Topic starter
24/06/2026 9:05 pm
TL;DR: Opal Security argues that Palo Alto Networks’ $25B CyberArk acquisition reflects a market shift from login and vault control toward runtime authorization, especially as AI agents and machine identities expand the attack surface. Static roles, ticketed approvals, and periodic reviews are losing relevance where access is ephemeral and continuously changing.
Editorial analysis by NHI Mgmt Group, based on content published by Opal Security: “When Identity Gets Acquired, Authorization Gets Real”.
Practitioner guidance
- Map authorization decisions to runtime context Review where access is still granted through static roles, ticket approvals, or durable sessions and identify the systems that need context-aware decisions at execution time.
- Inventory machine identities separately from human accounts Create a distinct inventory for service accounts, containers, API-driven workflows, and agents so ownership, purpose, and access scope are visible outside the human IAM model.
- Reduce standing privilege in privileged workflows Replace persistent administrative access with just-in-time elevation and short-lived permissions for tasks that do not require continuous privilege.
Bottom line: Authorization has become the main identity control problem because modern access is dynamic, contextual, and increasingly machine-driven.
What's in the full analysis
Opal Security's full analysis covers the operational detail this post intentionally leaves for the source:
- How the vendor frames runtime authorization across humans, machines, and AI agents
- The specific cases it cites to illustrate identity drift, standing privilege, and authorization gaps
- Details on its policy-as-code, xBAC, and just-in-time access model
- The acquisition and platformization arguments behind the broader market interpretation
👉 Read Opal Security’s analysis of the Palo Alto Networks and CyberArk deal →
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 4 days ago by NHI Mgmt Group
25/06/2026 6:04 am
Authorization, not authentication, is now the governance battleground. Login controls have matured faster than the controls that decide what an identity can do after access is granted. That gap matters because modern environments distribute privilege across humans, workloads, and agents, each with different timing and context requirements. Practitioners should treat authorization as the primary control plane for identity security, not a downstream policy layer.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
👉 Read our full editorial: Palo Alto's CyberArk deal makes authorization the identity battleground
This post was modified 4 days ago by NHI Mgmt Group