$92 Million Bet: Why This Fund Made CyberArk a 12% Portfolio Position Amid a Booming Stock Rally

Brazil-based Absolute Gestao initiated a new $92.23 million position in CyberArk (190,897 shares) in Q3, making the holding roughly 12% of its $769.14 million 13F-reportable U.S. equity assets. CyberArk is trading at $454.65 with a $22.95 billion market cap, delivered Q3 revenue of $342.8M (+43% YoY), subscription revenue +60% and ARR of $1.34B, while non‑GAAP operating margin expanded to 19% and the company ended the quarter with nearly $2B in cash and positive adjusted free cash flow; the stake appears a conviction bet ahead of strategic optionality from the pending Palo Alto Networks transaction.

Analysis

Market structure: Absolute Gestao’s $92m, ~12% 13F stake in CYBR signals institutional conviction that identity/security is a scarce growth pocket; direct beneficiaries are CyberArk (CYBR) and adjacent IAM/cloud-entitlement vendors (PANW, OKTA) while legacy on‑prem PAM vendors face pricing pressure. Strong ARR growth (+60% subscription, ARR $1.34bn) and expanding non‑GAAP operating margin (19%) tighten supply of high‑quality SaaS exposure, supporting premium multiples near ~15–18x revenue today and creating demand-driven multiple expansion in the near term.

Risk assessment: Tail risks include a failed/blocked Palo Alto transaction or regulatory scrutiny of consolidation, macro IT spend cuts reducing renewals, and concentration risk from large holders rebalancing; these could blow a 20–40% downside in a stress scenario. Time horizons: expect muted 0–30 day drift (13F lag), re-rating in 1–6 months around earnings/M&A news, and fundamentals-driven outcomes 6–24 months out. Hidden dependency: 13F lag and fund crowding can cause outsized flows at quarter boundaries.

Trade implications: Direct long CYBR exposure is justified but size and volatility must be managed — prefer staggered entries and defined‑risk option spreads; consider relative value long CYBR vs short OKTA to isolate identity vs broad IAM execution risk. Cross‑asset: tighter credit for high‑quality SaaS, higher implied vols in CYBR options; monitor implied volatility spikes >40% as a signal to sell premium.

Contrarian angles: The market may underprice integration/regulatory risk from consolidation and overprice perpetual multiple expansion — CYBR’s ~17x revenue multiple assumes sustained 40%+ subscription growth. Reaction is mixed: momentum is strong (41% 1‑yr) but exposure concentration and potential deal outcomes create asymmetric risk; similar past security consolidations produced short-term pops then multi‑quarter sideways performance during integration.

Key Decisions for Investors

• Establish a 1.5–2.5% net long position in CyberArk (CYBR) on a 6–12 month horizon, scaling in with limit buys below $440 and adding up to $500; set a hard stop of 18–20% and a price target of +25–40% (approx. $565–$635) contingent on continued ARR/margin beats.
• Deploy a defined‑risk bullish option spread: buy CYBR Jan 2026 $460 calls and sell Jan 2026 $620 calls (1:1) sized to represent 1% portfolio exposure; this captures upside from ARR momentum while capping premium outlay and limiting downside to the net debit.
• Initiate a pair trade: long CYBR (0.75–1.0% portfolio) and short OKTA (OKTA, 0.75–1.0%) for 3–9 months to isolate execution/valuation divergence; close if CYBR underperforms OKTA by >15% in 60 days or after CYBR misses ARR guidance.
• Rotate 1–2% from broad EM ETFs (EEM/EWZ) into cybersecurity/identity names (CYBR, PANW) over 30–90 days given better cash generation and margin expansion prospects; pause further purchases until the Palo Alto/CYBR transaction outcome is resolved (monitor regulatory filings and DOJ/FTC commentary over the next 30–60 days).