Executive Summary
AI-generated analysis for Cyberark
CyberArk (cyberark.com) is a globally recognized identity security and access management vendor, incorporated as CyberArk Software Ltd. (LEI: 529900YEXNDM894PWS93, active, jurisdiction: IL), currently undergoing acquisition by Palo Alto Networks in a reported ~$25B transaction. This assessment assigns a Tier 3 (Moderate Risk) rating, driven primarily by the inability to independently verify an extensive portfolio of claimed certifications and the presence of security header gaps on the marketing site — not by any fundamental concerns about the vendor's legitimacy or security posture. CyberArk presents a number of strong positive signals across this assessment:
Key Findings
- The domain has been registered since 1996 and continuously archived since 1997, reflecting ~30 years of established presence.
- No sanctions matches were identified across OFAC, EU, or UN watchlists.
- No adverse media was found in either the 12-month scan or historical archive search.
- Domain reputation is clean across all blacklists (SURBL, Spamhaus DBL, URLhaus), with a Malware detection service threat score of zero.
- Zero known CVEs were identified against the vendor's infrastructure, and the IP reputation score is 0% abuse confidence.
- The vendor publishes a comprehensive subprocessor list at cyberark.com/sub-processors, identifying 22 subprocessors — all cleared against sanctions and safety databases.
- A SOC 2 trust page is maintained via the Drata platform at trust.cyberark.com, and the vendor's compliance page references an extensive set of certifications including SOC 2 Type 2, ISO 27001, FedRAMP High, PCI DSS v4.0.1, and others. Two areas require attention. First, while CyberArk claims 11 certifications on its trust and compliance pages, independent registry verification could not confirm any of them during this assessment — all are currently classified as vendor-attested. Notably, the FedRAMP Marketplace did not return a confirmed authorization for CyberArk at the time of this scan, despite a vendor claim of "FedRAMP High Authorization." Compliance buyers relying on any of these certifications should request current certificates or audit reports directly. Second, CyberArk's marketing site (cyberark.com) received a HTTP security scanner grade of D (30/100), indicating missing security headers including Content-Security-Policy. While this applies to the marketing domain rather than the product platform, it represents a gap in web security hygiene. Additionally, researchers publicly disclosed RCE attack chains in CyberArk Conjur in August 2025 — buyers using that specific product should confirm patch status with the vendor. Overall, CyberArk is a well-established, enterprise-grade security vendor with a long operational history and clean threat intelligence profile. The Tier 3 rating reflects the limitations of independent verification for its stated compliance posture and the identified web security gap, rather than any active risk indicators. A conditional engagement approach — obtaining current audit documentation and confirming Conjur patch status — is recommended before proceeding.
Independence Statement
All evidence in this report was independently sourced from external data providers and public registries without vendor participation or notification.