IAM Valuations: Q1 2026
IAM valuations bifurcated sharply entering Q1 2026, with AI-native platform leaders commanding 10 to 25x EV/Revenue while legacy on-premises point solutions compressed to 2 to 4x, against a backdrop of $96 to $102 billion in cybersecurity M&A across 400-plus deals in 2025 where strategic buyers accounted for roughly 92% of disclosed value. Google's $32 billion Wiz acquisition and Palo Alto Networks' approximately $25 billion CyberArk close reset valuation anchors for cloud-native and PAM assets respectively, while the 82-to-1 projected ratio of non-human to human identities by 2026 and Morgan Stanley's $377 billion TAM estimate through 2028 frame the structural demand case. The report covers public comparable multiples, M&A transaction benchmarks, private-market round valuations for late-stage IPO candidates including Netskope, Delinea, and Saviynt, and the valuation implications of emerging categories including NHI governance, decentralized identity, and passwordless authentication.
- Sector
- Cybersecurity
- Focus
- Valuations
- Published
- January 15, 2026
- Length
- 30 slides
- Reading time
- 23 minutes
Key findings
- Cybersecurity M&A reached $96–$102B across 400+ deals in 2025, with strategic buyers accounting for ~92% of disclosed value, resetting valuation anchors for the IAM category.
- Google's $32B all-cash acquisition of Wiz at an implied ~45–65x ARR multiple established a new valuation ceiling for cloud-native, AI-ready security platforms.
- Palo Alto Networks' ~$25B acquisition of CyberArk at an implied 13–18x EV/Revenue re-rated PAM multiples and removed the leading independent PAM asset from the market.
- AI-native IAM platform leaders trade at 10–25x EV/Revenue while legacy on-premises point solutions are compressed to 2–4x, reflecting a widening bifurcation in the market.
- Non-human identities are projected to outnumber human identities 82:1 by 2026, expanding the IAM addressable market and driving premium multiples for NHI-capable platforms.
- Morgan Stanley projects the IAM TAM to reach $377B by 2028 as identity becomes the control plane for AI workloads, agentic systems, and machine identity governance.
- CrowdStrike trades at ~24.7x NTM EV/Revenue with a Rule of 40 score of ~60%, while Okta trades at ~5.1x with ~12% growth, illustrating the valuation gap between platform leaders and slower growers.
- Thoma Bravo's combined Ping Identity ($2.8B, 2022) and ForgeRock ($2.3B, 2023) roll-up is targeting a potential relisting or strategic sale in 2026–2027 after integration synergies.
- Late-stage IAM IPO candidates include Netskope (ARR >$500M, ~$10B+ valuation), Delinea (ARR >$400M), and Saviynt (~$200M+ ARR, $3B valuation), with an H2 2026 window expected.
- Decentralized identity is forecast to grow at ~81% CAGR while passwordless authentication expands at 16–18% CAGR, driven by the EU Digital Identity (EUDI) wallet mandate.
Methodology
This report synthesizes public-market, M&A, and private-market data as of January 2026. Public comparable multiples were sourced from Capital IQ, FactSet, Multiples.vc, and company 10-Ks and press releases. M&A transaction data was drawn from Momentum Cyber's 2025 Year-End Almanac, SecurityWeek, Reuters, and bank sector reports. Private-market round valuations and ARR estimates were sourced from PitchBook, investor disclosures, and press releases. Research frameworks and category definitions referenced Gartner, Forrester, and IDC; macro inputs were drawn from Goldman Sachs and Morgan Stanley 2026 outlooks; regulatory analysis referenced EU DORA, NIS2, SEC cyber-disclosure rules, and the EU AI Act. Windsor Drake calibrated multiple bands by normalizing LTM and NTM EV/Revenue across sub-sectors, reconciling ARR and GAAP revenue where applicable, and triangulating ranges where source estimates diverged.
Frequently asked questions
What EV/Revenue multiples are IAM companies trading at in Q1 2026?
Platform and AI-native IAM leaders command 10–25x EV/Revenue in Q1 2026, with a top-cohort median of approximately 12x. CrowdStrike trades at ~24.7x, CyberArk at ~16.6x, and Zscaler at ~13.7x, while legacy or point-solution vendors are compressed to 2–6x.
Who is buying IAM and cybersecurity companies right now?
Strategic buyers dominated 2025 M&A, accounting for ~92% of the $96–$102B in disclosed deal value. The landmark deals were Google acquiring Wiz for $32B and Palo Alto Networks acquiring CyberArk for ~$25B. Thoma Bravo has also been active, rolling up Ping Identity and ForgeRock into a unified IAM platform.
What multiples did the Google–Wiz and PANW–CyberArk deals imply?
The Google–Wiz deal at $32B implied approximately 45–65x ARR, with Wiz estimated at $500–700M ARR. The Palo Alto Networks–CyberArk deal at ~$25B implied 13–18x EV/Revenue, reflecting CyberArk's category leadership in PAM and a ~26% premium to its unaffected share price.
What Rule of 40 score do IAM companies need to command a premium multiple?
A Rule of 40 score above 50% correlates with double-digit revenue multiples in the IAM sector. Scores above 40% support median bands of 5–8x EV/Revenue, while companies below 40% face discount valuations below 4x. Efficient growth and NRR above 120% are the primary valuation filters.
What is driving IAM TAM expansion in 2026?
Three forces are expanding the IAM TAM: the explosion of non-human identities projected at an 82:1 NHI-to-human ratio by 2026, regulatory mandates including DORA, NIS2, and SEC cyber-disclosure rules, and AI adoption requiring governance for agentic workflows and machine identities. Morgan Stanley projects the TAM to reach $377B by 2028.
Which IAM companies are expected to IPO in 2026?
The primary IPO candidates are Netskope (ARR >$500M, valuation ~$10B+, timing H2 2026), Delinea (ARR >$400M, IPO or strategic sale path), Saviynt (~$200M+ ARR, $3B valuation, KKR-led round), Semperis (ARR >$100M, valuation >$1B), and 1Password ($6.8B valuation, shifting toward enterprise). The IPO window is expected to broaden in H2 2026.
How do regional IAM valuations differ between North America, Europe, and Israel?
North America trades at 4.8–10x EV/Revenue, supported by deep capital markets and AI platform concentration. Europe trades at 3.5–4.5x, as DORA and NIS2 drive spend but regulatory complexity compresses near-term multiples. Israel achieves 5.0–9.0x, underpinned by deep-tech innovation and US-listed exit pathways via NASDAQ or strategic M&A.
Companies covered
Public and private companies referenced in this report.