A New Hope for Identity—or Vendor Lock-In?

Hey {{first_name | Jedi}} , welcome to the 109th Edition ofIdentity Jedi Newsletter. We’re barreling through the dog days of summer, and the identity world refuses to take a vacation. This week’s galactic hot topic: Palo Alto Networks’ bid to absorb CyberArk. Grab your lightsabers – it’s going to get spicy.

I view this acquisition as both inevitable and risky. Identity is the new front line, and CyberArk’s PAM/IGA strengths complement Palo Alto’s network and cloud dominance. Integrating these layers could provide unified visibility into human and machine identities, session behavior and network telemetry – a critical capability as generative AI fuels novel attacks (deepfake phishers, prompt injections, autonomous malware).

However, massive consolidation carries the danger of vendor lock‑in and an innovation lull. Identity should remain standards‑based and interoperable; monoculture is a breeding ground for systemic risk. If the combined entity embraces open APIs and fosters healthy competition, the Force will remain balanced. Otherwise, we may be trading diversity for convenience.

The acquisition isn’t expected to close until the second half of Palo Alto’s fiscal year 2026 , so there’s still time for regulators and customers to weigh in. Stay tuned – the galaxy watches with bated breath.

Having said that, I think this is just the beginning. The fuse has been lit, and second wave of the Consolidation Era has started. Crowsdtrike, Zscaler, Fortinet,etc. The shot has been fired and now I think the talks will heat up around other identity players as the “traditional security” vendors look to include identity as apart of their GTM. Maybe an Austin based company that just recently came back to market, or a well known authentication company that’s broadened their lineup by acquiring an IGA company, or even an innovative identity company out of LA.

Interesting times ahead folks..

The Force is strong with identity. As AI evolves from buzzword to business enabler, identity becomes the control plane. The Palo Alto–CyberArk deal underscores that identity security is no longer optional or siloed; it’s part of an integrated defense strategy. But consolidation can cut both ways: it promises simplicity yet risks stifling innovation and creating monoculture. History really does repeat itself. We are heading right back to the days of old, where companies built huge consolidated stacks to give users a “Single Pane of Glass” to manage things. I can’t say that I’m completely surprised at this move, I saw it coming. Flashback to 2021, I’m in Portland, Oregon in a small room on a whiteboard drawing out the landscape of identity and security to a potential investor. I explained that ITDR was just the tipping point, and it would be a tissue paper market, but what it signaled was that the market wanted identity to be more like security, and that the big “security” players of the world ( Crowdstrike, Palo, Z-Scaler, etc) would have to get more identity smart and eventually they would move into the traditional IAM market. Welp..here we are. Till next time folks.