Palo Alto Networks completes its CyberArk acquisition

What happened?

Palo Alto Networks announced that it had completed its acquisition of CyberArk on 11 February 2026. The company's press release frames the deal around securing the AI era. CyberArk had long been known for privileged access management, and its documentation already described a secure AI architecture for agents.

Why does it matter for agent governance?

Privileged access and agent governance overlap in one important place: credentials. Agents need secrets to reach tools, and those secrets are often powerful. A vendor that already manages privileged credentials has a natural route into managing agent credentials.

The acquisition also signalled that large security platforms see agent identity as part of their core product, not a side feature. That pattern repeated through 2026, with Cisco buying Astrix Security, SailPoint buying Entro and Cyera buying Oasis Security.

What came next?

On 12 May 2026 Palo Alto Networks introduced Idira, which it calls a next-generation identity platform. The register scores Idira at 5.50 out of 10, in tenth place. Its strongest area is lifecycle, at eight. CyberArk documentation describes credential creation, rotation and renewal under zero standing privilege. An Identity Broker sits as a proxy between the agent and its tools, and obtains MCP tokens for agents while managing their rotation.

Its weaker areas reflect what we could not find in public material. Owner mapping was not found. Human approval was not found. The policy is described as AI-powered, but its semantics are not published. Idira is sold as add-on licences, with no price published.

What should buyers do?

If your organisation already runs CyberArk or Palo Alto Networks products, Idira is worth a look for credential lifecycle. Ask for a demonstration of the gaps the register records: owner mapping, human approval for high-risk actions and the policy language.

If you are choosing a governance layer from scratch, compare Idira's control coverage with the other nine platforms. The register shows each control as documented, partly documented or not found, with sources.

How does this note affect the register?

This note does not change any score. It records context for the Idira entry and the change log. Idira's scores rest on the Palo Alto Networks launch release and the CyberArk documentation, both read on 3 November 2026.

Consolidation also raises a buying question. Products bought by larger companies often change packaging. When that happens, buying clarity scores can move. We will recheck Idira's licensing at the next monthly review.