Palo Alto's $25B CyberArk Deal Closes, Forcing IAM Buyers to Rethink Standalone Vendors

CyberArk Is Now Part of the Platform

Palo Alto Networks closed its $25 billion acquisition of CyberArk in February 2026, nine months after announcing the deal. CyberArk shareholders received $45 in cash plus 2.2005 shares of Palo Alto Networks common stock per share. Palo Alto says CyberArk will remain available as a standalone offering while also integrating into the broader platform.

The consolidation matters because it removes one of the largest independent privileged-access management vendors from the market. CyberArk built its reputation on deep credential security and least-privilege controls. That capability now sits inside a vendor whose primary sales motion is platform consolidation across network security, endpoint protection, and cloud security posture management. For enterprise buyers, the question shifts from "Which PAM vendor?" to "Do we accept identity as part of a platform deal or insist on best-of-breed?"

Standalone identity vendors—Delinea, BeyondTrust, SailPoint, Okta—now defend against a bundled pitch that includes identity, network, and endpoint security under a single contract. That sales advantage is real. Platform vendors can discount aggressively when identity is part of a broader renewal, and they can position tighter integration as a risk reduction story. Standalone vendors must prove that their depth in identity governance, access certification, or privilege analytics justifies the friction of managing multiple vendors.

Okta Pricing Shows AI Agent Costs Are Moving Into IAM Budgets

Okta's public pricing remains seat-based: Workforce Identity starts at $6 per user per month for Starter, $14 for Core Essentials, and $17 for Essentials, billed annually. Customer Identity begins at $3,000 per month for the base platform. But Okta's latest earnings commentary introduces a new variable: AI agent identity is now priced per user, with consumption-based frameworks under discussion and a cap on agent single sign-on in the base edition.

This is the first clear signal that AI agents will appear as line items in IAM budgets, not buried in compute or application costs. For buyers, it creates a new forecasting problem. If your organization runs 500 AI agents handling customer support, procurement workflows, or code generation, each agent may require a licensed identity. The cost model is not yet settled—Okta is testing per-user pricing, consumption tiers, and feature caps—but the direction is clear. IAM vendors will charge for machine identities the way they charge for human identities, and buyers will need to track agent proliferation the way they track contractor onboarding.

Permiso's 2026 identity security research found that 91% of respondents expect AI-generated identities to increase this year, and 25% expect them to double or triple. That is not a product announcement, but it supports the budget case for identity threat detection and response, non-human identity governance, and machine credential controls. If AI agents are identities, they need lifecycle management, access reviews, and anomaly detection. Vendors selling those capabilities as add-ons now have a clearer business case.

European CRA Standards Add Procurement Risk to IAM Contracts

The EU Cyber Resilience Act standards track shows that as of August 13, 2026, no harmonized CRA standard had been published in the Official Journal, meaning no product category yet qualifies for the presumption of conformity. The standards work includes a category for identity management, privileged access management, and authentication readers, still marked "in development."

For enterprise buyers deploying IAM products in Europe, this creates near-term procurement risk. Vendors will need to document secure development practices, credential lifecycle handling, and authorization features in ways that support CRA compliance. That means buyer due diligence must now include questions about CRA readiness, secure-by-design processes, and whether the vendor has a timeline for conformity assessment. Contracts should include language that allows buyers to exit or renegotiate if the vendor cannot meet CRA obligations by the time enforcement begins.

The regulatory pressure also favors larger vendors with compliance teams over point products from smaller players. If a buyer must choose between an IAM vendor with a public CRA roadmap and one without, the former carries less regulatory risk. This is another consolidation pressure, separate from platform bundling but pulling in the same direction.

IAM Market Growth Justifies Continued Budget Allocation

Recent market research puts the IAM market at $25.23 billion in 2026, rising to $45.22 billion by 2030 at a 15.7% compound annual growth rate. Another forecast pegs the market at $26.2 billion in 2026 and $40.5 billion by 2031. These numbers do not announce a specific vendor development, but they confirm that identity remains a top-allocated security spend area.

For buyers, the growth forecast supports budget requests for identity governance, privileged access, and identity threat detection. It also reinforces the trend toward platform consolidation. Vendors are chasing breadth—IGA, PAM, access management, customer identity, and now AI agent identity—because the market size justifies the investment. KuppingerCole's 2026 research compass predicts at least two significant acquisitions affecting the IGA vendor population by the end of this year, which means pricing, packaging, and integrations will continue to shift.

What to Watch

Track how Palo Alto integrates CyberArk into platform deals over the next two quarters. If CyberArk capabilities appear as discounted add-ons in network security renewals, standalone PAM vendors will face pricing pressure. Watch Okta, Microsoft Entra, and Ping Identity for clarity on AI agent identity pricing—consumption models, per-agent licensing, and feature caps will determine how you budget for machine identities in 2027. And if your IAM deployments include European operations, ask vendors for their CRA compliance timeline now, before the standards are finalized and enforcement begins.