Identity security spent the last three years consolidating, and the pace picked up sharply in 2026. If you are evaluating a vendor, the question "is this product going to exist in its current form in two years" now matters as much as any feature comparison.

Three patterns run through the deals below.

PAM is being absorbed into platforms. Palo Alto Networks buying CyberArk for roughly $25 billion is the largest deal identity security has seen, and it moved the category's anchor vendor inside a network-security platform. Delinea took StrongDM, and Ping Identity took Procyon. Standalone privileged access management is becoming a feature of something larger.

Machine and non-human identity got expensive. CyberArk paid for Venafi, IBM took HashiCorp and with it both Vault and Boundary, and in a single week in mid-2026 Cisco bought Astrix Security while SailPoint bought Entro Security. Workload and agent identity stopped being a niche.

Private equity reshaped the middle of the market. Thoma Bravo bought ForgeRock and folded it into Ping Identity, which it already owned, collapsing two independent IAM platforms into one. Buyers who had standardised on ForgeRock inherited a migration they did not choose.

If you are on the other side of one of these deals and have to merge two identity estates, that is a different problem with its own playbook: see IAM for mergers and acquisitions.

What this means practically: check the ownership line before you sign. A vendor acquired mid-evaluation may keep its roadmap, or may be folded into the acquirer's platform within a year. The deals where the target continued as a standalone product are noted as such below, and every entry links to the vendor profiles on both sides.

The table is the record we maintain, not a complete history of the market. It covers the vendors we profile, and it is checked against every profile's ownership line on each build, so a vendor described as independent here and acquired there is a build failure rather than something a reader discovers.