CyberArk to Acquire Venafi from Thoma Bravo in Major Cyber Security Consolidation

Thoma Bravo is making cyber security headlines again with a big ticket sale to Israeli cyber security company, CyberArk (NASDAQ: CYBR). The two announced a definitive agreement today to acquire Venafi (a Thoma Bravo portfolio company), a key player in machine identity management, for $1.54 billion. The move follows Thoma Bravo's recent merger of LogRhythm and Exabeam, patently spelling consolidation in the cyber security sector.

The deal is comprised of about $1 billion in cash and $540 million in CyberArk shares, and it's expected to close in the second half of 2024. Some of the deal highlights include Venafi almost generating $150 million in ARR, with 95% of revenue categorized as recurring. The deal is also expected to be margin-accretive, with significant revenue synergies from cross-sell, up-sell, and geographic expansion.

The integration of Venafi’s advanced machine identity management solutions with CyberArk’s identity security platform will establish a solution for end-to-end machine identity security at an enterprise scale.

With the surge in digital transformation and cloud migration, the number of machine identities has skyrocketed, now outnumbering human identities by a factor of over 40. These include workloads, applications, IoT devices, and containers, which require robust security measures to prevent exploitation by cybercriminals. The complex landscape of machine identity management is further complicated by shorter certificate lifecycles and the need for quantum-ready solutions.

Research group Forrester states the increasing urgency in managing machine identities. In fact, A slew of new Israeli startups are working toward securing identity access management and non-human identity management, including Token Security, Sweet Security, Astrix Security, Oasis Security, and Clutch Security.

The expected unified solution, deployable as SaaS or hybrid, will enable organizations to secure modern cloud environments more effectively. Venafi’s expertise in PKI and certificate management will could expand CyberArk’s total addressable market to approximately $60 billion.

This is the eighth acquisition by CyberArk, and undoubtedly the largest. They previously acquired C3M, Aapi.io, IDaptive, Vaultive, Conjur, Viewfinity and Cybertinel.