diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 595ede92519..ca46ecd5803 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -53,6 +53,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Possible values for Netflow's locality fields (source.locality, destination.locality and flow.locality) are now `internal` and `external`, instead of `private` and `public`. {issue}24272[24272] {pull}24295[24295]
 - Add User Agent Parser for Azure Sign In Logs Ingest Pipeline {pull}23201[23201]
 - Changes filebeat httpjson input's append transform to create a list even with only a single value{pull}25074[25074]
+- Deprecated the cyberark module (replaced by cyberarkpas). {issue}25261[25261] {pull}25505[25505]
 
 *Heartbeat*
 
diff --git a/filebeat/docs/modules/cyberark.asciidoc b/filebeat/docs/modules/cyberark.asciidoc
index 9f423f97625..bff645d0809 100644
--- a/filebeat/docs/modules/cyberark.asciidoc
+++ b/filebeat/docs/modules/cyberark.asciidoc
@@ -10,7 +10,7 @@ This file is generated! See scripts/docs_collector.py
 
 == Cyberark module
 
-experimental[]
+deprecated::[7.13.0,"This module is deprecated. Use the <<filebeat-module-cyberarkpas,CyberArk Privileged Account Security module.>>"]
 
 This is a module for receiving Cyber-Ark logs over Syslog or a file.
 
@@ -25,7 +25,7 @@ include::../include/config-option-intro.asciidoc[]
 [float]
 ==== `corepas` fileset settings
 
-experimental[]
+deprecated::[7.13.0]
 
 NOTE: This was converted from RSA NetWitness log parser XML "cyberark" device revision 124.
 
diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml
index f48c558a5d0..6e879467d6b 100644
--- a/x-pack/filebeat/filebeat.reference.yml
+++ b/x-pack/filebeat/filebeat.reference.yml
@@ -769,6 +769,8 @@ filebeat.modules:
     #var.paths:
 
 #------------------------------ Cyber-Ark Module ------------------------------
+# The cyberark module is deprecated and will be removed in future releases.
+# Please use the Cyberark Privileged Account Security (cyberarkpas) module instead.
 - module: cyberark
   corepas:
     enabled: true
diff --git a/x-pack/filebeat/module/cyberark/_meta/config.yml b/x-pack/filebeat/module/cyberark/_meta/config.yml
index fa8edd7046a..d3a1f20ec6f 100644
--- a/x-pack/filebeat/module/cyberark/_meta/config.yml
+++ b/x-pack/filebeat/module/cyberark/_meta/config.yml
@@ -1,3 +1,5 @@
+# The cyberark module is deprecated and will be removed in future releases.
+# Please use the Cyberark Privileged Account Security (cyberarkpas) module instead.
 - module: cyberark
   corepas:
     enabled: true
diff --git a/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc b/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc
index d4beae518e8..5d349be9bfe 100644
--- a/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc
@@ -5,7 +5,7 @@
 
 == Cyberark module
 
-experimental[]
+deprecated::[7.13.0,"This module is deprecated. Use the <<filebeat-module-cyberarkpas,CyberArk Privileged Account Security module.>>"]
 
 This is a module for receiving Cyber-Ark logs over Syslog or a file.
 
@@ -20,7 +20,7 @@ include::../include/config-option-intro.asciidoc[]
 [float]
 ==== `corepas` fileset settings
 
-experimental[]
+deprecated::[7.13.0]
 
 NOTE: This was converted from RSA NetWitness log parser XML "cyberark" device revision 124.
 
diff --git a/x-pack/filebeat/modules.d/cyberark.yml.disabled b/x-pack/filebeat/modules.d/cyberark.yml.disabled
index e97955adfb8..f965cde2882 100644
--- a/x-pack/filebeat/modules.d/cyberark.yml.disabled
+++ b/x-pack/filebeat/modules.d/cyberark.yml.disabled
@@ -1,6 +1,8 @@
 # Module: cyberark
 # Docs: https://www.elastic.co/guide/en/beats/filebeat/7.x/filebeat-module-cyberark.html
 
+# The cyberark module is deprecated and will be removed in future releases.
+# Please use the Cyberark Privileged Account Security (cyberarkpas) module instead.
 - module: cyberark
   corepas:
     enabled: true