On February 11, 2026, Palo Alto Networks closed its acquisition of CyberArk. The deal was announced on July 30, 2025, at roughly $25 billion in cash and stock — $45 in cash plus 2.2005 Palo Alto shares for each CyberArk share. Palo Alto’s own filing later put the final purchase consideration at $21.1 billion. Either way you count it, it is the largest acquisition in the company’s history, and its first of a large public company. Palo Alto Networks completion release · SEC Form 8-K, February 11, 2026
I have spent enough of my career on both sides of this problem to say plainly what changed here. Palo Alto owned the network perimeter. CyberArk owned privileged access. Those were two different perimeters, run by two different teams, with two different control planes. Now they are one company, and Palo Alto has said identity security is a core pillar of its platform, alongside network security and security operations.
The number that explains the urgency is in Palo Alto’s own closing release: an 80-to-1 ratio of machine identities to human identities in the enterprise. That ratio is the whole story. The workforce that needs privileged access is no longer mostly people. It is service accounts, workloads, and now AI agents — and agents are the fastest-growing part of it.
Why it matters
The first reason is the perimeter. The network perimeter was the boundary I spent most of my career defending. The identity perimeter is the boundary that matters now. When those two perimeters live in different companies, the gaps between them are where the breaches happen. A compromised identity with network access is the attack path for nearly every major intrusion of the last decade. Bringing them under one control plane does not eliminate that risk, but it closes the seam between them.
The second reason is the customer. CyberArk’s base runs deep into the Fortune 500, and those customers did not buy a point product. They bought a privileged access program. The question for them is not whether Palo Alto is a good company. It is whether their privileged access program survives the integration intact — same people, same support, same roadmap — or becomes a feature of a platform they did not choose.
The third reason is the one the market missed. The press coverage focused on the $25 billion and the platform strategy. The more interesting number is the one Palo Alto disclosed about its own growth: platformization deals are now more than half its next-generation security revenue, and the CyberArk and Chronosphere acquisitions together contributed $338 million to its $3 billion April quarter. The acquisitions are not a side bet. They are the growth engine.
What I’m watching
The first thing is the layoffs. The day after close, roughly 700 CyberArk employees — about 10% of the combined company’s headcount — were let go. Palo Alto framed it as removing overlap. That is the standard language, and it is usually true. But the number is large, and the timing — the day after close — is the kind of thing that tells the remaining team exactly how the integration will feel. Watch whether the departures were concentrated in sales and back office, or whether they reached into the engineering teams that built the product customers bought.
The second thing is the relaunch. In May, CyberArk was relaunched as Idira, a standalone business unit inside Palo Alto. That is a better answer to the customer question than folding it in quietly — it signals that the identity business keeps its own identity, literally. The test is whether Idira’s roadmap stays independent or slowly converges into the platform’s release cycle.
The third thing is the platform bet itself. Palo Alto now has to prove that identity, network, and operations on one platform is better than best-of-breed on three. The customers who bought CyberArk as a specialist product will be the jury. Their renewal decisions over the next eighteen months are the real verdict on this deal.
Identity used to be the thing you bolted onto the network. Now the network is being bolted onto identity. That inversion is the whole story of this deal — and of the next five years of security consolidation.
Leave a Reply