Consolidation in the cybersecurity industry continues as major players acquire startups to better handle the growing challenge of securing enterprises that are increasingly operating in the cloud. In a recent development, CyberArk, a prominent Israeli-founded security company, is acquiring Venafi, a specialist in machine identity, for $1.54 billion.
CyberArk will pay $1 billion in cash and roughly $540 million in stock. Shareholders from both companies have approved the transaction, which is anticipated to close in the latter half of 2024, according to the companies.
Venafi is majority-owned by Thoma Bravo and was valued at $1.15 billion when the private equity firm acquired a controlling stake in 2020. Thus, Venafi’s current selling price represents a moderate increase since that valuation.
The news confirms rumors of a deal between the two companies that had been circulating in recent days.
CyberArk’s interest in Venafi is timely as security teams aim for a more comprehensive understanding of their organization’s threat landscape and attack surface. Currently, this is a particularly complex issue due to the proliferation of mobile technology, cloud services, and distributed working.
These factors have collectively led to an explosion in computing endpoints. This includes not only the numerous devices individuals might use to connect to a network, but also any other devices on the network where data is processed or stored. Typically, there are 40 “machines” for every human on an enterprise network. This surge has significantly boosted business for companies specializing in identity security, with startups like Oasis Security and Silverfort garnering substantial investments.
Venafi’s technology is focused on securing and understanding the data flow between these machines.
The startup is known for its expertise in PKI and certificate management. CyberArk expects this acquisition to expand its total addressable market by $10 billion, bringing the total to $60 billion.
“This acquisition marks a pivotal milestone for CyberArk, enabling us to further our vision to secure every identity – human and machine – with the right level of privilege controls,” stated Matt Cohen, CEO of CyberArk. “By combining forces with Venafi, we are expanding our capabilities to secure machine identities in a cloud-first, GenAI, post-quantum world. Our integrated technologies, capabilities, and expertise will empower Chief Information Security Officers to combat increasingly sophisticated attacks that leverage human and machine identities as part of the attack chain.”
The acquisition highlights ongoing consolidation trends within the cybersecurity industry.
Companies that raised funds several years ago at high valuations are now under pressure as they struggle to grow ARR or attain profitability. They are approaching the end of their financial runways and are seeking exits, often at prices significantly below their last valuation. Recent examples include Akamai purchasing Noname Security for $450 million, less than half its last valuation, and Wiz’s unsuccessful attempt to buy Lacework, last valued at $8.3 billion, for just over $150 million, returning around $800 million in cash to investors.
Conversely, a select group of cybersecurity firms are experiencing substantial growth and are emerging as industry consolidators. Wiz raised $1 billion recently to facilitate an acquisition spree, and CyberArk, with a market cap exceeding $10 billion, is another key player in this category.
Even the companies being acquired are part of this consolidation trend. In May 2020, Venafi acquired Jetstack to enhance its Kubernetes expertise. Around the same time, CyberArk acquired Idaptive.
