Palo Alto Networks

Palo Alto Networks is executing the most ambitious consolidation play in security, and February 2026 marked its boldest stroke: the completed $25B acquisition of CyberArk — the largest deal in the industry's history — adds privileged access management as a third platform pillar alongside network security (Strata) and AI-driven security operations (Cortex), positioning Palo Alto to own the identity layer just as machine and AI-agent identities become the defining attack surface of the agentic era. The platformization strategy is working where it matters: Cortex XSIAM has become a credible next-generation SIEM, ingesting telemetry across endpoint, network, cloud, and identity and applying machine learning to collapse SIEM, SOAR, XDR, and attack-surface management into one data-driven platform — directly attacking Splunk's and the legacy SIEM incumbents' installed base as the autonomous SOC becomes the industry's north star. Prisma Cloud contests the CNAPP market, Prisma SASE the network-security-as-a-service market, and the 2025 Protect AI acquisition extends coverage into securing AI systems themselves. The strategic bet — that enterprises are exhausted by dozens of point vendors and will consolidate spend onto a few platforms — is precisely the trend reshaping security budgets, and Palo Alto, with the broadest portfolio, the largest go-to-market engine, and durable free cash flow, is the prime beneficiary. Owning network, cloud, SOC, and now identity from one vendor is a franchise with a decade of cross-sell ahead.

Palo Alto is betting the company on acquisition-fueled platformization, and $25B for CyberArk is an enormous check that must be justified by integration few large security roll-ups have executed cleanly. The deal — $45 in cash plus 2.2005 PANW shares per CyberArk share — is heavily stock-funded, diluting holders, and stacks a major identity integration on top of the still-in-progress absorption of prior acquisitions, at the exact moment Cortex XSIAM is fighting a two-front SIEM war against Microsoft Sentinel and CrowdStrike's expanding Falcon platform. Platformization's dirty secret is that it can mask decelerating organic growth: aggressive bundling and "free" module giveaways to win platform commitments compress near-term margins and pull revenue forward, and the market has grown skeptical of whether the strategy drives durable net-new demand or merely repackages existing spend. Palo Alto now competes with everyone — CrowdStrike in SOC and cloud, Zscaler and Netskope in SASE, Wiz (now Google) and Orca in CNAPP, Okta and SailPoint in identity — meaning any single platform can be out-innovated by a focused specialist while Palo Alto stretches across all of them. Integration risk, key-talent retention at CyberArk, and the sheer complexity of unifying identity with SOC "within 12 months" as promised are formidable. If XSIAM's SIEM momentum stalls or the CyberArk integration slips, a richly valued platform story unwinds quickly.