diff --git a/CHANGELOG.next.asciidoc b/CHANGELOG.next.asciidoc
index 5d5b61cf588..5fe9a0c5b49 100644
--- a/CHANGELOG.next.asciidoc
+++ b/CHANGELOG.next.asciidoc
@@ -108,6 +108,7 @@ https://github.com/elastic/beats/compare/v7.0.0-alpha2...master[Check the HEAD d
 - Changes filebeat httpjson input's append transform to create a list even with only a single value{pull}25074[25074]
 - Change logging in logs input to structure logging. Some log message formats have changed. {pull}25299[25299]
 - All url.* fields apart from url.original in the Apache, Nginx, IIS, Traefik, S3Access, Cisco, F5, Fortinet, Google Workspace, Imperva, Microsoft, Netscout, O365, Sophos, Squid, Suricata, Zeek, Zia, Zoom, and ZScaler modules are now url unescaped due to using the Elasticsearch uri_parts processor. {pull}24699[24699]
+- Deprecated the cyberark module (replaced by cyberarkpas). {issue}25261[25261] {pull}25505[25505]
 
 *Heartbeat*
 
diff --git a/filebeat/docs/modules/cyberark.asciidoc b/filebeat/docs/modules/cyberark.asciidoc
index 9f423f97625..bff645d0809 100644
--- a/filebeat/docs/modules/cyberark.asciidoc
+++ b/filebeat/docs/modules/cyberark.asciidoc
@@ -10,7 +10,7 @@ This file is generated! See scripts/docs_collector.py
 
 == Cyberark module
 
-experimental[]
+deprecated::[7.13.0,"This module is deprecated. Use the <<filebeat-module-cyberarkpas,CyberArk Privileged Account Security module.>>"]
 
 This is a module for receiving Cyber-Ark logs over Syslog or a file.
 
@@ -25,7 +25,7 @@ include::../include/config-option-intro.asciidoc[]
 [float]
 ==== `corepas` fileset settings
 
-experimental[]
+deprecated::[7.13.0]
 
 NOTE: This was converted from RSA NetWitness log parser XML "cyberark" device revision 124.
 
diff --git a/x-pack/filebeat/filebeat.reference.yml b/x-pack/filebeat/filebeat.reference.yml
index 35c7c4930e0..26be5f65635 100644
--- a/x-pack/filebeat/filebeat.reference.yml
+++ b/x-pack/filebeat/filebeat.reference.yml
@@ -769,6 +769,8 @@ filebeat.modules:
     #var.paths:
 
 #------------------------------ Cyber-Ark Module ------------------------------
+# The cyberark module is deprecated and will be removed in future releases.
+# Please use the Cyberark Privileged Account Security (cyberarkpas) module instead.
 - module: cyberark
   corepas:
     enabled: true
diff --git a/x-pack/filebeat/module/cyberark/_meta/config.yml b/x-pack/filebeat/module/cyberark/_meta/config.yml
index fa8edd7046a..d3a1f20ec6f 100644
--- a/x-pack/filebeat/module/cyberark/_meta/config.yml
+++ b/x-pack/filebeat/module/cyberark/_meta/config.yml
@@ -1,3 +1,5 @@
+# The cyberark module is deprecated and will be removed in future releases.
+# Please use the Cyberark Privileged Account Security (cyberarkpas) module instead.
 - module: cyberark
   corepas:
     enabled: true
diff --git a/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc b/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc
index d4beae518e8..5d349be9bfe 100644
--- a/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc
+++ b/x-pack/filebeat/module/cyberark/_meta/docs.asciidoc
@@ -5,7 +5,7 @@
 
 == Cyberark module
 
-experimental[]
+deprecated::[7.13.0,"This module is deprecated. Use the <<filebeat-module-cyberarkpas,CyberArk Privileged Account Security module.>>"]
 
 This is a module for receiving Cyber-Ark logs over Syslog or a file.
 
@@ -20,7 +20,7 @@ include::../include/config-option-intro.asciidoc[]
 [float]
 ==== `corepas` fileset settings
 
-experimental[]
+deprecated::[7.13.0]
 
 NOTE: This was converted from RSA NetWitness log parser XML "cyberark" device revision 124.
 
diff --git a/x-pack/filebeat/modules.d/cyberark.yml.disabled b/x-pack/filebeat/modules.d/cyberark.yml.disabled
index b4a887b686f..833a92645b1 100644
--- a/x-pack/filebeat/modules.d/cyberark.yml.disabled
+++ b/x-pack/filebeat/modules.d/cyberark.yml.disabled
@@ -1,6 +1,8 @@
 # Module: cyberark
 # Docs: https://www.elastic.co/guide/en/beats/filebeat/master/filebeat-module-cyberark.html
 
+# The cyberark module is deprecated and will be removed in future releases.
+# Please use the Cyberark Privileged Account Security (cyberarkpas) module instead.
 - module: cyberark
   corepas:
     enabled: true