Notifications
Clear all
Topic starter
25/06/2026 1:06 am
TL;DR: Palo Alto Networks’ $25 billion acquisition of CyberArk confirms that stolen credentials remain the most common initial attack vector, accounting for 22% of breaches and 88% of web application breaches in Verizon’s 2025 DBIR. Identity controls, not perimeter tools alone, are now the main battleground for enterprise security.
NHIMG editorial — based on content published by Bravura Security: the Palo Alto CyberArk deal and its implications for identity security
By the numbers:
- Stolen credentials remain the single most common initial attack vector, used in 22% of breaches in Verizon’s 2025 DBIR.
- 88% of web application breaches involved the use of stolen credentials, making credential abuse the dominant tactic against internet-facing apps.
Questions worth separating out
Q: How should security teams respond when identity platforms become more consolidated?
A: Treat consolidation as a governance test, not a procurement win.
Q: Why do stolen credentials remain such an effective attack path?
A: Because many environments still trust a valid login too much.
Q: What breaks when PAM is treated as separate from IAM?
A: Governance breaks first.
Practitioner guidance
- Map identity controls to one governance model Inventory where IAM, PAM, and NHI controls are split across different teams, consoles, or policy engines.
- Harden post-authentication trust decisions Add step-up checks, token reuse detection, and session-level monitoring so a valid login does not automatically equal trusted access.
- Review privileged access as part of the main identity programme Tie administrative entitlements, approval workflows, and session evidence back to the central identity inventory so reviewers see the same context used for routine access.
What's in the full analysis
Bravura Security’s full article covers the operational detail this post intentionally leaves for the source:
- Vendor-specific discussion of the Palo Alto CyberArk deal and how Bravura Security interprets the market shift
- Examples of how the combined platform story is framed for buyers weighing identity consolidation
- A longer Bravura Security product narrative around its identity security fabric positioning
- The article’s closing promotional framing and call to action for readers evaluating identity strategy
👉 Read Bravura Security’s analysis of the Palo Alto CyberArk deal and identity convergence →
Palo Alto CyberArk deal: what it means for IAM teams?
Explore further
25/06/2026 10:17 am
Identity convergence is becoming the default security architecture. The Palo Alto CyberArk deal reflects a broader market correction: identity, privilege, and control are no longer treated as isolated disciplines. Security teams are being pushed toward a single governance model that spans IAM, PAM, and machine identities because attackers already move across those boundaries. The practical conclusion is that fragmented control ownership now creates more risk than it removes.
A few things that frame the scale:
- 92% of organisations expose NHIs to third parties, raising concerns about supply chain security, according to Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them, which helps explain why stale access persists.
A question worth separating out:
Q: How do organisations know whether an identity fabric is actually working?
A: Look for shared policy enforcement, consistent entitlement context, and session evidence across users, admins, and machine identities. If teams still need to reconcile multiple consoles or manually stitch logs together, the fabric is a packaging layer, not operational integration.
👉 Read our full editorial: Palo Alto CyberArk deal reframes identity as the new perimeter
