Your last paycheck said Palo Alto Networks. Your LinkedIn still says CyberArk. The termination email came from an HR address you had never seen. If you are one of the roughly 500 people cut from CyberArk in the weeks after the $25B close, you are now an "acquisition orphan," and your resume has a problem no generic layoff template solves.
Who counts as an acquisition orphan in the 2026 cut cycle
An acquisition orphan is a laid-off employee whose payroll employer, LinkedIn employer, and job-target keyword all disagree because the layoff hit before the post-merger rebrand finished. Three deals in the last nine months created the bulk of the current pool.
- Palo Alto Networks / CyberArk: roughly 500 of ~4,000 CyberArk staff cut within weeks of the $25B close, with notice periods running 3 to 12 months.
- Sanofi / Blueprint Medicines: 229 Blueprint workers cut on WARN, with departures staggered Oct. 9, 2026 through late June 2027, following the $9.1B July 2025 deal.
- eBay / Depop: ~800 roles (6% of eBay's 12,300) cut one week after the $1.2B Depop announcement, before the deal even closed.
The tell is that termination notifications for CyberArk staff came directly from Palo Alto Networks, not CyberArk. The last employment communication arrived from a company the recipient had never technically worked for. That single fact is the mechanism behind every downstream resume problem: ATS filters, background-check mismatches, and the recruiter question "so who did you actually work for?"
The immediate US and Israel universe now reconciling "CyberArk" vs "Palo Alto Networks" on their resumes over the next 12 months.
Why the CyberArk layoff is the template case
The CyberArk layoff is the template because it combines a public CEO reversal, a nested prior acquisition (Venafi), and a targeted cut of exactly the functions where employer brand carries the most weight on a resume. Every downstream case in 2026 will rhyme with it.
CEO Nikesh Arora said in December that integration "shouldn't affect most of the organization," explicitly ruling out "10% or 20% cuts." Two months later, roughly 12.5% of CyberArk was gone. Palo Alto Networks confirmed that no layoffs were planned in R&D and that the reductions focused on overlapping roles. Translation: if you were in sales, marketing, customer success, HR, legal, finance, or G&A, you were the target.
That function skew matters because employer recognition matters more in go-to-market roles than in engineering. A backend engineer can list "Palo Alto Networks" and get through. A field CISO or channel manager whose entire book of business was built under the CyberArk brand loses their most searchable keyword the moment they rewrite the header.
The Venafi problem
Some CyberArk alumni were already carrying a nested acquisition. Venafi was acquired by CyberArk and still shows up in the alumni index as "Venafi, a CyberArk Company." Those people now face a three-name resume: Venafi to CyberArk to Palo Alto Networks. Every ATS and every recruiter interprets that differently. This is exactly the friction Refolk handles: paste the posting, and Refolk rewrites the resume against the specific employer string the job actually searches for.
How many orphans are actually out there
Refolk's index of professional profiles gives a concrete size for each of the three orphan pools, plus a signal of how far each rebrand has already spread.
| Deal | Acquired co. pre-deal headcount | Layoff count | % of acquired co. cut |
|---|---|---|---|
| Palo Alto / CyberArk ($25B, Feb 2026) | ~4,000 | ~500 | ~12.5% |
| Sanofi / Blueprint ($9.1B, July 2025) | 682 | 229 | ~33.6% |
| eBay / Depop ($1.2B, Feb 2026) | 12,300 (eBay total) | ~800 | 6.5% of combined |
In Refolk's index, 2,477 professionals across the US and Israel currently list CyberArk in their profile keywords. That is the searchable alumni universe now reconciling their employer field. For Blueprint, the index shows 312 professionals, of whom only 17 currently list a Blueprint or "Blueprint Medicines a Sanofi Company" employer. That means ~95% of the alumni universe has already renamed, departed, or lagged, and recruiters searching "Blueprint Medicines" as a keyword string are effectively searching an archive.
The practical implication: if you were at Blueprint and you drop the Blueprint name in favor of "Sanofi," you disappear from every recruiter search still running against the old keyword. If you keep only "Blueprint," you disappear from every search calibrated to the new one.
How to list an acquired company on your resume without triggering ATS filters
The safest structure is a dual-keyword employer line that names both the acquirer and the acquired entity in the same string, with a dated parenthetical. This doubles keyword surface area without lying.
Use this pattern in your employer field:
- Palo Alto Networks (via CyberArk acquisition, Feb 2026)
- Sanofi (Blueprint Medicines, acquired July 2025)
- eBay (Depop, Etsy spinout acquisition, Feb 2026)
Three reasons this works:
- ATS keyword hedge. Older applicant tracking systems can require exact keyword matches. A posting asking for "CyberArk PAM experience" hits the legacy name. A posting from a competitor targeting Palo Alto Networks alumni hits the new one. Both fire from the same line.
- Background-check preemption. Background and credit checks will surface the parent-company name from payroll records. When the resume already names it, the checker's report matches the resume. When it does not, per standard hiring guidance, "it sends up a red flag for your potential employer."
- Recruiter narrative compression. The date parenthetical answers the "who did you actually work for?" question in five words instead of a phone-screen tangent.
For nested cases like Venafi, chain the parenthetical: Palo Alto Networks (via CyberArk, acq. Feb 2026; Venafi, acq. by CyberArk). It reads long but hits every legacy keyword a recruiter or ATS might have configured.
Your last paycheck said Palo Alto Networks. Your LinkedIn still says CyberArk. Both need to be true on your resume.
The paperwork-mismatch problem long severance creates
Long notice periods and staggered exit dates force a resume that has to be true in three tenses at once, because W-2 employer, LinkedIn status, and email signature will disagree for months. Ignore this and background checks will flag the file.
Notice periods for the CyberArk cut range from 3 to 12 months plus several months of salary. Blueprint's WARN filing runs from Oct. 9, 2026 through late June 2027, an eight-month tail. That means thousands of orphans will be actively interviewing while technically still employed by the acquirer.
Handle it explicitly:
- Resume employer line: use the dual-keyword format above with an end date matching the actual last day, not the announcement date.
- LinkedIn: flip "Open to Work" on, but keep the current employer field showing the acquirer through the true termination date. Add a headline note like "Palo Alto Networks (CyberArk) role concluding Q2 2026."
- Cover letter and interviews: name the notice-period end date once, plainly. "My CyberArk role concludes on [date] as part of the Palo Alto Networks integration."
- Background-check prep: ask outgoing HR (Palo Alto Networks' HR, not CyberArk's, for CyberArk alumni) for the exact employer string they will confirm to verifiers. Match it on the resume verbatim.
The senior-leader-exit-first pattern and how to use it
If you were mid-level at an acquired company, the most powerful narrative on your resume points to the senior leaders who left before you. It converts "I got cut" into "I was in a cohort that saw this coming."
Blueprint's public roster of pre-layoff senior exits is a case study:
- Kate Haviland, former Blueprint CEO, now board chair at GC Therapeutics
- Percy Carter, former Blueprint CSO, joined Pfizer
- Philina Lee, former Blueprint CCO, now CEO at AdvanCell
All three left before the 229-person mass layoff. If you were on Haviland's leadership team, name her once in your cover letter as context. It signals you are not shopping a layoff story, you are shopping a leadership-diaspora story. Recruiters read those differently.
For CyberArk staff, the equivalent move is citing Arora's December quote directly. "In December, Palo Alto Networks' CEO publicly ruled out '10% or 20% cuts.' The February reduction affected roughly 12.5% of CyberArk staff, including my role." It is factual, it is dated, and it moves the conversation from "why you?" to "what's next?" Refolk drafts this cover-letter paragraph automatically from your history and the posting, so you are not writing it 40 times.
The function-specific rewrite: GTM vs R&D
The rewrite differs by function because Palo Alto Networks, Sanofi, and eBay all protected R&D and cut the go-to-market side. That skews the orphan pool toward roles where employer brand carries more resume weight.
| Function | Keyword risk | Primary rewrite move |
|---|---|---|
| Enterprise sales / channel | Losing "CyberArk PAM" or "Ayvakit" as a search hit | Keep legacy product names in bullets; dual-name the employer |
| Marketing / demand gen | Campaign attribution tied to legacy brand | List campaigns by product name, not company name |
| Customer success | Book-of-business named to old entity | Cite ARR retained through the transition, not raw logos |
| HR / legal / finance | Generic titles blur across acquirer and acquired | Add a one-line "scope" bullet naming the acquired entity |
| R&D / engineering | Lowest risk; product names carry | Standard dual-name line; no other change needed |
The cleanest test: search the exact string you plan to use as your employer field in Google, in quotes. If it returns fewer than 10 results, no ATS is calibrated for it and no recruiter is searching for it. Rewrite until you land on a string that already exists in the wild.
229 layoffs against a 682-person pre-deal headcount, with exits staggered from Oct 2026 through June 2027.
What to do this week
- Rewrite the employer line to the dual-keyword format for every role at an acquired company, not just the most recent one.
- Confirm the exact employer string outgoing HR will verify on background checks and match it verbatim.
- Update LinkedIn's current-employer field to the acquirer, but keep a legacy-brand mention in the headline or About section for search parity.
- Draft one cover-letter paragraph naming the CEO quote or senior-leader-exit pattern relevant to the deal.
- For each posting, tune the employer string to the specific keyword the job description uses. This is the exact per-posting rewrite Refolk handles: paste the job, get the resume back tailored to how that hiring team actually searches.
FAQ
How do I list CyberArk on my resume now that Palo Alto Networks acquired it?
Use a dual-keyword employer line: "Palo Alto Networks (via CyberArk acquisition, Feb 2026)." That format hits both keyword strings for ATS filters, matches whatever payroll name a background check will surface, and answers the recruiter's implicit "who employed you?" question without a phone-screen tangent. Keep legacy product names like "CyberArk PAM" or "Venafi" in the bullets, since those are still the terms buyers and hiring managers search.
Should I remove Blueprint Medicines from my resume now that Sanofi owns it?
No. In Refolk's index, only 17 of 312 Blueprint-tagged professionals currently list a Sanofi-branded employer, meaning most recruiter searches calibrated to the old name still work. Use "Sanofi (Blueprint Medicines, acquired July 2025)" so you appear in searches for both. Dropping the Blueprint name entirely erases you from the alumni network that hiring managers in Cambridge biotech still recruit from.
What do I say in interviews about being laid off right after the acquisition?
Name the deal, name the date, and cite one public fact. For CyberArk alumni, that is Nikesh Arora's December statement ruling out "10% or 20% cuts" before roughly 12.5% of CyberArk was reduced. That reframes the story from personal performance to a documented leadership reversal that hit an overlapping function. Then move fast to what you built and what you want next.
How do I handle background checks when my notice period runs six months into my job search?
Tell the truth on the resume and match it on the check. Ask HR for the exact employer name, title, and dates they will confirm to verifiers, and use that string verbatim on the resume and LinkedIn. If a Palo Alto Networks role concludes in Q3 2026 but interviews start in Q1, list an end date of "Present" with a footnote that the role concludes on the actual termination date. Background-check flags come from mismatches, not from long tails.