Identity market acquisitions

Identity security spent the last three years consolidating, and the pace picked up sharply in 2026. If you are evaluating a vendor, the question "is this product going to exist in its current form in two years" now matters as much as any feature comparison.

Four patterns run through the deals below.

PAM is being absorbed into platforms. Palo Alto Networks buying CyberArk for roughly $25 billion is the largest deal identity security has seen, and it moved the category's anchor vendor inside a network-security platform. Delinea took StrongDM, and Ping Identity took Procyon. Standalone privileged access management is becoming a feature of something larger.

Machine and non-human identity got expensive. CyberArk paid for Venafi, IBM took HashiCorp and with it both Vault and Boundary, and in a single week in mid-2026 Cisco bought Astrix Security while SailPoint bought Entro Security. Then Cyera agreed to pay about 1 billion dollars for Oasis Security, a company founded in 2022. Workload and agent identity stopped being a niche.

Buyers came from outside identity. The most striking thing about 2026 is who is writing the cheques. A data security vendor (Cyera) bought non-human identity, a data platform (Snowflake) bought Natoma, a workflow company (ServiceNow) bought Veza, an endpoint vendor (CrowdStrike) bought SGNL, and a password manager (1Password) bought Apono. Identity controls are being pulled into whichever platform already sits closest to the thing an AI agent wants to touch, which means a standalone agent-identity vendor is now a likelier acquisition target than a likely category winner. Okta buying Permiso is the exception that proves it: an identity vendor buying detection back.

Private equity reshaped the middle of the market. Thoma Bravo bought ForgeRock and folded it into Ping Identity, which it already owned, collapsing two independent IAM platforms into one. Buyers who had standardised on ForgeRock inherited a migration they did not choose.

If you are on the other side of one of these deals and have to merge two identity estates, that is a different problem with its own playbook: see IAM for mergers and acquisitions.

What this means practically: check the ownership line before you sign. A vendor acquired mid-evaluation may keep its roadmap, or may be folded into the acquirer's platform within a year. The deals where the target continued as a standalone product are noted as such below, and every entry links to the vendor profiles on both sides.

The table is the record we maintain, not a complete history of the market. It covers the vendors we profile, and it is checked against every profile's ownership line on each build, so a vendor described as independent here and acquired there is a build failure rather than something a reader discovers.