Identity & Access Management Valuations: Q2 2026
Public IAM multiples have re-anchored near 6.0x NTM revenue in Q2 2026, with Palo Alto Networks' $25B acquisition of CyberArk (closed February 2026) and SailPoint's $12.8B February 2025 relisting framing the strategic and public benchmarks. Non-human and AI agent identity platforms now lead the sector at 15x to 30x revenue, while privileged access (14x to 18x), identity governance (9x to 14x) and workforce IAM (4x to 8x) reflect a sharp subsegment bifurcation. Gartner forecasts $24.3B of global IAM spend in 2026 at roughly 15% growth, and the report sets out how founders should position for a strategic-buyer-led identity consolidation cycle.
- Sector
- Cybersecurity
- Focus
- Valuations
- Published
- April 15, 2026
- Length
- 8 slides
- Reading time
- 11 minutes
Slide deck
8-slide deck. Desktop readers can page through the embedded viewer below. Mobile readers can open the direct PDF link.
Open slide deck PDF Key findings
- Palo Alto Networks closed its $25B acquisition of CyberArk in February 2026, repricing every comparable PAM asset upward and anchoring privileged access multiples at 14x to 18x revenue.
- Non-human and AI agent identity platforms now command 15x to 30x revenue in private rounds, the highest ceiling of the current cycle, driven by AI agent governance demand and capital concentration.
- SailPoint relisted at $12.8B in February 2025 on $925M of ARR growing at 30%, resetting the public benchmark for identity governance and administration at 9x to 14x revenue.
- Gartner forecasts global IAM end-user spend of $24.3B in 2026 at roughly 15% YoY growth, with 41% of enterprises now running zero-trust frameworks according to McKinsey.
- The public IAM cohort has re-anchored near Windsor Drake's 6.0x NTM revenue benchmark in Q2 2026, one full turn ahead of generic enterprise software but in line with the broader cybersecurity median.
- Okta now trades near 3.7x revenue on 11% YoY growth and 107% NRR, illustrating the compression facing standalone workforce IAM vendors under Microsoft Entra bundling pressure.
- Machine identities outnumber human identities 40 to 1 across modern stacks, a structural driver of the NHI and AI agent identity premium.
- $47B of cybersecurity deal value transacted in Q1 2026 alone, with identity identified as a leading category within that total.
- Public software companies clearing the Rule of 40 earn a median 10.7x EV/Revenue per Bain, with top-quartile IAM performers achieving 50% to 100% premium over the sector median.
- The Federal Reserve funds range holds at 3.50% to 3.75%, with the December 2025 dot plot signalling one further cut in 2026, easing the cost of capital for long-duration identity software assets.
Methodology
This report synthesises Windsor Drake's proprietary valuation index and subsegment multiple framework with data drawn from PitchBook, CB Insights, and S&P Global Market Intelligence for transaction and public-market comparables. Macro and market-size inputs reference Gartner's Forecast: Information Security End-User Spending Worldwide and 2026 Predicts: Identity and Access Management, McKinsey & Company's software value-creation and zero-trust research, and Bain & Company's Rule of 40 analysis. M&A volume and deal data are sourced from PwC's Global M&A Industry Trends, EY-Parthenon M&A Activity Insights, and PitchBook's Q1 2026 Global M&A Report. Public-company financials are drawn from SEC filings by Palo Alto Networks, SailPoint Technologies, and Okta. Windsor Drake calibrated all multiples against live transaction data and applied its own subsegment weighting and strategic-premium methodology.
Frequently asked questions
What multiples are identity and access management companies trading at in Q2 2026?
The public IAM cohort clusters near Windsor Drake's 6.0x NTM revenue benchmark, but subsegment spreads are the widest in a decade. Non-human and AI agent identity platforms command 15x to 30x revenue, privileged access trades at 14x to 18x, identity governance at 9x to 14x, customer IAM at 7x to 12x, and legacy directory and SSO at a compressed 3x to 5x.
How does the Palo Alto Networks acquisition of CyberArk affect IAM valuations?
The $25B close of the Palo Alto Networks and CyberArk deal in February 2026 repriced every comparable PAM asset upward, creating a valuation halo that benefits players such as Delinea and BeyondTrust. PAM multiples have re-rated to 14x to 18x revenue as a direct consequence, making it the single most consequential transaction benchmark in the current cycle.
How are identity and access management companies valued in 2026 beyond simple revenue multiples?
The Rule of 40 is now the primary filter for a premium identity multiple, with top-quartile performers above 50 earning 12x to 22x and above. LTV/CAC of at least 3:1, payback inside twelve months, and NRR above 115% are the essential unit-economic thresholds. For category-defining assets, a strategic premium of roughly 25% to 30% is applied on top of the underlying revenue or EBITDA multiple.
Who is buying identity and access management companies right now?
Strategic platform buyers are the dominant acquirers, with Palo Alto Networks setting the tone through its $25B CyberArk acquisition. Cisco's interest in AI-native identity players such as Astrix illustrates appetite for NHI and machine identity assets. Generic late-stage private IAM companies without a clear AI agent or NHI position are increasingly candidates for strategic M&A or PE take-private outcomes.
What is driving the bifurcation between AI-native identity platforms and legacy workforce IAM valuations?
AI agent governance demand and capital concentration are pushing NHI and AI agent identity platforms to 15x to 30x revenue, while Microsoft Entra bundling is compressing standalone workforce IAM to 4x to 8x. The 40-to-1 ratio of machine to human identities across modern stacks structurally advantages vendors addressing non-human identity, and the market is explicitly pricing that divergence.
What growth and profitability benchmarks do identity companies need to hit for a premium valuation in 2026?
A Rule of 40 score above 40 is the minimum for a healthy premium, with scores above 50 earning the top-quartile range of 12x to 22x and above. For any identity asset valued above 8x revenue, the market expects a credible path to EBITDA profitability within 12 to 18 months. NRR above 115% and LTV/CAC of 5:1 or better are the additional markers that investors use to confirm multi-product attach quality.
How long does an identity M&A or IPO process take in 2026, and when should founders start preparing?
A full strategic or public-market process runs 12 to 18 months end to end. Given that today's alignment of strategic identity demand, AI agent capability premia, and stable rate pricing may not persist indefinitely, founders who intend to engage the market during this window are, in practice, preparing now in the current cycle.
Companies covered
Public and private companies referenced in this report.