Identity security company CyberArk acquires identity governance and administration platform Zilla Security for $165M in cash and an additional $10M “earn-out”
Identity security company CyberArk has acquired identity governance and administration (IGA) platform Zilla Security in a deal worth up to $175 million.
Context & Ripple Effects
This deal extends a cybersecurity M&A pattern in which larger vendors buy specialized platforms rather than build every adjacent capability internally. Zscaler’s purchase of Avalor and its earlier Cloudneeti acquisition show similar efforts to add focused security functions through acquisition.
The transaction also sits early in CyberArk’s larger consolidation arc: subsequent coverage reported Palo Alto Networks’ agreement to buy CyberArk. That makes Zilla a relevant example of CyberArk broadening its own product scope before becoming an acquisition target.
First-order effects
- CyberArk adds Zilla Security’s IGA platform to its identity-security portfolio, giving its customers a governance-oriented product alongside CyberArk’s existing identity focus.
- Zilla becomes part of CyberArk, with the consideration structured as $165 million in cash plus up to $10 million in an earn-out.
Second-order effects
- Identity-security rivals face added pressure to offer governance capabilities through their own product roadmaps, partnerships, or acquisitions, as CyberArk can package IGA within a broader identity-security offering.
- For IGA buyers, the deal may shift vendor evaluation toward how well governance tools integrate with a wider identity-security stack rather than stand alone.
Third-order effects
- If acquisitions such as this continue, identity governance is likely to be absorbed into broader security platforms, concentrating more of the identity stack among large vendors.
- The later proposed Palo Alto-CyberArk combination suggests that consolidation can occur at multiple layers: specialist capabilities are first acquired by identity vendors, which may themselves become strategic assets for larger security platforms.
The trend: Cybersecurity vendors are consolidating adjacent identity, governance, and cloud-security capabilities into broader platforms through targeted acquisitions.