Idira

Positioning: the PAM incumbent, now a Palo Alto Networks platform

If you are shortlisting privileged access management in 2026, the first thing to know is that CyberArk the company no longer exists. Palo Alto Networks announced the acquisition on 30 July 2025, closed it on 11 February 2026, and on 12 May 2026 relaunched the entire acquired portfolio as Idira — the identity security platform that now sits alongside Strata and Cortex as one of Palo Alto Networks' core platforms. cyberark.com still resolves and still serves documentation, but it leads with "CyberArk is now Idira." In my view that matters for buyers: you are no longer choosing an independent PAM specialist, you are choosing one pillar of a four-pillar security platform, sold by a vendor most enterprise security teams already buy firewalls and SOC tooling from.

That is not a criticism — it is the context you need before the rest of this review makes sense. Idira is built on more than twenty years of privileged access engineering (CyberArk was founded in 1999 in Petah Tikva, Israel) plus the acquisitions CyberArk made along the way: Conjur for DevOps secrets, Idaptive for workforce identity, Venafi for certificate and machine identity management, and Zilla Security for identity governance. The pitch under the new brand is that every identity in the modern enterprise is privileged — every token, service account, workload and AI agent can trigger workflows and reach data — so privilege controls should extend to all of them rather than to a small priesthood of administrators. Palo Alto Networks' 2026 Identity Security Landscape Report, surveying 2,930 security decision makers, is the data backbone for that argument: machine identities outnumber humans 109 to 1 (a vendor figure I would treat as directional rather than precise), 91% of organisations already run autonomous agents in production, and 90% suffered an identity-related breach in the past year.

What Idira actually does

The cleanest functional map I found is the five-module split Palo Alto Networks uses in its own financial reporting. First, Workforce Identity Security: workforce access, workforce password management and secure browsing, largely the old Idaptive lineage. Second, IT and Developer Identity Security — the modern PAM core: vaulting, session isolation and recording, just-in-time elevation, credential protection and the zero standing privilege model. Third, Machine Identity Security: secrets management for applications and pipelines (the ex-Conjur Secrets Manager), certificate lifecycle management (the ex-Venafi Certificate Manager and PKI), and workload identity. Fourth, Identity Governance and Administration: access certification and joiner-mover-leaver lifecycle automation (the ex-Zilla piece). Fifth, and newest, AI Agents Security: agent discovery across SaaS, cloud and developer environments, an Agent Registry that enriches agents with ownership and permission context, an Agent Identity Broker that grants task-scoped just-in-time access, activity recording, and an Agent Kill Switch to revoke access when an agent deviates.

Underneath the modules the operating model is a three-beat loop the vendor repeats everywhere: discover (continuously find identities, entitlements and access paths), control (replace standing accounts with dynamic privilege that exists only in the moment of use), and govern (automate the lifecycle end to end rather than running quarterly certification exercises). Deployment is SaaS (the old Privilege Cloud estate), self-hosted vault, or hybrid. Integration into the wider Palo Alto Networks stack is real and observable: Prisma Browser delivers privileged access inside the browser where users work, Cortex receives first-party identity signals for detection and response, and Prisma AIRS 3.0 is the intended integration point for agent security.

My testing notes

Two concrete observations from working through the product surfaces. First, the licensing model is more visible than most enterprise platforms, but it is also where the complexity lives. The Setup space has a license consumption page that shows usage per service and per user license type, with entitlement lifecycles (available, expiring, expired) spelled out in the documentation. Walking through it, I counted the user license types that map onto Privilege Cloud roles — Privileged Basic User, Privilege Cloud External Vendors, and the Privileged Standard Lite User type that the docs note was discontinued in 2025 — and the mapping between roles in Identity Administration and consumed licences is genuinely granular. That granularity cuts both ways: an administrator can see exactly what they are paying for, but a buyer assembling a quote has to reason about several user classes plus per-service entitlements before knowing the bill.

Second, the rebrand migration is visibly incomplete in the product surfaces, not just in press coverage. The documentation is still hosted at docs.cyberark.com and speaks of "the Idira service entitlement lifecycle" and "Idira Identity" in the same console text — a mixed vocabulary that is easy to parse once you know the history and confusing if you do not. When I checked the Idira Certificate Manager SaaS trial page in October 2026, it still read "CyberArk Certificate Manager." None of this breaks functionality, but it tells you what state the platform is in: a genuinely integrated portfolio moving through a naming and console consolidation that will take more than one release cycle.

Third, and this is the one that matters at contract stage, the upgrade paths from legacy CyberArk licences are explicitly tiered. Traditional PAM (IT Standard) customers receive discovery and user experience improvements automatically, but zero standing privilege, agentic and machine identity protections require additional licences. Modern PAM (IT Enterprise and Dev) customers get discovery, ZSP and UX improvements at no additional cost. Secrets and workload licence holders can add traditional PAM only through new licences. I read the launch release twice to confirm this: the "one platform" story has licence gates at exactly the points where the new capabilities are most interesting.

What it does not do

Idira is not a workforce identity provider replacement. Its centre of gravity is privilege and identity security — vaulting, brokering, governance, secrets — not being your directory. If you want an Okta or Entra ID substitute, this is not it, and nothing in the launch material claims otherwise.

The agentic security story is the newest and least finished layer. As of October 2026 the Prisma AIRS 3.0 integration with Idira agent identity capabilities was still marked as coming soon on the product page; the Claude-agent extensions (SPIFFE-based identities, JIT access, audit trails) only appeared in September 2026. If your buying decision rests on governing AI agents today, treat those capabilities as early and verify them in your own proof of concept rather than in a slide.

There is no public price list. Idira is quote-based and sold per managed account and module mix; independent comparisons put small deployments at roughly $7,000–$12,000 per managed account annually and large deployments at a lower per-account rate, but those are third-party estimates, not vendor figures. There is no free tier; the closest thing to self-serve evaluation is a SaaS trial for individual modules such as Certificate Manager. There is also an ownership-transition risk that a purely technical review would miss: press reports in February 2026 described job cuts affecting about 10% of the former CyberArk staff, and independent analysts flag genuine uncertainty for customers heading into 2027 renewals as contracts migrate onto Palo Alto Networks paperwork.

Verdict

Idira is the deepest privileged access platform I have evaluated, and the extension of vaulting and just-in-time principles to machine and AI-agent identities is the right direction — arguably the only direction that matches where enterprise access is going. But you are buying it mid-transformation: a rebrand that is still shedding old names, agentic features with visible "coming soon" tags, licence gates between the tiers, no public pricing, and the integration risk that comes with any platform being absorbed into a much larger vendor. I rate it 3.9 — strong on core functionality depth (the module set covers PAM, secrets, certificates, governance and agent identity with few gaps), weaker on value transparency and mid-migration polish. If you are a regulated enterprise already running CyberArk, the upgrade path is coherent and mostly additive. If you are starting from scratch, go in with eyes open about the licence structure and validate the agent controls hands-on before signing.

Sources

• https://www.paloaltonetworks.com/idira
• https://investors.paloaltonetworks.com/news-releases/news-release-details/palo-alto-networks-introduces-idira-next-generation-identity
• https://paloaltonetworks.com/blog/2026/05/idira-journey-democratize-privilege-controls
• https://www.paloaltonetworks.com/idira/agentic
• https://www.paloaltonetworks.com/idira/machine/secrets-management
• https://www.paloaltonetworks.com/idira/certificate-manager-saas-trial
• https://crn.com/news/security/2026/palo-alto-networks-ceo-cyberark-has-already-surpassed-expectations-as-agentic-identity-security-heats-up
• https://nhigovernance.com/companies/cyberark.html
• https://druce.ai/governance/wiki/vendors/cyberark
• https://tech-insider.org/cyberark-vs-beyondtrust-vs-delinea-2026/
• https://docs.cyberark.com/setup/latest/en/content/setup-space/health-maintenance/license-consumption.htm
• https://docs.cyberark.com/manage/latest/en/content/identity/coreservices/getstarted/ispss-user-roles.htm
• https://docs.cyberark.com/remote-access-shared-services/latest/en/content/admin/licensing.htm
• https://cyberark.com/press/palo-alto-networks-announces-agreement-to-acquire-cyberark
• https://www.sec.gov/Archives/edgar/data/1327567/000119312526045600/d40626dex991.htm