TL;DR: Palo Alto Networks’ planned acquisition of CyberArk, valued at about $25 billion, signals that identity security, privileged access, and lifecycle governance have become core enterprise controls, especially as AI and cloud access expand, according to SPHERE Technology Solutions. The deal makes identity hygiene and privileged access discipline board-level issues rather than back-office tasks.
At a glance
What this is: SPHERE analyses Palo Alto Networks’ planned CyberArk acquisition as a signal that identity security and privileged access management have moved from supporting controls to core enterprise defence.
Why it matters: IAM, PAM, and NHI teams should treat identity hygiene, lifecycle governance, and privileged access as board-level controls that now shape cloud and AI access decisions.
Context
Identity security is the set of controls that decide who or what can access systems, data, and tools. SPHERE argues that the planned Palo Alto Networks acquisition of CyberArk shows those controls are no longer a back-office concern, because cloud adoption and AI use have pushed identity to the centre of access decisions.
The article links that shift to privileged access, lifecycle management, and identity hygiene. Its central claim is that legacy IAM and PAM only work when the underlying identities are accurate, governed, and continuously cleaned, including shadow accounts, orphaned accounts, and stale privileges.
Key questions
Q: What breaks when privileged access is not part of identity governance?
A: Governance breaks at the highest-risk tier because privileged accounts can create, hide, or amplify access problems that normal reviews do not surface. If privileged activity is not tied to the same certification and exception workflows, the organisation can pass audit while still holding dangerous standing privilege.
Q: Why do stale identities increase risk even when PAM is deployed?
A: Because PAM assumes the accounts it governs are current, owned, and correctly scoped. If abandoned accounts or unmanaged credentials survive lifecycle changes, they become persistent access paths that can be reused or exploited without triggering the intended governance logic.
Q: How should teams prioritise identity hygiene versus new access controls?
A: Identity hygiene should come first when current inventories are incomplete or trust in entitlement data is low. New access controls cannot reliably reduce risk if they are layered on top of inaccurate ownership, stale privileges, or unresolved shadow accounts.
Q: What is the difference between PAM and identity hygiene?
A: PAM governs privileged access decisions and enforcement. Identity hygiene ensures the identities, entitlements, and ownership data feeding those decisions are accurate, which is why the two controls are complementary but not interchangeable.
Technical breakdown
Why identity hygiene now determines control effectiveness
Identity hygiene is the quality of the identity records and entitlements that governance tools depend on. If shadow accounts, stale privileges, orphaned accounts, and misconfigured identities remain in the estate, IAM and PAM controls will enforce the wrong state with confidence. In practical terms, least privilege and JIT are not just policy patterns; they depend on current, accurate identity data. That makes hygiene a control dependency, not an optional cleanup task.
Practical implication: validate identity inventories before you trust privileged access workflows to enforce least privilege.
How lifecycle management changes privileged access governance
Lifecycle management governs the creation, change, and removal of identities over time. In the article’s framing, CyberArk’s PAM value depends on whether identities are onboarded, updated, and offboarded correctly, because abandoned access paths outlive their owners and keep privilege alive. The mechanism matters for both human and non-human identities, especially where cloud services, DevOps tokens, and AI-related access patterns blur the boundary between user and workload.
Practical implication: tie privileged access approvals to lifecycle events so stale identities do not retain access beyond their purpose.
Why cloud and AI pressure identity controls at the same time
As the enterprise perimeter dissolves, identity becomes the primary control plane for access. That is why the article connects identity security to cloud services, machine identities, and AI agents rather than treating them as separate problems. When access decisions shift to identity attributes and entitlements, any weakness in discovery, governance, or remediation scales quickly across the environment. The result is broader blast radius, not just more administrative overhead.
Practical implication: extend governance coverage to cloud workloads, service accounts, and AI-linked access paths as part of the same control model.
Breaches seen in the wild
- Azure Key Vault Contributor escalation 2024: Datadog found Azure Key Vault Contributor could add itself to access policies and read every secret, key and certificate in a vault.
- BeyondTrust breach 2024: A stolen BeyondTrust Remote Support API key let a China state-sponsored actor reset accounts and reach US Treasury workstations in 2024.
Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.
NHI Mgmt Group analysis
Identity hygiene is now a control dependency, not a housekeeping task. Legacy IAM and PAM only produce reliable outcomes when the underlying identity data is current and complete. Shadow accounts, stale privileges, and orphaned access paths undermine the enforcement layer before a policy is ever applied. The implication is that governance teams must treat identity quality as part of control design, not post-hoc cleanup.
PAM value collapses when lifecycle data is wrong. Privileged access systems assume they are governing known, valid identities with accurate ownership and scope. When abandoned accounts or misclassified access paths persist, the system can only automate bad state faster. That makes lifecycle governance the condition for PAM effectiveness, not a separate administrative stream.
Ephemeral access still depends on durable identity truth: JIT, least privilege, and AI-era access models all assume that identities can be trusted at issuance time. That assumption fails when shadow accounts, orphaned tokens, or stale entitlements remain hidden in the estate. The implication is that identity governance has to shift from periodic review to continuous discovery and correction.
The acquisition signals that identity security is moving into the core security stack. When a perimeter-led vendor places this much strategic weight on identity, the market is acknowledging that access control now sits alongside network and endpoint defence. Practitioners should expect tighter convergence between IAM, PAM, cloud security, and identity hygiene workflows. The implication is to re-evaluate programme boundaries before the market defines them for you.
AI and machine identities make identity governance more operationally fragile. The article is right to link future access patterns to AI agents, DevOps tokens, and ephemeral cloud services because those identities scale faster than manual governance processes. That does not create a new category of identity problem so much as expose how incomplete current lifecycle and hygiene models already are. Practitioners need governance that can keep pace with identity creation and removal at machine speed.
From our research library:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Read next: Ultimate Guide to NHIs — Key Challenges and Risks
What this signals
Identity hygiene is becoming the gating condition for modern privileged access. If an organisation cannot continuously find shadow accounts and stale entitlements, it cannot assume that least privilege or JIT is actually constraining the right identities. The governance task is shifting from periodic certification to continuous identity truth maintenance.
Cloud and AI access patterns raise the stakes for lifecycle discipline. DevOps tokens, ephemeral cloud services, and AI-linked identities all expand the number of access paths that can outlive their intended purpose. That is why the question is no longer whether PAM exists, but whether the identity data underneath it is clean enough to trust.
Privileged access becomes less about elevation and more about trust in the identity estate. Organisations that still separate IAM, PAM, and hygiene into disconnected programmes will struggle to keep pace with machine-speed identity creation and teardown. The more dynamic the access model, the more important the underlying identity records become.
For practitioners
- Audit shadow accounts and orphaned identities Identify accounts, tokens, and privileged entitlements that no longer map cleanly to an owner, workload, or lifecycle event, then route them into remediation before they can be used as persistent access paths.
- Bind PAM to lifecycle events Require joiner, mover, and leaver signals to update privileged access state so access cannot outlive the identity’s current role, workload, or business purpose.
- Validate identity data before enforcing JIT Check that source attributes, group membership, and entitlement records are accurate before relying on just-in-time access to limit privilege exposure.
- Extend governance to machine and AI-related identities Treat DevOps tokens, ephemeral cloud services, and AI-linked access paths as part of the same governance plane as human privileged users.
Key takeaways
- Identity security now sits at the centre of enterprise defence, and the article treats privileged access and lifecycle governance as core controls rather than secondary administration.
- The article’s risk signal is identity quality: shadow accounts, stale privileges, and orphaned access can undermine PAM even when the tooling is in place.
- Teams should treat identity hygiene, lifecycle linkage, and privileged access governance as one control plane if they want least privilege and JIT to hold in practice.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Non-Human Identity Top 10 addresses the attack and risk surface, while NIST CSF 2.0 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Non-Human Identity Top 10 | NHI-01 — Improper Offboarding | The article centres on abandoned and shadow accounts that remain active after their purpose ends. |
| NHI-05 — Overprivileged NHI | The article links privileged access risk to identities retaining more access than they need. | |
| NHI-07 — Long-Lived Secrets | The article discusses tokens and access paths that persist beyond their intended lifecycle. | |
| Recommendation — Track and revoke identities that outlive their owners or workflows under NHI-01. Review privileged entitlements against actual need and remove excess access under NHI-05. Shorten secret and token lifetime so standing access does not persist past business need. | ||
| NIST CSF 2.0 | PR.AA-05 — Access Permissions, Entitlements and Authorizations | The article is fundamentally about keeping identity entitlements aligned to current access needs. |
| Recommendation — Align entitlement governance to PR.AA-05 so access is continuously authorised and scoped. | ||
| CIS Controls v8 | CIS-5 — Account Management | The article emphasises discovery, governance, and remediation of shadow and orphaned accounts. |
| Recommendation — Apply CIS-5 to inventory, review, and remove unmanaged accounts before they become persistent access paths. | ||
Key terms
- Identity hygiene: Identity hygiene is the practice of discovering, normalizing, and enriching identity records so governance can rely on them. It reduces ambiguity across directories, platforms, and operational systems, and it makes access review and remediation possible at enterprise scale.
- Shadow account: A shadow account is an identity used for work that is not managed under normal organisational controls. It may lack approved MFA, monitoring, retention, and revocation processes. In practice, it creates a parallel trust zone where sensitive activity can occur without the same governance applied to corporate identities.
- Lifecycle Governance: Lifecycle governance is the set of controls that cover creation, assignment, review, rotation, and retirement of identities and credentials. For NHIs, it is the difference between a temporary automation asset and a persistent access risk. Strong lifecycle governance keeps ownership and expiry tied to actual business use.
- Privilege Access Management: Privilege Access Management is the discipline of controlling and monitoring elevated access to critical systems and data. It governs how privileged accounts, credentials, sessions, and commands are issued, used, recorded, and revoked, so administrative power is limited, traceable, and aligned to policy, risk, and operational need.
Deepen your knowledge
NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.
Published by the NHIMG editorial team on June 22, 2026.
Updated on October 6, 2026.
NHI Mgmt Group, the independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org