The European Commission has flagged the CyberArk acquisition by Athens Strategies Ltd. for potential antitrust investigation, adding regulatory uncertainty to one of 2026's largest cybersecurity deals. EU competition authorities cite market concentration concerns in privileged access management (PAM) software, where CyberArk holds an estimated 40% European market share.
Athens Strategies, an Israeli merger vehicle, announced the acquisition in January 2026. The transaction requires approval from competition regulators in Israel, the United States, and the European Union. EU officials have 25 working days to decide whether to launch a Phase II investigation, which typically adds 90-125 days to approval timelines.
Brussels regulators raised three specific concerns in preliminary filings. First, CyberArk's dominance in PAM software for financial services and energy sectors. Second, the deal's impact on smaller European cybersecurity vendors who compete in identity management. Third, data sovereignty questions around consolidating privileged access credentials under Israeli-US corporate control.
The EU's 2024 Cyber Resilience Act designated PAM systems as critical security infrastructure. This classification triggers enhanced scrutiny under Article 22 merger review provisions. Companies controlling critical security tools face stricter concentration thresholds than standard software mergers.
Competition Commissioner Margrethe Vestager's office declined comment on active investigations. Industry lawyers estimate 60-70% probability the Commission requests concessions or divestitures. Potential remedies include spinning off CyberArk's European customer contracts or licensing PAM technology to competitors.
Three comparable cybersecurity mergers faced EU intervention since 2023. Broadcom's VMware acquisition required selling carbon black endpoint security assets. Thoma Bravo's Darktrace purchase cleared only after firewall product divestitures. NortonLifeLock's Avast merger took 14 months for EU approval.
Athens Strategies has not disclosed the acquisition price. Analysts value CyberArk at €12-15 billion based on its Nasdaq market capitalization. The company reported €847 million revenue in 2025, with 35% derived from European customers.
Israeli Foreign Investment Review Board approved the deal in February 2026. US CFIUS review remains pending. The transaction cannot close until all three jurisdictions grant clearance.