CyberArk
CyberArk is a publicly-traded identity security vendor (NASDAQ: CYBR until 2026 acquisition) historically anchored on Privileged Access Management (PAM). The company has expanded its Identity Security Platform across human PAM, secrets management (Conjur), workload identity, and — beginning in 2025 — non-human-identity governance for AI agents under the Secure AI Agents initiative.
Core product lines
| Line | Role |
|---|---|
| Privileged Access Manager | Human PAM — session recording, vaulting, just-in-time elevation |
| Conjur (Secrets Manager) | Vault and policy engine for secrets used by non-human identities; foundation for credential proxying for AI agents |
| Secure AI Agents | Initiative spanning Conjur + new agent-specific tooling (AI Agent Gateway, MCP-aware enforcement, zero-standing-privileges) |
| Agent Guard | Product for STDIO-based MCP server flows (AWS Marketplace, 2025) |
| Identity Security Platform | Umbrella platform unifying human + non-human identity security |
Palo Alto Networks acquisition (2026)
Palo Alto Networks announced acquisition of CyberArk for approximately $25B (closed/announced 2026). The strategic implication is convergence of CyberArk’s identity-side stack (PAM, Conjur, NHI governance) with Palo Alto’s runtime/network/AI-security stack (Prisma AIRS, Prisma Cloud, Prisma SASE, Cortex). This positions Palo Alto with one of the most complete commercial AI agent security portfolios in the market, spanning identity → policy → runtime → network → posture → red-team.
Position in the agent security market
CyberArk is the incumbent vault layer in the credential-proxy / NHI ecosystem. Newer NHI-governance vendors (Oasis Security, Aembit, Astrix Security, GitGuardian) typically position above the vault layer rather than as substitutes. The industry framing: Conjur is a vault; the others are governance/access layers.
Wiki references
- Agent Guard) — primary product page
- RA Identity plane (Non-Human Identity governance, Credential proxy)
- NHI Governance for AI Agents practice page
- Credential Proxy Pattern — Conjur is the canonical commercial implementation
Gap
Detailed product roadmap post-Palo Alto acquisition has not been publicly disclosed. Track for: integration of Conjur with Prisma AIRS identity surface, unification of the AI Agent Gateway with AgentGateway / Prisma AIRS runtime, and any deprecation of overlapping Palo Alto identity offerings.