Identity security firm CyberArk announced its intention to acquire Venafi, a machine identity management vendor, from Thoma Bravo for about $1.54 billion. CyberArk claims the deal will expand its total addressable market (TAM) by nearly $10 billion to about $60 billion.

The deal is expected to close in the second half of 2024, subject to required regulatory approvals, clearances and other customary closing conditions.

Founded in 2004, Venafi offers machine identity management and identity and access management solutions. In 2020, private equity investment firm Thoma Bravo announced the completion of its strategic growth investment in Venafi. Before this, Venafi had raised more than $160 million in funding over six rounds.

CyberArk, recognized as a challenger in Gartner’s 2023 Magic Quadrant for Access Management, views this acquisition as an expansion of market reach and capabilities.

The company claims the combination of Venafi’s certificate lifecycle management, private public key infrastructure (PKI), IoT identity management and cryptographic code signing and CyberArk’s secrets management capabilities will enable customers to protect against misuse and compromise of machine identities, while having an all-in-one machine identity security solution that can be deployed as software-as-a-service (SaaS) or for hybrid cloud.

CyberArk Chief Strategy Officer Clarence Hinton told SDxCentral that the two companies are in the process of developing their integration plans. “We already see strong alignment between our two organizations. Acquiring Venafi accelerates our vision to secure every identity — human and machine — with the right level of privilege controls.”

The Venafi team is expected to join CyberArk. “The talent and expertise within Venafi are critical to our long-term success in delivering on this mission,” Hinton said in response to questions. “Given the scale of its operations and its highly profitable business model, at this time we intend to integrate the Venafi team into CyberArk in a manner that maintains market traction for solutions within both businesses.”

The deal aims to benefit customers from both companies Hinton noted the two companies aim to “drive meaningful top-line growth through cross-selling into each customer base as well as into new customers” upon the deal's completion.

“By bringing together Venafi’s best-in-class certificate lifecycle management, private PKI and certificate authority, IoT identity management and cryptographic code signing with CyberArk’s secrets management capabilities, we will create meaningful customer benefits through offering complementary solutions,” he said.

“In addition, Venafi and CyberArk both have deep relationships with CISOs in similar large enterprise organizations making the synergies easier to realize,” he added.

Lastly, he added the deal is expected to drive global growth. “40% of CyberArk’s business is outside the Americas, compared with Venafi’s 26%, which provides opportunities to drive growth geographically.”

Venafi expected to broaden CyberArk’s total addressable market The integration of Venafi’s solutions is expected to broaden CyberArk’s total TAM from $50 billion to $60 billion.

CyberArk expects Venafi to add about $150 million in annual recurring revenue (ARR) and bring a strong business model with 95% in recurring revenue, including SaaS and term-based license revenue.

The growing need for machine identity management The digital transformation and ongoing cloud migration have exponentially increased the number of machine identities, including workloads, code, applications, IoT devices, and containers.

CyberArk noted the number of machine identities now outpaces human identities with over 40 machine identities for every human identity.

“Historically, enterprises have taken less interest in managing machine identities compared with human identities, in part because machine identities present different requirements and more complicated lifecycle challenges,” Forrester analysts wrote in the Forrester Tech Tide: Identity And Access Management, Q1 2023 report.

“However, the exponential growth of machine identities, both for devices and cloud workloads, has brought attention and urgency to improving machine identity management to reduce the risks stemming from this expanded threat surface,” they added.

“This acquisition marks a pivotal milestone for CyberArk, enabling us to further our vision to secure every identity – human and machine – with the right level of privilege controls,” CyberArk CEO Matt Cohen, said in a statement. “By combining forces with Venafi, we are expanding our abilities to secure machine identities in a cloud-first, genAI [generative artificial intelligence], post-quantum world. Our integrated technologies, capabilities and expertise will address the needs of global enterprises and empower Chief Information Security Officers to defend against increasingly sophisticated attacks that leverage human and machine identities as part of the attack chain.”