Why One Firm Exited $11 Million CyberArk Stake as Stock Rallied 44% Over the Past Year

G2 Investment Partners disclosed in an SEC filing dated November 14 that it fully liquidated its CyberArk Software (NASDAQ: CYBR) stake in Q3, selling 27,578 shares — about a $11.2 million reduction and roughly 2.5% of the fund's assets. The sale comes as CyberArk trades near $458.59 with a $23.1 billion market cap, reporting strong underlying results (Q3 revenue $342.8M, +43% YoY; record net new ARR $68M; total ARR $1.34B, +45% YoY) and a pending Palo Alto Networks acquisition; the move appears driven by portfolio rebalancing rather than company weakness and is unlikely to be market-moving given the position's small size relative to CYBR market cap.

Analysis

Market structure: G2’s $11.2M exit (~0.05% of CYBR market cap) is immaterial to supply but signals active-manager rotation into smaller, higher-volatility names (DAVEW, PACK, TSEM, PRCH, PGYWW). Winners are acquirer Palo Alto Networks (PANW) and large-cap, subscription-heavy identity/security platforms that command pricing power as enterprises shift to cloud/IAM; losers are niche point-solution vendors and highly levered small caps that face funding and multiple compression. With CYBR up 44% YTD and ARR +45%, demand remains robust; however pending M&A tightens effective free float and compresses arbitrage spreads, lowering options IV for the near term.

Risk assessment: Tail risks include a DOJ/FTC antitrust challenge or deal break (low-probability, high-impact), integration churn causing ARR deceleration, or macro-driven multiple compression if rates rise sharply. Immediate (days) impact: headline-driven IV spikes and 13F rebalances; short-term (weeks-months): potential spread narrowing/volatility around regulatory filings and earnings; long-term (quarters-years): secular identity demand should support ARR compounding barring execution failures. Hidden dependencies: earnouts/retention packages and renewal rates post-integration; track next 90-day regulatory milestones and CYBR net new ARR cadence.

Trade implications: Direct: initiate a 1–1.5% portfolio exposure to PANW via a 9–12 month bull-call spread (buy ATM, sell 25–30% OTM) to capture M&A synergies while limiting premium spend. Arbitrage: only buy CYBR up to 0.5–1% if the spread to offer price exceeds 2–3% after fees; avoid if <1.5%. Pair: long PANW (1%) / short crowded small-cap cybersecurity or non-subscription tech names (e.g., trim DAVEW, PRCH, PGYWW by 25–35%) to reduce liquidity and valuation risk. Options: purchase 3–6 month protective puts equal to 30–50% of position size if regulatory-failure probability >15%.

Contrarian angles: The market is missing that G2’s sale is a portfolio-size rebalance, not a signal of CYBR fundamental failure; with ARR growth at +45% and record net new ARR, a failed deal could leave CYBR substantially higher as a standalone public comp. Historical parallels (e.g., Splunk/Cloud M&A) show arbitrage spreads compressing quickly; opportunistic buyers who avoid sub-1.5% spreads and hedge regulatory risk can capture asymmetric returns. Unintended consequence: aggressive buying of CYBR pre-close can create crowding; prefer structured exposure (spreads, hedges) rather than naked directional positions.

Key Decisions for Investors

• Establish a 1.0–1.5% portfolio position in PANW via a 9–12 month bull-call spread (buy ATM call, sell 25–30% OTM) within 2 weeks to capture M&A upside with defined risk.
• Only initiate a CYBR arbitrage position up to 0.5–1.0% portfolio if the market price trades at least 2–3% below the confirmed offer price after transaction costs; avoid if spread <1.5%.
• Trim exposure to G2-style small/mid-cap growth names (reduce DAVEW, PRCH, PGYWW positions by 25–35%) over the next 2–4 weeks and redeploy proceeds into large-cap enterprise cyber (PANW) and cash-equivalent hedges.
• If holding PANW/CYBR, buy 3–6 month protective puts sized to 30–50% of position value if probability of regulatory challenge exceeds 15% (monitor DOJ/FTC filings and PANW 8-Ks over next 90 days).