IAM User Base to Jump 30% by 2031 as Palo Alto-CyberArk Deal Clears 99.8% Vote

Market Growth Signals Continued IAM Budget Priority

Juniper Research projects the number of businesses using identity and access management services will grow from 67.6 million in 2026 to over 88 million in 2031—a 30% increase in five years. For enterprise buyers, this matters less as a prediction than as a signal: IAM remains a funded category across identity governance, privileged access management, single sign-on, and customer identity platforms. The forecast supports budget requests for identity modernization, consolidation programs, and compliance-driven deployments. Vendors with broad suites and specialists that can prove measurable ROI are positioned to capture the growth.

The number itself is large enough to indicate IAM has moved beyond early adoption into standard enterprise infrastructure. Buyers evaluating IAM platforms in 2026 are no longer asking whether to deploy identity controls but which architecture—centralized governance, decentralized access, or hybrid—best fits their risk profile and operational complexity. The market expansion validates continued investment, but it also increases the importance of vendor differentiation. As more organizations deploy IAM, the competitive advantage shifts from having identity controls to how well those controls integrate with broader security architecture, incident response workflows, and zero-trust frameworks.

CyberArk Shareholders Approve Palo Alto Acquisition with Near-Unanimous Support

CyberArk shareholders approved Palo Alto Networks' acquisition with approximately 99.8% support. The deal is expected to close in the second half of Palo Alto's fiscal 2026, subject to regulatory approvals. This consolidates privileged access management and identity security capabilities under a large platform vendor, intensifying pressure on standalone identity vendors and changing procurement dynamics for buyers evaluating IAM strategies.

The shareholder vote removes one layer of uncertainty, but enterprise buyers face new questions. Palo Alto's acquisition strategy centers on integrating CyberArk's PAM capabilities into its broader security platform, which could mean tighter coupling with firewall, endpoint, and SIEM products. Buyers that prefer multi-vendor architectures or best-of-breed identity tools may find fewer standalone options as independent PAM vendors face competitive pressure from bundled pricing and integrated roadmaps. Organizations currently using CyberArk should evaluate roadmap continuity, integration timelines, and licensing changes. Buyers in the market for PAM should assess whether platform consolidation reduces negotiating leverage or increases vendor lock-in risk.

The deal also raises competitive stakes for other identity vendors. Okta, Ping Identity, SailPoint, and Microsoft already compete for identity governance and access management budgets. Adding CyberArk to Palo Alto's portfolio creates a new competitor with privileged access, identity security, and network security combined under one vendor. Buyers with existing Palo Alto deployments may see bundled pricing as attractive, but organizations committed to multi-vendor strategies should model the total cost of integration, support complexity, and exit scenarios if they choose a consolidated platform over specialized tools.

What This Means for IAM Procurement in 2026

The combination of market growth and vendor consolidation creates two countervailing forces. IAM budgets are expanding, but the number of independent vendors may shrink. Buyers gain leverage from market competition but lose it if consolidation reduces choice. Organizations planning IAM procurements in the next 12 months should evaluate vendor roadmaps, integration capabilities, and acquisition risk. A vendor acquired mid-deployment can delay timelines, disrupt support, and force architectural changes.

Buyers should also model the cost of platform lock-in against the operational efficiency of single-vendor architectures. Palo Alto's acquisition of CyberArk is the latest in a series of identity consolidations, including Delinea's acquisition of StrongDM and ongoing activity in non-human identity management. The pattern suggests large security vendors view identity as a core platform component, not a standalone product. That shift benefits buyers that want unified dashboards and integrated workflows, but it penalizes organizations that need flexibility to swap components or integrate with non-standard tools.

For identity governance and PAM buyers, the near-term action is to audit current vendor relationships, map integration dependencies, and assess whether platform consolidation improves or complicates their architecture. The market is growing, but the number of strategic choices may be narrowing.