Analyst(s): Krista Case
Publication Date: April 22, 2025

What is Covered in this Article:

• CyberArk has been evolving from a PAM-centric vendor into a full-spectrum identity security platform. In response to rising identity-based cyber threats, it aims to address the increasing volume and complexity of human, machine, and AI identities.
• The company announced key product updates, including integrating Zilla’s modern Identity Governance and Administration (IGA) capabilities, new offerings for secure workload access, and lifecycle controls for AI agents. These updates underlined the company’s goal of managing all identity types with contextual privilege control.
• CyberArk’s acquisition of Venafi aims to add certificate-based trust to machine identity management, complementing secrets management and positioning it strongly against niche certificate and workload identity startups.
• Identity integration and threat detection across IAM, PAM, IGA, and SIEM ecosystems were highlighted as critical needs. This would enable adaptive, risk-aware policies and automated access governance while enhancing SecOps collaboration to detect and respond to identity-based threats across dynamic attack surfaces.
• Competitors in traditional IAM and emerging identity niches are likely to face pressure, as CyberArk proposes unifying privilege, lifecycle, and trust across human and machine identities, with automation and behavior-based controls as foundational elements.

The News: On April 9-11, 2025, CyberArk hosted more than 1,700 security professionals at Boston’s Seaport for IMPACT, its annual customer and partner event.

At the event, key executives, including CEO Matt Cohen, outlined the critical need for a comprehensive platform addressing human, machine, and AI identity security requirements to address the rise in sophistication, velocity, and sheer volume of identity-based cyberattacks. More specifically, CyberArk stated that it is aligning its R&D investment, acquisition strategy, and market positioning around three core pillars: the proliferation of human privileges beyond traditional IT roles, the exponential growth of machine identities, and AI accelerating attack velocity and identity sprawl. From this standpoint, it demonstrates that it is steadily evolving from its roots in Privileged Access Management (PAM) into providing a broader identity security platform.

In accordance with this strategy, key announcements from CyberArk IMPACT 2025 included:

• Integration and universal availability of CyberArk’s acquired Zilla capabilities for modern IGA.
• Availability of the CyberArk Secure Workload Access offering, for visibility into and control over the lifecycle of non-human identities. This includes the ability to discover workloads and obtain contextual understanding of their identity risk and integration with CyberArk Secrets Manager.
• Introduction of the CyberArk Secure AI Agents offering, for privileged access and lifecycle management for AI agents, across the environment.

CyberArk Impact 2025 Articulates a Possible Future of Identity-Driven Security

Analyst Take: During his mainstage keynote, CyberArk CEO Matt Cohen outlined the clear and pressing reality that identity remains the common denominator across most successful breaches, whether it is through lateral movement within networks or vertical privilege escalation. Validating this perspective, one in five respondents in Futurum’s Cybersecurity Decision Maker IQ research indicated credential compromise/account takeover as a security incident most impacting their organization.

Identity security has become a critical lever to cyber-resilience. This trend has a few key implications for cybersecurity technology vendors:

• Authentication, access control, and privilege management are central to threat prevention. In other words, identity has never been more paramount to cybersecurity.
• With this in mind, identity protection must span humans, machines, and the emerging roster of agentic AI identities. This is not an easy feat, as machines proliferate and agentic AI applications blend qualities of human and machine identities. CyberArk estimates that for every human identity, there are more than 80 machine identities in an average enterprise environment, with theoretically infinite growth potential.
• Integration across IAM, PAM, IGA, and SIEM ecosystems has become necessary to mitigate identity-related blind spots that could misuse credentials, privileges, and over-provisioned access. For example, such integration supports identity threat detection and response by correlating insights to drive more adaptive security policies (e.g., revoking access based on risk signals).
• The speed of deployment of new technologies and the ability to automate functions will become more important in the quest to react more quickly to evolving threat tactics.
• Finally, and far but least importantly, identity protection must become more proactive. For example, it must incorporate capabilities to uncover anomalous behavior and continuously assess the identity security posture.

CyberArk’s two and a half decades of experience in the PAM market provide it with a possible competitive advantage, as shoring up privileged accounts is simultaneously a growing priority and challenge. In The Futurum Group’s Cybersecurity Decision Maker IQ research, the need to heighten security for privileged accounts was most frequently cited as a Rank One top initiative, reflecting that privileged accounts, including the exponentially growing number of machine/non-human identities that often have privileged access, are being targeted due to their elevated access to critical systems and data.

As demonstrated on the main stage at IMPACT 2025 and in analyst-specific sessions, the machine identity space is a prime example of CyberArk’s evolution into a full-stack identity security provider. CyberArk has provided access for machine identities through secrets, key, and credential management, but this approach did not allow machines to be authenticated or established as trustworthy. The October 2024 acquisition of Venafi for approximately $1.54 billion added the ability to establish trust via capabilities for issuing, rotating, and revoking digital certificates. At the same time, CyberArk’s February 2025 acquisition of Zilla, in a deal worth up to $175 million, added the ability to audit and manage the lifecycle of the machine identities. The convergence of these capabilities is synergistic regarding securing and machine identities, and as a result, modern container- and microservices-based environments, at scale. This move elevates machine identities from an edge case to treating them with similar levels of control and governance as human identities.

Along a similar vein, and strategically from the standpoint of addressing where the market is heading, CyberArk aims to address the steady rise of AI agents, which are complicated to secure from an identity perspective, because they blend qualities of human and machine identities. For example, AI agents often act on behalf of users, increasingly making new decisions and accessing resources like a human would, while at the same time performing backend automation like a bot, making it difficult to assign traditional roles or static entitlements. At the same time, they do not have a defined start or end date, and they might be cloned or re-trained, making it difficult to oversee their lifecycle. This necessitates a contextual, adaptive approach to privilege control based on behavior and trust signals, as opposed to strictly role or identity type, as CyberArk indicated that it is building with its Secure AI Agents offering.

CyberArk’s proposed ability to facilitate risk-driven, adaptive access, revoking or elevating controls based on contextual signals, is supported by the ability to pull in signals from SIEM and EDR platforms, reflecting the increasing precedence that identity tools can participate in an interoperable ecosystem. Equally important is CyberArk’s stated focus on facilitating automation at scale, for example, allowing for policy-based onboarding and lifecycle management of identities, including machines and DevOps workloads. This furthermore helps to reduce time to value and human error.

CyberArk’s emphasis on integrating PAM and IGA capabilities to provide the spectrum of just-in-time access, dynamic session controls, threat detection, and lifecycle governance capabilities will pressure competing standalone PAM and IAM providers such as BeyondTrust, Delinea, One Identity, SailPoint, and Saviynt, as well as comparatively more narrow identity players like Okta and ForgeRock. Competitive moves, including deeper authentication integration with privilege enforcement, tapping real-time telemetry, and embracing automation to avoid heavy manual configurations and operations, are likely. Finally, CyberArk will likely nudge the market toward treating machine and AI identities with similar governance and control as their human counterparts. This will pressure certificate management and workload identity startups like Akeyless, Keyfactor, Smallstep, and IAM vendors that focus mostly on users.

What to Watch:

Market response to CyberArk’s machine identity strategy: As CyberArk integrates certificate lifecycle, secrets management, and IGA into one platform, expect increased competition—and potential consolidation—among workload identity and certificate management startups.

Customer adoption of Secure AI Agent capabilities: Watch how enterprises operationalize identity lifecycle controls for AI agents, and whether CyberArk’s contextual, adaptive model sets a precedent for identity governance in this emerging domain.

Ecosystem integration depth: CyberArk’s ability to deliver on tight integrations across SIEM, EDR, IAM, and cloud platforms will be a key indicator of its traction in supporting real-time, risk-based access controls at scale.

Vendor consolidation or partnerships: As identity sprawl intensifies, traditional IAM and PAM vendors may be pressured to expand capabilities—through acquisitions or tighter alliances—to keep pace with CyberArk’s and other larger identity management vendors’ platform approach.

Execution on automation and time-to-value: Whether CyberArk can continue reducing complexity for customers—especially in onboarding and lifecycle management of non-human identities—will be critical for differentiation in a crowded identity security market.

Visit CyberArk’s newsroom for additional details about the Impact event and the company’s subsequent announcements.

Disclosure: The Futurum Group is a research and advisory firm that engages or has engaged in research, analysis, and advisory services with many technology companies, including those mentioned in this article. The author does not hold any equity positions with any company mentioned in this article.

Analysis and opinions expressed herein are specific to the analyst individually and data and other information that might have been provided for validation, not those of The Futurum Group as a whole.

Other insights from The Futurum Group:

Is SailPoint’s IPO a Sign of Renewed Tech Optimism or Market Caution?

How Will Cybersecurity Reach $288B by 2029? Futurum Unveils New Insights

Is Microsoft’s AI-Powered Security Copilot Changing the Future of SecOps?

Image Credit: CyberArk

Author Information

Krista Case

With a focus on data security, protection, and management, Krista has a particular focus on how these strategies play out in multi-cloud environments. She brings approximately 15 years of experience providing research and advisory services and creating thought leadership content. Her vantage point spans technology and vendor portfolio developments; customer buying behavior trends; and vendor ecosystems, go-to-market positioning, and business models. Her work has appeared in major publications including eWeek, TechTarget and The Register.

Prior to joining The Futurum Group, Krista led the data protection practice for Evaluator Group and the data center practice of analyst firm Technology Business Research. She also created articles, product analyses, and blogs on all things storage and data protection and management for analyst firm Storage Switzerland and led market intelligence initiatives for media company TechTarget.