Okta acquires Permiso for ~$200M to secure AI agents and non-human identities
The identity-management giant is buying Permiso to add threat detection for AI agents and other non-human identities proliferating across enterprise cloud environments.
What matters
- Okta is acquiring AI security startup Permiso for approximately $200 million, per a source.
- The deal adds identity threat detection capabilities for AI agents and non-human identities in cloud environments.
- Non-human identity security is becoming critical as enterprises deploy AI agents with broad access permissions.
- The acquisition reflects ongoing consolidation in the identity and access management market.
- Integration details, official pricing, and product roadmap have not yet been disclosed.
Funding facts
- Amount:
- ~$200 million
- Round:
- acquisition
What happened
Okta, the identity and access management company, is acquiring Permiso, an AI security startup, for approximately $200 million, according to a source cited by TechCrunch. The deal gives Okta identity threat detection capabilities aimed at a rapidly expanding problem: securing AI agents and other non-human identities that now operate across enterprise cloud environments.
Permiso has focused on detecting threats tied to non-human identities — the API keys, service accounts, machine credentials, and increasingly AI agents that authenticate and move through cloud infrastructure. By bringing Permiso's technology in-house, Okta positions itself to extend its core identity platform beyond human users to the sprawling set of automated and AI-driven workloads that enterprises are deploying.
The reported price tag of roughly $200 million signals a meaningful but not blockbuster acquisition — consistent with Okta's strategy of adding targeted capabilities through tuck-in deals rather than transformational mergers.
Why it matters
The identity landscape is shifting fast. For years, identity management was primarily about people — employees, contractors, customers — logging into applications. But the rise of cloud-native architectures and now AI agents has created an explosion of non-human identities that often operate with broad permissions and minimal oversight.
AI agents, in particular, represent a new category of identity risk. These autonomous or semi-autonomous systems can authenticate, access data, call APIs, and chain together actions across multiple services — sometimes with credentials that are over-privileged or poorly monitored. Traditional identity tools built for human login flows are not designed to detect when an AI agent's behavior pattern shifts in ways that suggest compromise or misuse.
Okta's acquisition of Permiso is a direct response to this gap. Enterprises deploying AI agents need the same kind of threat detection and anomaly monitoring for those agents that they have long expected for human users. By integrating Permiso's detection capabilities, Okta can offer a more complete identity security story that spans both human and non-human actors.
The deal also reflects broader consolidation in the security market, where large platform vendors are acquiring specialized startups to fill capability gaps rather than building from scratch. Identity has become one of the most active areas for M&A as vendors race to cover the full spectrum of access, authentication, and threat detection.
What to watch
Several questions remain. Okta has not yet detailed how Permiso's technology will be integrated into its platform or when customers can expect new features. The acquisition price has not been officially confirmed by Okta — it comes from a single source — so the final terms could differ. It is also unclear whether Permiso's existing customer base will be migrated to Okta's platform or whether the product will continue to operate independently in the near term.
Watch for Okta's next earnings call or product announcement for more detail on integration plans and pricing. Also watch how competitors in the identity space — such as Microsoft Entra, CyberArk, and Saviynt — respond, as the non-human identity market is heating up quickly.
What to do next
Developers
Audit the non-human identities — API keys, service accounts, and agent credentials — in your cloud environments and map which ones have access to sensitive resources.
As Okta and others build tooling for non-human identity threats, developers should understand their current exposure to over-privileged machine and AI agent credentials.
Founders
Evaluate whether your startup's security roadmap accounts for AI agent identity management, and consider partnerships or integrations with identity platforms like Okta early.
Large identity vendors are actively acquiring capabilities in this space, and startups that build complementary non-human identity tooling may become acquisition targets.
PMs
Review your product's authentication and authorization model to ensure it can handle non-human identities and AI agent access patterns, not just human user logins.
The Permiso acquisition signals that identity platforms are shifting to cover AI agents; PMs should ensure their roadmaps reflect this trend.
Investors
Track M&A activity in the non-human identity and AI agent security segment, as large platform vendors are acquiring specialized startups to fill capability gaps.
Okta's ~$200M Permiso deal is part of a broader consolidation pattern in identity security, and similar tuck-in acquisitions are likely across the sector.
Operators
Inventory all AI agents and automated workloads running in your environment and verify that each has least-privilege credentials and monitoring in place.
Non-human identities often operate with broad permissions and minimal oversight; as threat detection tools mature, operators should prepare by establishing baseline visibility now.
Testing notes
Caveats
- This is an acquisition announcement, not a product release. Permiso's capabilities are not yet integrated into Okta's platform, and no new features are available to test.