CyberArk
Enterprise SaaS/subscription software (completed license-to-SaaS transition ~2021-2023); ARR-driven, land-and-expand across human, machine, and AI-agent identities; sold direct + channel/GSI. Now operated as the Identity Security pillar inside Palo Alto Networks' platformization model.
Now part of Palo Alto Networks — $21.1B consideration (cash + stock) · public-market exposure via PANW
Earnings, margins, COGS & capex
CyberArk exited as a ~$1.44B-ARR, 20%+ growth identity security platform with an 18% non-GAAP operating margin and ~23% adjusted FCF margin - a completed rule-of-40+ subscription transition story. FY2025 revenue of $1.361B (+36%) was flattered by M&A (Venafi machine identity, closed Oct 2024; Zilla Security identity governance, Feb 2025); subscription ARR of $1.267B (+30%) and total ARR of $1.440B (+23%) better reflect underlying momentum. GAAP operating loss (-$131.2M FY2025, vs -$72.8M FY2024) persisted due to stock-based comp and acquisition amortization. Q4 2025 (reported 2026-02-04) was the final standalone print: record $99M net-new ARR. All figures vintage FY2025 / 2026-02.
Income statement — where each revenue dollar goes
% of revenueOf every $1 of revenue, ~0¢ is cost of goods and ~0¢ operating expense, leaving ~100¢ of operating profit.
Revenue trend
Margins
improving (15% FY2024, 20% in Q4 2025 at $75.0M)
widened vs -$72.8M FY2024 on Venafi amortization + deal costs
improving
stable
COGS structure
COGS is typical enterprise SaaS: cloud hosting (AWS/Azure) for SaaS delivery, customer support, professional services (structurally lower-margin than subscription), plus amortization of acquired technology (Venafi) weighing on GAAP gross margin. Self-hosted subscription revenue carries near-pure software margins; SaaS mix shift added hosting cost but was offset by scale.
Capex
Minimal - no data centers of its own at scale (SaaS rides public cloud), no manufacturing; capex mostly offices and internal-use software. Capital deployment went to M&A instead: Venafi (~$1.54B announced May 2024, closed Oct 2024), Zilla Security (~$165M plus earnout, Feb 2025). Vintage: through FY2025.
Latest earnings
Record quarter, characterized by management as strong across the board; no forward consensus framing given the pending (then week-from-closing) PANW acquisition
No standalone FY2026 guidance issued - acquisition by PANW closed 2026-02-11; CyberArk's outlook is now embedded in Palo Alto Networks' consolidated guidance
- Total ARR (2025-12-31)
- $1.440B, +23% YoY
- Subscription ARR
- $1.267B, +30% YoY (88% of total ARR)
- Q4 2025 net-new ARR
- $99M (record), +20% YoY
- FY2025 adjusted FCF
- $318.0M (~23% margin)
- FY2025 non-GAAP operating income
- $246.7M (18% margin)
Growth drivers
- Machine identity — Venafi (certificate lifecycle) + secrets management, with machine identities outnumbering human identities ~82:1 in enterprises (CyberArk 2025 Identity Security Landscape study) - the fastest-expanding part of the platform
- AI-agent identity — securing autonomous agents' credentials/permissions - the strategic rationale PANW cited for the deal ('secure the AI era', Jul 2025-Feb 2026)
- Subscription/SaaS expansion within the installed base (subscription ARR +30% YoY to $1.267B at 2025-12-31; subscription = 81% of FY2025 revenue vs 73% FY2024)
- Platform consolidation from point PAM into identity governance (Zilla), workforce access, and endpoint privilege
- Post-close: distribution through PANW's ~80k-customer base (PANW-stated approximate) and platformization bundling (2026 onward)
Bull & bear
The bull case is now a PANW bull case: CyberArk was the crown-jewel identity asset, acquired to make identity the third pillar of PANW's platform alongside network and SecOps, just as agentic AI makes machine/agent identity the fastest-growing security problem.
- Deal logic is sound: identity was PANW's biggest portfolio gap, and CyberArk brought the #1 PAM franchise plus Venafi machine identity at ~$1.44B ARR growing 23% (2025-12-31)
- AI-agent explosion multiplies identities to secure; CyberArk's vaulting/secrets tech is the natural control plane - PANW explicitly framed the deal as 'securing the AI era' (Jul 2025)
- Cross-sell asymmetry: PANW's ~80k customers vs CyberArk's ~10k - even modest attach rates compound ARR (2026 integration thesis)
- CyberArk exited with improving economics (non-GAAP op margin 15%->18% FY2024->FY2025; $318M adjusted FCF), so it is accretive-quality ARR, not a turnaround
- Regulatory tailwinds (cyber insurance requirements, 47-day cert lifetimes, critical-infrastructure identity mandates) keep demand non-discretionary
The bear case: PANW paid a rich multiple (~17x year-end ARR at the announced value) for growth that was partly M&A-manufactured, and mega-deal integration - PANW's largest ever by an order of magnitude - historically destroys more value in security software than it creates.
- Price: ~$25B announced for what became $1.44B year-end ARR (~17x) / ~18x FY2025 revenue - priced for flawless execution; consideration slid to ~$21.1B by close (Feb 2026) via PANW stock weakness, and PANW absorbed meaningful dilution (~112M new shares)
- Organic growth question: +36% reported revenue vs +23% ARR - Venafi and Zilla flattered the headline; underlying growth was decelerating from the high-20s (FY2024-FY2025)
- Integration risk is concrete: overlapping channel programs, Israeli R&D retention, and CyberArk's complex on-prem installed base do not platformize quickly; Okta and SailPoint will target unsettled customers during the transition (2026)
- Microsoft's Entra bundling erodes the standalone-identity price umbrella over time, pressuring exactly the cross-sell economics the deal assumes
- GAAP reality: CyberArk was still GAAP-unprofitable (-$131.2M FY2025 operating loss); inside PANW the amortization burden grows, weighing on PANW GAAP EPS
What it is worth
Takeout multiple (the market-clearing print) - no standalone valuation is possible post-delisting; forward exposure is via PANW
Integration attrition + Microsoft bundling slows identity ARR to low teens; the ~17x-ARR price marks the top for identity-security multiples and weighs on PANW GAAP EPS for years
CyberArk sustains ~20% ARR growth inside PANW with modest cross-sell; deal is roughly value-neutral to PANW after dilution and integration cost
Identity attach into PANW's ~80k customers accelerates CyberArk ARR beyond 25%+ and the deal screens cheap in hindsight; PANW re-rates on platform breadth
PANW's agreed price of ~$25B equity value (Jul 2025) = ~17x CyberArk's eventual year-end ARR ($1.440B at 2025-12-31) and ~18x FY2025 revenue ($1.361B) - a premium to the SAIL/OKTA comp set (roughly mid-single-digit to ~10x forward revenue in 2025), justified by category leadership + machine-identity/AI optionality. Value received by holders drifted to ~$21.1B purchase consideration at close (2026-02-11; ~$2.3B cash + ~112M PANW shares worth ~$18.5B per PANW's 10-Q) because ~78% of consideration was PANW stock (2.2005 shares + $45.00 cash per CYBR share). Any 'bull/base/bear' today is a PANW question: whether identity cross-sell and AI-agent security justify the dilution.
SWOT
Strengths
- Undisputed PAM category leader (perennial Gartner MQ leader) with deep vault/rotation technology moat built since 1999
- Broadest identity security platform — privileged access + secrets + machine identity (Venafi) + identity governance (Zilla) + workforce access
- High-quality model at exit — $1.44B ARR, 88% subscription, ~23% adjusted FCF margin, record net-new ARR in the final quarter (FY2025)
- Mission-critical, high-switching-cost deployments across a majority of the Fortune 500; security spend resilient through cycles
- Now backed by PANW's balance sheet, sales machine, and platform bundling (post Feb 2026)
Weaknesses
- Persistent GAAP losses (-$131.2M FY2025 operating) on heavy SBC and acquisition amortization
- Reported revenue growth (+36% FY2025) materially M&A-inflated vs ~23% ARR growth - organic deceleration vs headline
- Legacy on-prem PAM base still migrating — PAM deployment complexity historically a friction point vs newer SaaS-native rivals
- As a PANW unit — loss of standalone focus, founder/leadership transition risk, and exposure to PANW's integration bandwidth (absorbing its largest deal ever)
Opportunities
- AI-agent identity security — authorizing and vaulting credentials for autonomous agents; nascent, potentially larger than human identity (2026 framing)
- Machine identity/certificate lifecycle tailwind — 47-day TLS certificate lifetimes (CA/Browser Forum ballot passed Apr 2025, phasing in through 2029) forces automation - direct Venafi demand driver
- Cross-sell into PANW's customer base and inclusion in platformization deals
- Identity-security consolidation: displacing point tools (governance, secrets, CIEM) as CISOs cut vendor count
Threats
- Microsoft bundling Entra ID governance/PIM into E5 — the classic good-enough suite threat to standalone identity pricing
- Okta, SailPoint (SAIL), and private-equity-backed PAM rivals (BeyondTrust, Delinea) attacking segments of the platform
- Integration failure risk inside PANW — culture, channel conflict, R&D attrition of Israeli engineering talent post-close
- Identity-focused attacks evolving faster than controls (session hijacking, token theft, agentic AI abuse) - a breach of CyberArk itself would be existential to the brand
Moats, dependencies & bottlenecks
Moats
Vault deployments touch thousands of credentials, sessions, and workflows across the enterprise; rip-and-replace of PAM is a multi-year project few CISOs attempt
20+ year PAM leadership and Gartner MQ dominance; security buyers pay for the reference vendor. Brand now subordinated to PANW's
Human + machine + AI-agent identity in one platform (post-Venafi/Zilla) is unmatched by any single rival; Microsoft is the only player who could bundle equivalent breadth
Threat/behavior analytics across the installed base improve detection, but weaker than endpoint/network telemetry moats; strengthened by PANW's Cortex data lake post-close
Dependencies
Since 2026-02-11 all strategy, capital allocation, and go-to-market run through PANW; execution of its platformization integration determines CyberArk's trajectory
infrastructure supplier SaaS delivery rides hyperscaler infrastructure; Azure is simultaneously a supplier and (via Entra) a competitor
Core engineering in Petah Tikva; retention through the PANW integration and regional geopolitical disruption are live risks (2026)
Majority of enterprise deals are partner-touched; channel-program merger with PANW's is a near-term friction point
technology substrate Much of PAM value historically anchored to Active Directory sprawl; cloud-native shift changes but does not remove the need
Advantages
- De facto standard for privileged access in regulated industries — banks, insurers, governments default to CyberArk (vintage: through 2025)
- Only vendor with leadership across PAM + secrets + machine identity + certificates (post-Venafi) before rivals assembled equivalents
- Completed the painful license-to-SaaS transition BEFORE being acquired - clean subscription economics (88% of ARR, 81% of revenue) at exit
- Now paired with PANW's network/SecOps telemetry — identity signals + network signals in one platform is a genuine technical differentiator (2026 onward)
Weaknesses
- No longer master of its own roadmap - product priorities compete inside PANW's portfolio
- GAAP-unprofitable at exit; economics depend on non-GAAP framing (SBC, amortization)
- Organic growth decelerating into the close (~23% ARR vs +36% headline revenue, FY2025)
- Historically weak in workforce/CIAM identity vs Okta — the acquisition does not fix breadth at the access-management layer
Bottlenecks
- Integration bandwidth — merging CyberArk into PANW (largest deal in PANW history) while retaining talent and deal momentum - the binding constraint of 2026
- Deployment complexity: full PAM programs take quarters to roll out, gating expansion revenue
- Sales-motion collision — reconciling CyberArk's identity-specialist sell with PANW's platform ELA motion without discounting away identity ARR
- Legacy base migration — remaining self-hosted/perpetual customers must move to SaaS without opening the door to rivals
Top signals & trends
Top signals
Clean close after shareholder approval at the 2025-11-13 special meeting (approved overwhelmingly; exact tally not independently confirmed) and US/EU/UK/Israel regulatory clearances; thesis transfers to PANW
No demand deterioration into the close; customers did not pause buying during deal limbo
Reflects PANW stock decline post-announcement (~78% of consideration was PANW stock) - the market's skepticism about mega-deal dilution/integration
Secondary listing making PANW the largest company on TASE by market cap; symbolic retention of the CyberArk identity and Israeli investor base
Identity security consolidating into platforms; validates the category, intensifies competition for the remaining independents
Trends
strong tailwind · Autonomous agents need scoped, vaulted, auditable credentials; both PANW and rivals name AI-agent identity as the next battleground (2025-2026)
Certificates, workloads, service accounts at ~82:1 vs humans (CyberArk 2025 Identity Security Landscape); 47-day TLS cert lifetime mandate (phasing in to 2029) forces Venafi-style automation
tailwind for platforms, headwind for point tools · CISO vendor-count reduction favors PANW/CrowdStrike/Microsoft platforms - the strategic logic of the acquisition itself
Majority of breaches involve credential abuse (Verizon DBIR-consistent framing, 2024-2025); board-level budget priority
Compresses standalone identity pricing at the mid-market; strongest structural threat to the category
Ecosystem & competitor graph
Suppliers feed the company; customers pull from it. Line thickness shows the strength of each tie (supply-chain dependency, customer earnings contribution). Hover to isolate a tie.
Primary SaaS hosting infrastructure
Cloud hosting + the AD/Entra estate CyberArk secures; supplier and competitor
Secondary cloud + workload identity integration surface
~10k customers at exit incl. a majority of the Fortune 500; no single-customer concentration disclosed (vintage FY2025)
Largest vertical - regulatory-driven PAM adoption (e.g. institutions of the JPM/BAC class; specific names not disclosed)
FedRAMP-authorized offerings; zero-trust executive-order-driven demand
Bundles privileged identity management and governance into E5; the suite-vs-best-of-breed threat
Workforce/customer IAM leader pushing into privileged access (Okta Privileged Access); strongest independent identity brand post-CYBR-acquisition
Identity governance (IGA) leader, re-IPO'd Feb 2025; overlaps with CyberArk's Zilla governance push
Private (Francisco Partners/Clearlake-backed); #2 pure-play PAM, aggressive on pricing and cloud PAM
Private (TPG); Thycotic+Centrify merger, mid-market PAM strength
Identity threat detection bundled with endpoint platform; competes for identity-security budget, now a direct PANW platform rival
HashiCorp acquisition (closed Feb 2025) gives IBM the developer-native secrets-management franchise competing with Conjur/CyberArk secrets
Private (Thoma Bravo); enterprise access management overlap
Private; cloud-native IGA + PAM convergence challenger