Topic starter
25/06/2026 12:23 am
TL;DR: Demand driven by human, machine, and agentic AI identity risk helped CyberArk report third-quarter 2025 net new ARR of $68 million, total ARR of $1.341 billion, and subscription ARR of $1.158 billion, according to CyberArk, while the numbers reinforce that identity security is moving from point controls to platform governance across the full identity lifecycle.
Editorial analysis by NHI Mgmt Group, based on content published by CyberArk: “CyberArk Announces Strong Third Quarter 2025 Results”.
By the numbers:
- Total ARR grew 45 percent year over year to reach $1.341 billion.
- Subscription ARR grew 57 percent year over year to reach $1.158 billion.
- CyberArk reported $342.8 million in total revenue for the third quarter of 2025.
Key questions
Q: What do organisations get wrong when they treat human, machine, and AI identities the same?
A: They apply one policy model to identities with very different lifecycles, behaviours, and evidence requirements.
Q: Why do machine identities complicate identity governance more than human accounts?
A: Machine identities act continuously, at scale, and with delegated authority, so they cannot rely on manual review cycles or human pauses.
Q: What signals show that identity controls are not keeping up with agentic AI?
A: Look for tool calls that are hard to attribute, access that expands across multiple services in one session, and approvals that do not explain the eventual action chain.
Practitioner guidance
- Map governance across all identity classes Inventory where human, machine, and agentic identities are governed today, then identify where access decisions, approvals, reviews, and revocation still sit in separate systems.
- Define ownership for machine identities Assign accountable owners to service accounts, tokens, certificates, and workload identities so that lifecycle actions are not left to platform teams by default.
- Test whether agentic systems can be constrained Review whether any AI-driven workflow can select tools or act on its own privilege without a bounded task definition, logging, and revocation path.
Bottom line: The article shows that identity security is moving beyond isolated controls and toward lifecycle governance across human, machine, and agentic identities.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 9:17 am
Identity security is moving from point control to lifecycle governance. The results are less about one vendor’s quarterly execution than about how the market is redefining the problem. Human access, machine identities, and AI agents now sit inside the same governance conversation because privilege is increasingly distributed across the full identity lifecycle. Practitioners should expect buying decisions to favour platforms that can govern issuance, use, review, and retirement across identity classes.
A question worth separating out:
Q: What does platform consolidation in identity security mean for practitioners?
A: It means buyers should expect broader coverage demands, tighter integration questions, and stronger evidence that a platform can govern both access state and runtime behaviour. Consolidation usually shifts evaluation away from single-feature comparison toward operating model fit. Teams should validate whether their current stack can still support cross-domain identity governance end to end.
👉 Read our full editorial: CyberArk’s Q3 results show identity security shifting to AI-era governance
This post was modified 1 day ago by NHI Mgmt Group