Yesterday, privileged identity management (PIM) vendor CyberArk announced the acquisition of identity-as-a-service (IDaaS) vendor Idaptive from private equity firm Thoma Bravo for $70M in cash. Idaptive is no stranger to the PIM world, having been part of PIM vendor Centrify (a CyberArk competitor) when Thoma Bravo acquired Centrify in July 2018. In October 2018, Thoma Bravo spun out the IDaaS business from Centrify into a stand-alone company called Idaptive.

Forrester’s take:

  1. The competitive balance in IDaaS and PIM has changed. This deal hurts the Centrify PIM business (still owned by Thoma Bravo) in two ways. First, it gives CyberArk a broader identity and access management (IAM) portfolio, which differentiates it against Centrify. Secondly, the CyberArk/Idaptive combo removes the strategic advantage of the earlier, tight IDaaS-to-PIM product integration that Centrify has continued to claim (post split-up) as a competitive advantage for customers using both.
  2. The merger synergies are clear for CyberArk’s PIM SaaS offerings but less so with its on-premises offerings. Centrify pioneered the PIM-as-a-service offering, so architecturally speaking, it aligned well with the Idaptive IDaaS offering. While CyberArk has software-as-a-service (SaaS) offerings, the CyberArk install base is predominantly for its on-premises offerings. So while the Idaptive acquisition demonstrates CyberArk’s commitment to double down on PIM SaaS, how CyberArk’s on-prem offerings will integrate with Idaptive is less clear.
  3. CyberArk has broader IAM ambitions beyond PIM. While this may just be a move to enhance CyberArk’s PIM SaaS offerings, we think that this acquisition signals something more. The Idaptive IDaaS business provides secure access and single sign-on for employees, not just privileged users. Idaptive also serves partners (B2B) and customers (B2C). This provides CyberArk with an entrée into new IAM market segments and puts it on the path to becoming an IAM suite provider.

Success Will Depend On These Factors

Forrester expects that the success of this acquisition will hinge on the following factors:

  • How long will it take CyberArk to deliver this integration? Integration between CyberArk and Idaptive will need to have a compelling and consistent user experience.
  • Does CyberArk have a strategy for moving or incentivizing customers using an existing commercial IDaaS offering to Idaptive instead? Given that many of CyberArk’s existing customers already use other competing IDaaS solutions from vendors such as ForgeRock, IBM, Microsoft, Okta, OneLogin, Ping Identity, and others, this will be something to monitor post-acquisition.
  • Will the integration efforts cause CyberArk to lose focus on its core PIM business? Focus is important for any business but especially for those operating in competitive and dynamic markets (PIM and IDaaS both qualify). Does CyberArk have enough of an understanding of IDaaS and especially customer IAM (CIAM) to compete effectively in that space going forward while still maintaining its strong PIM position?