Why Palo Alto’s mega-deal isn’t cheering investors
Despite CyberArk’s strategic fit, fears grow over valuation, execution, and future innovation bottlenecks.
After a week of celebrations in the global cyber industry following the sale of CyberArk to Palo Alto for $25 billion, the hangover phase arrives, and with it, the questions. The collapse of Palo Alto's stock by 17% since the deal was announced shows that investors, as well as the industry, have quite a few doubts about the surprising move by the world's largest cyber company. The fall, incidentally, endangers Palo Alto’s position, founded by Israeli Nir Zuk, as the gap between its market value and that of CrowdStrike, which is breathing down its neck, shrank to only $4 billion on Friday. When the value is $115 billion versus $111 billion, that gap could easily be erased within days. The drop in Palo Alto's stock, which also affects CyberArk’s value, since 90% of the deal was made in shares, is also steep relative to the dilution that investors expected. Why are they not calm?
2 View gallery
Palo Alto is acquiring CyberArk.
(Photo: David Paul Morris/Bloomberg, ShU studio/Shutterstock)
1. How far can the platformization strategy go?
In the midst of the celebrations, experts in the global cyber industry, many of whom, not coincidentally, are concentrated in Israel, began to doubt Palo Alto's ability to keep pushing in the direction of platformization. The strategy, announced by Nikesh Arora, CEO of Palo Alto, in January 2024, shook the entire cyber market, but even then, it was perceived as a pressure move. Palo Alto revealed that each organization uses an average of about 70 different cyber solutions that don’t integrate and are not always in use, and began giving away products for free just to unify them all on its own platform. This move did accelerate growth, but recently, more and more voices have begun opposing Palo Alto’s approach, saying the "obsession with platformization" has gotten out of control and is harming organizations.
"It is not healthy to concentrate all the solutions with one supplier because it makes the organization vulnerable," said Nadav Zafrir, CEO of Check Point and former commander of the 8200 Intelligence Unit, when the deal was first announced. Although Zafrir speaks from a position of competition, he justified his comments: "The platform creates a situation where the customer only receives products from the same development department and the same intelligence department. That’s what’s called a 'closed garden.' You have to put your ego aside and allow customers to connect products from other companies to the platform if they are the best best of breed."
Shlomo Kramer, one of the founders of Check Point who left the company long ago, founded and sold Imperva for $2 billion and currently heads Cato Networks, valued at almost $5 billion in its latest round, was less diplomatic.
"Platformization? More like IBMization. With its acquisition of CyberArk, Palo Alto Networks is looking more like old Big Blue every day. No pureplay cybersecurity vendor has ever done multi-platform successfully. Even Microsoft is unable to consolidate, particularly in the network security market," Kramer said, referring to the fact that Palo Alto will now attempt to connect its platform, which includes cloud security products that compete with Wiz, firewall and perimeter products that compete with Check Point and SentinelOne, SASE solutions that compete with Kramer's Cato, and crisis response tools, to CyberArk’s identity management platform, a separate suite of products designed to control access to enterprise systems.
2. Can Palo Alto handle an acquisition of this magnitude?
On one hand, CyberArk and its products are the last missing piece in the Palo Alto platform puzzle. On the other, this is an unprecedented deal that takes Palo Alto into uncharted territory.
"Even when I sleep, I think about the next acquisition. If I could buy hundreds of companies instead of 20, I would do it," Arora said Wednesday evening in a conversation with the Israeli media.
Arora, who joined Palo Alto as a hired CEO after a distinguished career at SoftBank and Google, led an aggressive string of acquisitions that built the current platform. However, all of those deals were below $1 billion and involved private companies.
Now, Palo Alto is paying a high multiple relative to the cybersecurity sector for CyberArk, which is at its peak. To enter the same market, it could have acquired Okta, CyberArk’s competitor with higher revenue and a lower valuation. Other rivals, like U.S.-based Ping and SailPoint, are also cheaper. But Palo Alto opted, as usual, for the most expensive product, only this time it’s a public company with strong revenues and not a startup with little income.
Shareholders will now expect a swift return on the investment, measurable by familiar financial metrics. Yet the fact that CyberArk's shareholders, despite strong 2024 results and a bullish forecast of 30% growth in 2025, chose to sell now raises the next question:
3. Does CyberArk have the technology to compete, or is this just fear of the future?
CyberArk has built a strong position managing human identities and, through its acquisition of Venafi, entered the growing market of machine identities. But that doesn’t automatically prepare it for the next frontier: managing AI agent identities.
Arora said Wednesday, "I am not panicking about the competition, but I am panicking about what AI is doing to cyber", and he’s right. There’s no market-ready solution today for the exploding category of AI identity management. As evidence, the Israeli startup Noma just raised $100 million, less than three years after it was founded, to build a solution for managing AI agent identities.
Palo Alto’s rationale is that organizations won’t replace identity management systems, because unlike other categories, these systems are deeply embedded across IT infrastructure. To manage them, vendors must earn immense trust.
By acquiring CyberArk, Palo Alto is betting that the combined development teams, mostly based in Israel, can build the missing AI identity layer and sell it to the combined customer base.
4. If CyberArk is confident in its solution, why sell now at the peak?
The obvious answer: its shareholders believe CyberArk has reached its peak and may struggle to compete in the next wave of AI-centric cybersecurity.
Another explanation, purely financial, is the nature of public companies without controlling shareholders. CyberArk’s founders no longer hold significant stakes, and decisions are driven by institutional investors like BlackRock, Fidelity, and Vanguard, entities with no sentiment, just performance mandates.
For them, a $25 billion offer from Palo Alto, based on a high revenue multiple, checks all the boxes.
Insiders say CyberArk chairman and co-founder Udi Mokady did not want to sell, but lacked the power to stop it. Ironically, just two days after the deal, U.S. company Figma went public and became a Wall Street sensation. Its stock jumped 250% post-IPO and closed Friday at a $45 billion valuation.
Why does that matter? In 2022, Figma agreed to sell to Adobe for $20 billion, what was then seen as one of the biggest tech exits ever. But antitrust opposition torpedoed the deal. Sometimes, an exit that seems like a win can, in hindsight, be a miss.
5. Are Check Point, Cato, and others next in line for acquisition?
If Palo Alto’s rivals adopt the same logic, and if the market continues to favor platforms, the game of musical chairs is just beginning.
In the short term, this could make companies like Cato, which has a strong platform for secure remote access, targets for acquisition, despite public claims of IPO ambitions.
Even Check Point could become an attractive target. It trades at a valuation similar to CyberArk, but has double the revenue and $3 billion in cash.
Potential acquirers could include CrowdStrike, Fortinet, Cloudflare, or even tech giants like Microsoft and Google, all eager to own a complete platform.
At some point, however, enterprise customers may start asking whether the race toward platformization comes at the cost of innovation.
For Israel, every scenario looks good. In a year of crisis across nearly every sector, 2025 has brought enormous attention to its cybersecurity industry, first with Wiz’s $32 billion sale, now with CyberArk.
For those who hadn’t noticed the Israeli cyber ecosystem before, it’s now impossible to ignore it.
But beyond cyber, the larger story is AI. Israel may not have produced a foundational model, but its role in reshaping security infrastructure in the age of AI is becoming central. From CyberArk’s exit to Noma’s funding, and more deals maturing soon, Israel’s technological leadership in this emerging domain is increasingly clear.
