Okta on Thursday announced it has agreed to acquire Permiso Security, an AI identity security startup, in a deal valued at just under $200 million, according to a source familiar with the transaction. The acquisition marks Okta's latest effort to expand its identity management platform beyond traditional user authentication and into the rapidly growing field of protecting AI agents, machine identities, and cloud-era security threats.

While Okta did not disclose the financial terms, the source said the deal is structured as an almost all-cash transaction. An Okta spokesperson did not dispute the $200 million figure when questioned by the press, though the company declined to comment on specific terms. The acquisition is expected to close in the third quarter of Okta's fiscal 2027, subject to customary closing conditions.

Why Okta Is Buying Permiso

Okta's move comes as identity management companies face increasing pressure to evolve from a model based on verifying users at the login gate to one that continuously monitors behavior across applications, workloads, and increasingly autonomous AI agents. Enterprises are deploying AI systems that can act independently, creating new categories of non-human identities that require security oversight. Permiso's technology is designed to address exactly this problem: it helps security teams detect suspicious activity in cloud environments after a user, application, or AI agent has gained authorized access.

The deal strengthens Okta's push into securing AI agents and other machine identities, a segment that analysts expect to grow rapidly in the coming years. By integrating Permiso's identity threat detection and response (ITDR) capabilities, Okta aims to offer customers a more complete security fabric that protects both human and machine identities across their entire digital estate.

Permiso's Technology and Background

Permiso emerged from stealth in 2022 and has quickly built a reputation for specializing in detecting attacks that use stolen or compromised identities to move laterally through cloud infrastructure. The company was co-founded by Paul Nguyen and Jason Martin, both of whom previously held senior positions at FireEye, a well-known cybersecurity firm. Their experience in threat research and incident response is reflected in Permiso's core platform, which continuously analyzes identity behavior in cloud and SaaS environments to flag anomalies that might indicate a breach.

More recently, Permiso expanded its platform to cover AI agents and machine identities. In April 2026, the startup introduced SandyClaw, a platform designed to analyze the skills and capabilities of AI agents in a sandboxed environment before they are deployed. This allows security teams to identify malicious or unintended behaviors before an agent is granted access to production systems. This feature is particularly relevant as organizations begin to deploy AI agents for tasks ranging from customer support to data analysis and even automated software development.

Permiso's technology is complementary to Okta's existing identity security offerings. Okta has traditionally focused on identity and access management, but in recent years has been building out its security capabilities with products like Okta Identity Threat Protection and Okta Security Insights. The addition of Permiso's ITDR platform will allow Okta to offer continuous post-authentication monitoring, helping customers detect and respond to threats that might otherwise go unnoticed until after a breach has occurred.

Market Context: The Race to Secure Machine Identities

The acquisition comes amid a broader industry shift toward securing machine identities, a category that includes API keys, service accounts, OAuth tokens, and AI agent identities. According to cybersecurity researchers, machine identities now vastly outnumber human identities in most large enterprises, creating a massive attack surface for cybercriminals. Stolen machine credentials can allow attackers to move through networks undetected, because they often have high levels of access and are not subject to the same monitoring as human users.

Several major security vendors have made moves to address this challenge. Okta's acquisition of Permiso follows a series of similar deals in the identity security space. The market has seen increased M&A activity as companies scramble to add AI-specific security capabilities to their portfolios. This deal also signals that traditional identity providers are betting heavily on the idea that AI agents will become a permanent and widespread part of enterprise operations, and that securing those agents will be a critical requirement.

Permiso raised approximately $29 million in venture funding prior to this acquisition, including an $18.5 million Series A round in April 2024 led by Altimeter Capital. People familiar with that financing said the Series A valued the Palo Alto-based startup at about $80 million on a post-money basis. The acquisition price of nearly $200 million represents a significant return for Permiso's investors, who saw the company grow quickly as demand for AI security solutions surged.

Okta's Strategic Direction

Okta's CEO Todd McKinnon has been vocal about the importance of expanding beyond enterprise single sign-on. Under his leadership, the company has invested heavily in identity security, governance, and machine identity management. The Permiso acquisition is one of Okta's largest in recent years and demonstrates a clear commitment to staying ahead of the curve as AI adoption accelerates.

In a prepared statement, Okta's chief product officer, Ely Kahn, said: “Permiso will extend Okta’s identity security fabric with proven identity threat detection and response capabilities, and an incredible threat research and security team that will advance Okta’s threat detection and prevention capabilities.” This comment highlights the dual value Okta sees in Permiso: the technology itself, and the team behind it. Permiso's co-founders and engineers bring deep expertise in threat research that could be valuable to Okta's broader security roadmap.

Industry analysts note that Okta has been lagging in some areas of security compared to competitors like Microsoft and CrowdStrike, which have made significant strides in identity threat protection. The Permiso acquisition could help close that gap, particularly in the area of AI agent security where there is no established leader yet. By moving early, Okta has an opportunity to define the market for AI identity security and establish its platform as the go-to solution for enterprises deploying AI agents.

What It Means for Enterprises

For Okta's customers, the deal will likely lead to new capabilities that help secure AI agents and other machine identities. As enterprises integrate AI into their operations, they need visibility into what these agents are doing, what data they are accessing, and whether their behavior is anomalous. Permiso's technology provides this visibility through continuous monitoring and behavior analysis.

Enterprises are already experimenting with AI agents for a wide range of tasks, but many are reluctant to fully deploy them without adequate security controls. The acquisition could make Okta customers feel more confident in deploying AI agents knowing that they have a security platform that can monitor those agents in real time. This is crucial because AI agents often operate autonomously and may have access to sensitive systems or data, making them attractive targets for attackers.

Furthermore, Permiso's threat research team and the SandyClaw sandboxing technology will allow security teams to test AI agents before deploying them. This proactive approach is more effective than simply trying to detect malicious behavior after the fact. By integrating these capabilities into Okta's identity platform, the company aims to offer a comprehensive solution that covers the entire lifecycle of an AI agent, from pre-deployment testing to ongoing monitoring and incident response.

Timeline and Expectations

Okta expects the transaction to close in the third quarter of fiscal 2027, which corresponds to the end of its fiscal year. Given the relatively low regulatory scrutiny for a deal of this size, the closing is expected to proceed smoothly. Okta said the acquisition is subject to customary closing conditions, including regulatory approvals.

Once the deal closes, Permiso's team is expected to join Okta, and its products will be integrated into Okta's Identity Security Cloud. Okta will likely continue to support Permiso's existing customers, and over time, the technology will become available to all Okta customers. The company has not yet announced pricing or packaging details for the new capabilities, but it is likely that they will be offered as add-on modules to existing Okta plans.

The acquisition also sends a message to the broader market that Okta is serious about AI security. In the coming months, we may see more M&A activity in this space as competitors look to build or buy similar capabilities. For now, Okta has taken a significant step toward differentiating itself at a time when many identity management vendors are scrambling to catch up with the rapid evolution of the threat landscape.

Ultimately, the deal reflects a growing recognition that security and identity are inseparable in the age of AI. As machine identities proliferate, organizations need tools that can understand and protect them just as effectively as they protect human users. With Permiso under its wing, Okta aims to lead that charge.

Source: TechCrunch News