CyberArk Buys Venafi for $1.54B for Enhanced Security

In the most recent development, CyberArk, one of an army of more giant Israeli-based security corporations, pays $1.54 billion to acquire machine identity specialist Venafi

In addition to approximately $540 million in shares, CyberArk will pay $1 billion in cash. The deal has been approved by the shareholders of both companies and is anticipated to conclude in the second half of 2024, according to the companies.

Thoma Bravo owns most of Venafi, valued at $1.15 billion in 2020, when the private equity firm acquired the predominant interest. But, the current selling price of Venafi signifies a moderate escalation compared to 2020. 

The news validates speculations that a transaction had been circulating between the two organizations for the past few days. 

At a time when security teams are attempting to gain a more comprehensive comprehension of the threat landscape and attack surface of their organizations, CyberArk’s interest in Venafi is timely. Solving that riddle in the current market is exceedingly complex due to the proliferation of mobile technology, cloud services, and distributed working. 

Fundamentally, these factors have contributed to a proliferation of computing terminals, encompassing not only the myriad devices individuals employ to establish network connections but also any other device situated within the network that processes or stores data. As a general rule, on an enterprise network, there are forty “machines” for every human.

This has resulted in a tremendous increase in revenue for organizations specializing in identity security. Additionally, several firms in the industry have successfully secured substantial funding, including Oasis Security and Silverfort.

Venafi’s technology analyzes and secures the data flow between these devices. 

As an authority on PKI and certificate administration, the startup specializes in these fields. CyberArk estimates that the acquisition will increase its total addressable market by $10 billion (bringing it to $60 billion). 

“This acquisition enables us to further our vision to secure every identity – human and machine – with the appropriate level of privilege controls,” said Matt Cohen, CEO of CyberArk, in a statement. “This acquisition represents a pivotal moment for CyberArk.” “By joining forces with Venafi, we are enhancing our capacity to ensure the security of machine identities in a post-quantum, cloud-centric, GenAI environment.

By leveraging human and machine identities as part of the attack chain, our integrated technologies, capabilities, and expertise will enable Chief Information Security Officers to defend against increasingly sophisticated threats that target global enterprises.

Furthermore, the acquisition highlights recurring patterns observed in cybersecurity companies concerning consolidation. Specific companies that secured funding at elevated valuations several years ago are currently experiencing pressure on those valuations as they, in different ways, fail to generate recurring revenue or achieve profitability and are near the anticipated conclusion of their operational lifespans.

These businesses seek an exit, occasionally occurring at a price substantially below their most recent valuations. Akamai, for instance, acquired Noname Security in recent weeks for $450 million, which is less than half of its previous valuation; Wiz, which was last valued at $8.3 billion, attempted to acquire Lacework for just over $150 million in recent weeks, returning to investors approximately $800 million in cash; however, that deal failed.

Conversely, a limited number of cybersecurity enterprises are presently experiencing substantial expansion and are being identified as consolidators. A couple of weeks ago, Wiz raised $1 billion to fund an acquisition binge; CyberArk, with a market capitalization of over $10 billion, is undoubtedly another company in this category. 

The trend of consolidation is evident even among entities undergoing acquisitions. Venafi acquired Jetstack in May 2020 to incorporate its domain expertise in Kubernetes. The day before that, CyberArk acquired Adaptive.