Topic starter
24/06/2026 11:08 pm
TL;DR: Sustained demand for privilege controls across human, machine, and agentic AI identities drove $99 million in record net new ARR, $1.440 billion in total ARR, and $1.267 billion in subscription ARR, while also flagging a planned combination with Palo Alto Networks, according to CyberArk. The numbers point to sustained demand for privilege controls across human, machine, and agentic AI identities, while consolidation raises the bar for governance clarity.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “CyberArk Announces Record Fourth Quarter and Full Year 2025 Results”.
By the numbers:
- Total ARR grew 23% year-over-year to reach $1.440 billion.
- The subscription portion of ARR grew 30% year-over-year to reach $1.267 billion.
- Fourth-quarter total revenue was $372.7 million, up 19% from $314.4 million a year earlier.
Key questions
Q: Why does ARR growth in identity security matter to IAM teams?
A: ARR growth usually shows that identity controls have moved from experimental use to operational dependency.
Q: Should organisations re-evaluate their identity security architecture after a major acquisition?
A: Yes. A major acquisition can change control boundaries, product roadmaps, and support assumptions. Organisations should verify that policy administration, audit trails, and lifecycle operations still work independently, especially where human IAM, PAM, and NHI functions were previously governed separately.
Q: What breaks when identity security tools are folded into a larger platform?
A: What breaks first is usually governance visibility.
Practitioner guidance
- Separate governance domains by actor type Document which controls apply to humans, service accounts, and AI-driven actors, then test whether your current operating model preserves that distinction in approvals, telemetry, and revocation.
- Reassess lifecycle ownership before platform consolidation Before accepting a broader platform narrative, define who owns secrets, privileged session oversight, and offboarding evidence after vendor consolidation or suite expansion.
- Validate subscription and renewal dependencies Review whether renewal value is driven by a narrow control need or by a broader governance dependency that could change if platform scope shifts.
Bottom line: Identity security demand is broadening across human, machine, and agentic AI identities, which changes how practitioners should scope governance.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 13 hours ago by NHI Mgmt Group
25/06/2026 7:52 am
Identity security is becoming a cross-actor governance category, not a single control domain. CyberArk's numbers show that buyers are no longer treating human IAM, machine identity, and agentic AI access as separate purchase motions. That matters because the operating problem is increasingly the same across actor types: governing privilege, scope, and revocation with consistent evidence. Practitioners should expect programme ownership to shift toward broader identity governance architecture.
A question worth separating out:
Q: How do security teams evaluate whether machine and agentic identities are governed separately?
A: Teams should check whether policy, telemetry, and offboarding differ by actor type. If service accounts and AI-driven actors are handled through the same generic entitlement process, the programme may be hiding material differences in risk, accountability, and runtime behaviour.
👉 Read our full editorial: CyberArk’s ARR growth signals identity security demand is broadening
This post was modified 13 hours ago by NHI Mgmt Group