Why One Firm Exited $11 Million CyberArk Stake as Stock Rallied 44% Over the Past Year

G2 Investment Partners fully liquidated its 27,578-share CyberArk stake in Q3, reducing its reportable portfolio by an estimated $11.2 million per the Nov. 14 SEC filing as the manager rebalances a concentrated small-/mid-cap growth book. CyberArk trades near $458.59 (market cap ~$23.1B) after reporting strong growth—Q3 revenue $342.8M (+43% YoY), record net new ARR $68M and total ARR $1.34B (+45% YoY)—despite a TTM net loss of $226.9M; the company is also subject to a pending Palo Alto Networks acquisition. The sale appears driven by portfolio positioning rather than company weakness and is unlikely to be market-moving given the size of the holding relative to CYBR’s market capitalization.

Analysis

Market structure: G2’s 27,578-share exit (~$11.2M) is immaterial versus CYBR’s $23.1B market cap but signals active fund rotation away from large winners into smaller mid-cap ideas; that rotation can temporarily amplify flows into names like DAVE, PACK and TSEM while removing a marginal block of sell-side supply in CYBR. The pending Palo Alto Networks (PANW) acquisition is the dominant structural story: a successful close reduces free float, concentrates identity-security capability under a larger OEM, and increases cross-sell leverage across endpoint/cloud portfolios.

Competitive dynamics & supply/demand: consolidation improves PANW’s pricing power and cross-sell economics (expect mid-single-digit margin upside over 12–24 months from badge engineering and ARR bundling). On a supply/demand axis, short-term implied-volatility on CYBR/options should compress after deal clarity; equity flows will favor scale players (PANW, CRWD) while pure-play IAM/mid-cap vendors face rerating risk if forecasts don’t show >30% ARR growth.

Risk assessment: tail risks include a DOJ/FTC antitrust challenge or deal collapse (outcome could drive CYBR >30% lower in 3–12 months) and integration execution causing ARR churn or renewal compression. Near-term (days–weeks) volatility is event-driven (earnings, deal notices); medium-term (3–12 months) risk centers on regulatory signoffs and Q4 ARR/renewal prints; long-term (12+ months) upside depends on cross-sell capture and AI-driven security budgets.

Trade implications & catalysts: actionable catalysts are CYBR quarterly ARR releases, any formal deal terms/definitive agreement, and antitrust filings over the next 60–180 days. Merger-arb mechanics will dominate CYBR’s risk-return until closing; broader sector rotation favors large-cap cyber vendors and hardware/software integrators (PANW) over standalone mid-cap pure-play identity suppliers unless they demonstrate >30% ARR growth sustained for 4+ quarters.

Key Decisions for Investors

• Merger-arb conditional: if a definitive PANW takeout price is announced, consider establishing a merger-arbitrage long position in CYBR sized 1–3% NAV when the spread implies an annualized IRR >6%; hedge delta/stock-for-stock deal exposure by shorting PANW at the announced exchange ratio. Target horizon 6–12 months; unwind if spread compresses to <1% or regulatory action is filed.
• Tactical directional: establish a 2–3% long position in PANW on any pullback >5% within the next 3 months to play cross-sell and AI-security demand; take profits at +20% or reduce to half position if PANW issues negative integration guidance or if DOJ/FTC files suit within 90 days.
• Pairs/short: initiate a 1–2% short position in a pure-play mid-cap IAM name with <20% ARR growth (e.g., peer OKTA or similar) versus a 2% long in PANW for 3–9 months to capture consolidation-led rerating; size defensively and cover if peers report accelerating net-new ARR >25% quarter-over-quarter.
• Options event hedge: buy a 3-month CYBR put spread (buy 1 near-ATM put, sell 1 further OTM) sized 0.5–1% NAV to protect against a deal failure or adverse regulatory outcome; alternatively buy a 6-month PANW call spread (defined-risk) if implied vol cheapens after weak headlines.