Palo Alto CyberArk deal: what it means for IAM teams

TL;DR: Palo Alto Networks’ $25 billion acquisition of CyberArk confirms that stolen credentials remain the most common initial attack vector, accounting for 22% of breaches and 88% of web application breaches in Verizon’s 2025 DBIR. Identity controls, not perimeter tools alone, are now the main battleground for enterprise security.

NHIMG editorial — based on content published by Bravura Security: the Palo Alto CyberArk deal and its implications for identity security

By the numbers:

• Stolen credentials remain the single most common initial attack vector, used in 22% of breaches in Verizon’s 2025 DBIR.
• 88% of web application breaches involved the use of stolen credentials, making credential abuse the dominant tactic against internet-facing apps.

Questions worth separating out

Q: How should security teams respond when identity platforms become more consolidated?

A: Treat consolidation as a governance test, not a procurement win.

Q: Why do stolen credentials remain such an effective attack path?

A: Because many environments still trust a valid login too much.

Q: What breaks when PAM is treated as separate from IAM?

A: Governance breaks first.

Practitioner guidance

• Map identity controls to one governance model Inventory where IAM, PAM, and NHI controls are split across different teams, consoles, or policy engines.
• Harden post-authentication trust decisions Add step-up checks, token reuse detection, and session-level monitoring so a valid login does not automatically equal trusted access.
• Review privileged access as part of the main identity programme Tie administrative entitlements, approval workflows, and session evidence back to the central identity inventory so reviewers see the same context used for routine access.

What's in the full analysis

Bravura Security’s full article covers the operational detail this post intentionally leaves for the source:

• Vendor-specific discussion of the Palo Alto CyberArk deal and how Bravura Security interprets the market shift
• Examples of how the combined platform story is framed for buyers weighing identity consolidation
• A longer Bravura Security product narrative around its identity security fabric positioning
• The article’s closing promotional framing and call to action for readers evaluating identity strategy

👉 Read Bravura Security’s analysis of the Palo Alto CyberArk deal and identity convergence →

Palo Alto CyberArk deal: what it means for IAM teams?

Explore further

View Full Forum →  |  NHI Foundation Course →