿𝗲 𝗠𝗮𝗻𝗮𝗴𝗲𝗺𝗲𝗻𝘁 These two recent launches highlight XSIAM’s pivotal role as both infrastructure and force multiplier for future innovations (btw, long-time X followers know I anticipated both of these product launches since early 2024) – The fact that it’s a massive security data security platform has unlocked these new capabilities and emphasizes the real platform play: inspecting an email is one thing, but understanding the full context and user activity beyond the inbox is a privilege reserved for real platform-play vendors (email, endpoint, browser, network, SOC from a single vendor). 𝗦𝗔𝗦𝗘 & 𝗔𝗰𝗰𝗲𝘀𝘀 𝗕𝗿𝗼𝘄𝘀𝗲𝗿 ~6,000 SASE customers; 36% ARR growth (YoY) ~40% of new SASE customers are new to PANW (suggesting significant future upsell/platformization..) ~3M Access Browser seats – that’s a +1,100% YoY growth(!) For those who raised eyebrows about Talon’s EV/ARR disproportionate valuation, those eyebrows can probably go back in place now. That’s the power of distribution, reserved only for giants like PANW, CHKP, CSCO, etc. - where a successful PMI turns into top ROI. “𝘉𝘳𝘰𝘸𝘴𝘦 𝘉𝘳𝘢𝘷𝘦𝘭𝘺”? 𝗔𝗰𝗾𝘂𝗶𝗿𝗲 𝗕𝗿𝗮𝘃𝗲𝗹𝘆! 💪 𝗔𝗜 𝗦𝗲𝗰𝘂𝗿𝗶𝘁𝘆 Nikesh confirmed the $700M acquisition of Protect AI and emphasized how PANW is bullish on AI Security. The $15B TAM is being addressed through this platform play: Model scanning, red-teaming, posture, Agent & Runtime Security (interestingly, only the first two with Protect AI's logo..). Check out this quote – “In cloud security, we dwelled too long on the peacetime capabilities of cloud security... but in the firewall sort of AI business, we've actually doubled down on the production capability ... We will relentlessly innovate and make sure that we don't get sideswiped by any vendor in the market.” I recommend reading my previous post with my feedback on the “AI Security is Dead!” mantra – https://lnkd.in/gRCspad4 That’s a wrap!

The 44 leading cybersecurity vendors tracked by Omdia announced 29 mergers and acquisitions in the first half of 2025, nearly matching the full-year total for 2024. The combined estimated deal value surged to $61.10bn, nearly 6x higher compared to the same period in 2024. Excluding the two mega-deals involving Google Cloud Security-Wiz ($32bn in 1Q) and Palo Alto Networks-CyberArk ($25bn in 3Q), the remaining 27 transactions totalled $5.10bn, with 16 valued at $100m or more. PANW announced its largest acquisition to date, a proposed $25bn takeover of identity security vendor CyberArk. The deal signals a strategic pivot for PANW, moving beyond smaller tuck-in technology acquisitions toward platform-scale diversification. CyberArk has itself been acquisitive, having added Zilla Security for $175m and Venafi for $1.54bn to its portfolio in the last two years. In the 3Q, AI security M&A accelerated, as vendors raced to add new capabilities to capture emerging opportunities in mitigating the expanding threat landscape posed by LLMs and agentic AI. Nearly $1bn was spent on four early-stage vendors, which had secured almost $150m. These included Check Point Software-Lakera, CrowdStrike-Pangea, F5-CalypsoAI, and SentinelOne-Prompt Security. CrowdStrike’ Onum SentinelOne’s Oberservo AI deals underscore intensifying SIEM competition. These acquisitions strengthen their platforms with enriched and consolidated telemetry data from multiple sources and reduced ingestion costs. Since 2022, 115 cybersecurity deals have been announced, totalling $181bn. 94 involved venture-backed vendors, acquired for $54.23bn after raising $8.04bn. Excluding Google Cloud–Wiz, the remaining 93 deals totalled $22.23bn, with $6.04bn in funding. Average funding-to-sale multiple: 12.5×; excluding Wiz: 8.1×.

Palo Alto Networks acquisition of CyberArk is a lot of money changing hands and the acquisition makes sense, even if from an engineering perspective it's not exciting. It's a good way to buy into a market due to the size, customer count, and reputation. I wouldn't call the CyberArk product experience a delight; however, PAN needs someone with a mature product that works across a lot of use cases and teams. Cyberark is one of the only providers that can completely cover enterprise identity use cases from browser access to SSH, with details like sophisticated certificate management along the way. I would expect additional PAM acquisitions in the medium term to try and shore up a true "identity platform" that offers some of the more modern workflows on both the JIT cloud access and secure browser sides. While CyberArk supports both of these workflows on paper, they really need to be more useable. Either way, it seems like PAN really is trying to make the Google or Microsoft of security companies, having product offerings covering most of the gambit, and I think it can work.

Excited to publish a new piece on why we think Palo Alto Networks' acquisition of CyberArk might be much more important than many people anticipate in shaping the future of identity security. Identity is officially the new perimeter. This is something that we've written on over the past few weeks (but you'll see us write extensively MORE of over the next few months). As a result, we believe the Palo Alto Networks’ acquisition isn’t just another cybersecurity deal, but it’s a signal for a large identity category like PAM will evolve and reshape how enterprises think of privilege users / defend themselves in the next decade. Here are 5 key takeaways from our latest deep-dive analysis 👇 1️⃣ The platform wars have reached identity. PANW’s acquisition of CyberArk marks a decisive move to unify network, cloud, and identity, completing its full-stack security vision. Identity is now the control plane of enterprise defense. They'll likely need a new startup for the agentic piece. 2️⃣ PAM is being rewritten for the AI era. CyberArk’s dominance in Privileged Access Management gives Palo Alto a foundation to secure not just humans, but machines, workloads, and AI agents (this is the next major attack surface!) 3️⃣ The consolidation vs. best-of-breed debate just intensified. If Palo Alto integrates CyberArk smoothly (BIG If), it could accelerate a market-wide shift toward unified security ecosystems. If not, it’ll strengthen the argument for specialist vendors. 4️⃣ Identity-first SOCs are coming? Merging CyberArk’s PAM expertise with Palo Alto’s SOC and AI capabilities sets the stage for identity-aware detection and response, this potentially a blueprint for the “next-gen SOC” ? or we track AI Agents?? (hypothesis!) 5️⃣ Opportunities are wide open for new emerging PAM players. As identity becomes the new perimeter, new companies tackling non-human identity, machine lifecycle governance, and AI agent control will define the next growth wave. We think the market is tired of older players like Delinea or Beyond Identity. We see opportunities for early stage startups, and we like what companies like Silverfort (PAS), Apono, and Teleport are doing. We outline our full thesis in the report breaking down PAM, CyberArk, PANW's platform approach and more. 🔗 Read the full report: https://lnkd.in/gqbEaeyP *** #CyberSecurity #IdentitySecurity #PAM #PaloAltoNetworks #CyberArk #AIsecurity #CISO

𝐏𝐚𝐥𝐨 𝐀𝐥𝐭𝐨 𝐍𝐞𝐭𝐰𝐨𝐫𝐤𝐬 𝐭𝐨 𝐀𝐜𝐪𝐮𝐢𝐫𝐞 𝐂𝐲𝐛𝐞𝐫𝐀𝐫𝐤 𝐟𝐨𝐫 $25 𝐁𝐢𝐥𝐥𝐢𝐨𝐧 Palo Alto just penned its biggest deal ever. A $25B cash-and-stock for CyberArk. Shareholders get $45 cash plus 2.2005 PANW shares for every CyberArk share (~26% premium over recent prices). If all goes smoothly, the deal closes in the second half of Palo Alto’s fiscal 2026. But here’s the real question: 𝘞𝘩𝘢𝘵 𝘥𝘰𝘦𝘴 𝘵𝘩𝘪𝘴 𝘮𝘦𝘢𝘯 𝘧𝘰𝘳 𝘶𝘴? The folks living and breathing identity security? 𝐖𝐡𝐚𝐭 𝐏𝐚𝐥𝐨𝐀𝐫𝐤 (™) 𝐢𝐬 𝐀𝐢𝐦𝐢𝐧𝐠 𝐅𝐨𝐫 • 𝐒𝐮𝐩𝐞𝐫 𝐀𝐩𝐩: Palo’s all-seeing security platform + CyberArk’s identity muscle = fewer vendors, tighter integrations and better end-to-end risk context, aka fewer security headaches, easier compliance and hopefully less time in vendor bingo. • 𝐅𝐚𝐬𝐭𝐞𝐫 𝐈𝐧𝐧𝐨𝐯𝐚𝐭𝐢𝐨𝐧: Palo’s deep pockets could turbocharge CyberArk’s roadmap for next-gen PAM, secrets management, IGA and machine identity, all powered by AI, aka new features faster, especially for cloud and non-human identities. Your SOC might actually get smarter. • 𝐎𝐧𝐞-𝐒𝐭𝐨𝐩 𝐒𝐡𝐨𝐩 𝐟𝐨𝐫 𝐏𝐫𝐢𝐯𝐢𝐥𝐞𝐠𝐞𝐝 & 𝐍𝐇𝐈: Unified controls for bots, workloads and service accounts, aka less identity sprawl, fewer rogue service accounts and no more “wait, who owns this token?” moments. 𝐖𝐡𝐚𝐭 𝐭𝐨 𝐖𝐚𝐭𝐜𝐡 𝐎𝐮𝐭 𝐅𝐨𝐫 • 𝐈𝐧𝐭𝐞𝐠𝐫𝐚𝐭𝐢𝐨𝐧 𝐏𝐚𝐢𝐧𝐬 𝐀𝐫𝐞 𝐑𝐞𝐚𝐥: Mergers mean roadmap changes, tool overlap, platform migrations and the surprise “End-of-Life” emails. Get ready for some turbulence and plan for migration and tool churn. • 𝐁𝐢𝐠 𝐕𝐞𝐧𝐝𝐨𝐫, 𝐁𝐢𝐠 𝐏𝐫𝐢𝐜𝐞 𝐓𝐚𝐠: Consolidation often means steeper prices, bundles you don’t need and fewer choices at renewal time. That 𝘴𝘶𝘱𝘦𝘳 𝘢𝘱𝘱 might cost more than you think. Budget accordingly. • 𝐒𝐮𝐩𝐩𝐨𝐫𝐭 𝐌𝐚𝐲 𝐋𝐨𝐬𝐞 𝐈𝐭𝐬 𝐇𝐮𝐦𝐚𝐧 𝐓𝐨𝐮𝐜𝐡: Culture clash, staff turnover and shifting priorities can water down that great CyberArk community vibe. Don’t be surprised if support takes longer, niche questions go unanswered or your favorite CyberArk features take a backseat. Palo Alto + CyberArk 𝘸𝘪𝘭𝘭 change the identity game but for better or worse is just TBD

Palo Alto Networks reported outstanding results. Time to revisit the story? In short, the platformization strategy, which many investors were skeptical about, is working. Very strong topline metrics – all above expectations: ▪️Next Gen ARR up 32.2% YoY, and total revenue up +15.8% ▪️RPO up 24.4%, 4pp better than expectations ▪️Product revenues up 19%, 5pp better than expectations ▪️Software now accounting for 56% of product revenues ▪️Signed a large deal $50M ARR …shows the magnitude that companies are willing to spend to consolidate their cyber spend. 🚀 But here is where the real upside will come from. If Palo Alto Networks can execute on the CyberArk deal the same way it has been on the tuck-in acquisitions, it could take their M&A playbook to the next level. 🤝 Here is what we loved about the deal: ▪️ Adds another pillar to Palo Alto Networks strategy with a ~30B TAM. Identity is an area that historically wasn’t as interesting, but is just becoming super hot, with the introduction of AI Agents and non-human (machine) 🤖 identities. Cyber Ark is the leader in Privileged Access Management (PAM) …see graphic below 👀 ▪️ The main synergy will come from leveraging Palo Alto's customer base …CyberArk has about 8K paying customers, while Palo Alto would expand the reach to its 85K customers. There is also an opportunity to extend CyberArk's products to lightweight low-cost PAM agents that can be embedded across Palo's platform (browsers, VPN). ▪️ Reasonable price: pre-synergies, this deal was done at around ~17x EV/NTM Sales. On top of being able to leverage the large customer base, Palo can get synergies across the board: “We have a business model that scales at every single line item of the P&L” - Nikesh Arora …guided to 40%+ FCF post deal close Sure, there are some risks associated with the strategy: first large deal, large deals in cybersecurity have generally not been home runs... but companies that have value-generating M&A playbooks can get a nice valuation premium...especially in a space with so much opportunity for consolidation. Here is the best part: the stock was down 15% on the CyberArk deal and Fortinet's results creating a nice entry point. #cybersecurity #technology #artificialintelligence

Very insightful article on the recent CyberArk acquisition by Palo Alto Networks. The $25B marks Palo Alto’s largest acquisition yet, aiming to integrate robust identity and privileged access management (PAM) capabilities into its existing security platform. The strategy reflects Palo Alto’s ongoing transition toward a unified cybersecurity platform, now extended to include identity security, an entirely unmet segment for them. For security leaders and teams there are several benefits and potential drawbacks to this acquisition to consider. Potential Benefits •Continuity with scale: Your existing CyberArk infrastructure and expertise likely remain intact, but now supported by the extensive resources of Palo Alto. •Broader platform integration: Expect deeper integrations with network, endpoint, cloud, and AI-driven security components across Palo Alto’s suite, great for consolidating security into a single vendor experience. •Strategic momentum: Bouncing off strong Q4 results and bullish fiscal 2026 guidance from Palo Alto , this signals a forward-moving roadmap, especially towards identity/hybrid security plus AI tooling. Risks & Considerations •Innovation drag: As noted in several commentary pieces, CyberArk specialized exclusively in PAM. Embedded now within a massive platform, its innovation pace may slow, drowned out by competing priorities. •Vendor lock-in: Leaning further into Palo Alto’s ecosystem may limit flexibility, particularly if your requirements diverge from its roadmap. •Integration headaches: Mergers this big often bring complexity, cultural, technical, roadmap alignment, and potential shifts in support/service. •Pricing shifts: Over time, packaging and licensing Potential Benefits I’d say this move underscores a broader industry takeover: identity is now the control plane for cybersecurity. CyberArk’s acquisition confirms this shift, but as an existing user, it’s essential to stay vigilant around roadmap alignment, innovation, and enterprise agility. You may benefit from increased integration and vendor support, but also watch for signs of deprioritization of your unique needs. Proactively engage with product and account teams, and ensure you retain a voice in how identity security evolves at Palo Alto.

25 billion. Let that land. That’s the price Palo Alto Networks is paying to acquire CyberArk, not just a company, but a massive chunk of the identity-security market. This isn’t innovation. This is buying the market. From a business perspective? A clever move by Palo Alto. Expanding dominance, consolidating power, and tightening their position as the world’s largest cybersecurity vendor by market cap. But from a customer perspective? I see a different story. I’ve worked at Palo Alto myself. I know how the machine operates. It’s not about delivering the best security. It’s about extracting maximum value per customer. And when everything is pushed under one vendor and one strategy, the squeeze becomes very real. This acquisition means one thing for CyberArk customers: You will be squeezed out. Like a lemon. Because while it might look attractive, “one vendor for everything, easy integrations, simplified procurement”. The real outcome is vendor lock-in at a scale we’ve never seen before. All your eggs in one massive, shareholder-driven basket. And that’s the part many organizations underestimate. Ask yourself: Do you really want your entire security stack controlled by a single vendor whose primary obligation is to Wall Street, not your threat landscape? Consolidation may sound efficient. But in cybersecurity, diversity is resilience. Putting everything in one place doesn’t make you safer, it makes you dependent. This $25B deal should be a wake-up call. Not a convenience. Not a shortcut. A moment to rethink whether “one vendor to rule them all” is truly in your best interest.