Analysis: Palo Alto Networks bolsters Its AI play with acquisition of CyberArk – News

Palo Alto Networks Inc.‘s announcement Tuesday of its intent to acquire CyberArk for $25 billion implies a heavy price tag, as its shares fell on the news. But I believe it to be a good, long-term strategic move for Palo Alto and a logical extension of its platformization strategy.

Valuation is interesting to look at but highly overrated long-term. If an acquisition is a good one and helps transform a company, then the purchase price won’t matter over time. Consider the purchase of Mellanox Technologies Ltd. by Nvidia Corp., which was almost $7 billion in 2019. Given that it moved Nvidia into networking and was the foundation for innovations like NVLink and NVSwitch, the company could have paid twice what it did, and we still would have looked at it today as a good deal.

CyberArk enables Palo Alto to go after the identity market, which should flourish in the agentic and physical artificial intelligence era. Post-acquisition news, Palo Alto CEO Nikesh Arora (pictured) was on CNBC and discussed this with Jim Cramer. “I’ve always paid attention to markets when they inflect, because inflection points create the opportunity for us to enter markets,” he said. “I believe with the AI wave we’re seeing, with 88% of all ransomware attacks driven by credential theft, identity is an unsolved problem.”

This topic of conversation came up with Arora at an analyst roundtable at the recent RSA Conference. He discussed the concept of allowing agents to complete tasks on our behalf and the security challenges associated with this. A simple example would be to ask an airline’s agentic agent to rebook a flight for you. One would need to give permission for the agent to do that.

The logical extension of this is then to have the airline agent rebook your hotel, car rental, dinner reservations and so on. The challenge with this is do you give your usernames and passwords for the various services to the airline? A third-party agent? A digital twin of yourself? There are many possibilities, all of which will be used to some degree.

Also, with the rise of physical AI, each of those devices needs an “identity” to operate securely within their environments. I recently spoke with a chief information officer of a healthcare organization, and we were discussing using autonomous wheelchairs to take patients curbside, obviating the requirement to have a clinician take the person. That would allow for the clinicians to spend more time bedside rather than doing a task that could be automated. However, in healthcare, security is paramount, creating the need for a holistic identity solution.

CyberArk will plug in nicely with Palo Alto on several fronts. The first is the convergence of privileged access management, or PAM, and identity and access management, or IAM. The two are similar but operate at different levels. The latter is broad in scope and manages identities and permissions for all people, devices and apps. PAM can be considered a specialized subset of IAM where it focuses specifically on securing and managing high-level “privileged” users.

Historically, PAM was more expensive to deploy than IAM, so its use was limited. By rolling it into their platform, Palo Alto can offer PAM at the same cost as IAM, enabling it to be used on every device, user, machine and AI agent. The concept of “proliferation of privilege” has been bandied about for a while, but with standalone platforms it’s hard to scale.

Also, this expands Palo Alto’s platform capabilities. The identity industry is like every other submarket of security, in that it’s highly fragmented, with the various vendors solving a piece of the security problem. Palo Alto has done an excellent job of acquiring point products into its platforms and then using the data to “see” across the attack surface with more breadth and depth. With threat actors continually focusing on identity for breaches, bringing CyberArk into its platform makes sense and overdue.

The concept of the platformization is simple to understand and has been happening for over a decade. New vendors pop up to solve a problem, as the features get standardized, then get rolled into a larger platform. The best example of this is the next-generation firewall. At one time customers purchased firewalls, IPS systems, virtual private networks and more as point products. Today, no one does that, as the features were standardized and rolled into the firewall. Similarly, secure web gateways, cloud access security broker, zero trust and so on were all separate products and now they’ve been rolled into a security service edge stack.

On the interview with Cramer, Arora talked about this. “Long term, a billion-dollar revenue company should not be public,” he said. “They should be part of a bigger entity which allows for the leverage and scale required to create large amounts of cash flow and high market cap.” He was addressing a financial audience here, but the piece Arora omitted was the larger entity: if the technology is integrated correctly, companies can find and react to breaches faster and more accurately.

I’m not sure I agree that there should be no publicly traded security companies of a billion in revenue, but his thesis is correct, particularly in the AI era. Security is now an AI game, which requires data and lots of it. Point products are limited to the data within their silos where the platform vendors have a much broader set of data to work with. The platform vendors need to have the technical chops to know what to do with the data, but that’s something Palo Alto has shown it is excellent at, as evidenced by its success with the large number of acquisitions its done.

Agentic agents, robots and AI are coming and that requires security teams to rethink their approach to identity. Palo Alto scooped up CyberArk to address this, but I’m sure the other identity players will be in the cross hairs of other security companies. Okta, you’re on the clock.

Zeus Kerravala is a principal analyst at ZK Research, a division of Kerravala Consulting. He wrote this article for News.

Photo: News