Topic starter
22/06/2026 1:43 pm
TL;DR: Palo Alto Networks’ planned acquisition of CyberArk, valued at about $25 billion, signals that identity security, privileged access, and lifecycle governance have become core enterprise controls, especially as AI and cloud access expand, according to SPHERE Technology Solutions. The deal makes identity hygiene and privileged access discipline board-level issues rather than back-office tasks.
Editorial analysis by NHI Mgmt Group, based on content published by SPHERE: “Why Palo Alto Networks’ Planned Acquisition of CyberArk Validates the Need for Identity Hygiene”.
Key questions
Q: What breaks when privileged access is not part of identity governance?
A: Governance breaks at the highest-risk tier because privileged accounts can create, hide, or amplify access problems that normal reviews do not surface.
Q: Why do stale identities increase risk even when PAM is deployed?
A: Because PAM assumes the accounts it governs are current, owned, and correctly scoped.
Q: How should teams prioritise identity hygiene versus new access controls?
A: Identity hygiene should come first when current inventories are incomplete or trust in entitlement data is low.
Practitioner guidance
- Audit shadow accounts and orphaned identities Identify accounts, tokens, and privileged entitlements that no longer map cleanly to an owner, workload, or lifecycle event, then route them into remediation before they can be used as persistent access paths.
- Bind PAM to lifecycle events Require joiner, mover, and leaver signals to update privileged access state so access cannot outlive the identity’s current role, workload, or business purpose.
- Validate identity data before enforcing JIT Check that source attributes, group membership, and entitlement records are accurate before relying on just-in-time access to limit privilege exposure.
Bottom line: Identity security now sits at the centre of enterprise defence, and the article treats privileged access and lifecycle governance as core controls rather than secondary administration.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
22/06/2026 1:48 pm
Identity hygiene is now a control dependency, not a housekeeping task. Legacy IAM and PAM only produce reliable outcomes when the underlying identity data is current and complete. Shadow accounts, stale privileges, and orphaned access paths undermine the enforcement layer before a policy is ever applied. The implication is that governance teams must treat identity quality as part of control design, not post-hoc cleanup.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: What is the difference between PAM and identity hygiene?
A: PAM governs privileged access decisions and enforcement. Identity hygiene ensures the identities, entitlements, and ownership data feeding those decisions are accurate, which is why the two controls are complementary but not interchangeable.
👉 Read our full editorial: Palo Alto’s CyberArk deal shows identity security is now core