Okta is placing a big bet that the next wave of identity threats won’t come from humans stealing passwords—but from autonomous AI agents running amok with legitimate access. The identity management giant agreed to acquire Permiso Security on Thursday in a deal valued at just under $200 million, predominantly in cash, according to a source with knowledge of the terms. The move signals that securing machine identities is no longer a niche concern; it’s becoming the main event as enterprises deploy AI agents across their infrastructure.
Permiso, which crawled out of stealth in 2022, isn’t your typical startup. Co-founded by former FireEye execs Paul Nguyen and Jason Martin, the Palo Alto-based team specializes in spotting the subtle, scary stuff that happens after a login is approved—specifically attacks that weaponize stolen or compromised credentials to pivot through cloud environments. They’ve raised roughly $29 million to date, including an $18.5 million Series A led by Altimeter Capital that reportedly valued the company at about $80 million. Okta just more than doubled that valuation.
The strategic logic is clear. Okta’s chief product officer, Ely Kahn, framed the acquisition as an extension of the company’s identity security fabric, adding what he called “proven identity threat detection and response capabilities.” The real prize, however, might be Permiso’s newer work. In April, the startup unveiled SandyClaw, a platform that analyzes AI agent skills in a sandbox to sniff out malicious behavior before deployment. That technology gets Okta into the business of not just verifying who—or what—is knocking at the door, but continuously monitoring what that entity does once it’s inside the house.
Identity has moved way beyond the login screen. If a finance AI agent suddenly tries to access a code repository at 3 a.m., that’s not a user problem—it’s an identity problem. Okta is betting you’ll pay them to catch it. The deal is expected to close in Q3 of fiscal 2027.
