Okta to acquire Permiso for cloud-native identity threat tools

Okta, an identity and access management company, has agreed to acquire Permiso Security, a California-based provider of cloud-native identity security tools, for an undisclosed price.

Permiso provides detection and mitigation for threats involving human, non-human, and agentic identities across multi-cloud settings.

Okta plans to add Permiso’s risk detection signals, behavioural analytics, and threat response tools to its own identity platform. The company said these capabilities will enable customers to identify identity-based risks more quickly, remediate vulnerabilities, and address excessive permissions.

Both companies have identified challenges as identity types proliferate in enterprise environments. Okta referenced data showing 58% of executives reported an AI-focused security event or near miss within the last year.

The company noted that attackers are increasingly using post-authentication methods to move through enterprise systems, bypassing conventional defences. This evolving landscape, Okta said, requires a coordinated approach to identity security.

Okta chief product officer Ely Kahn said: “We’re thrilled to welcome Permiso to Okta as we help companies secure their agentic enterprises where humans, applications, service accounts, and AI agents work together.

“Permiso will extend Okta’s identity security fabric with proven identity threat detection and response capabilities, and an incredible threat research and security team that will advance Okta’s threat detection and prevention capabilities.”

Permiso’s technology uses more than 2,500 security signals drawn from over 70 identity-focused partners to monitor for a variety of risks. These include overprivileged access, unused permissions, abnormal behaviour by agents, policy violations, and actions with high potential impact.

Its tools locate and respond to these threats in real time. Okta intends to use these features to extend runtime identity detection and response across all identity types, including AI agents and machine identities.

Okta’s integration plans involve combining Permiso’s detection data with its existing identity fabric. The company described how this will allow continuous monitoring of risky behaviour from various sources, including locally running AI agents, cloud-based services, machine credentials, and privileged user accounts.

Among Permiso’s features is SandyClaw, which functions as a dynamic sandbox for AI agent skills and prompts. It analyses agent activity using behavioural techniques and a multi-engine detection framework. According to Okta, this solution identifies attacks targeting AI supply chains before they affect customer systems.

Permiso’s automated response capability enables security teams to contain misconfigured or compromised AI agents in real time. Okta stated this could lower the risk of unauthorised access or agent misuse.

Permiso co-founder Jason Martin said: “Everything we’ve built at Permiso has been driven by one goal: helping customers stay ahead of identity-based threats in an increasingly complex security landscape.

“Joining the leading, neutral identity provider means that work now reaches far more organisations than we could have on our own.”

Permiso’s P0 Labs unit will become part of Okta’s research operation, offering intelligence on suspicious post-authentication activity. Okta said this will enhance its platform’s detection, investigation, and threat hunting functions.

Insights from Permiso will also inform the future development of Okta’s identity security roadmap and strengthen detection across the identity lifecycle.

The transaction is scheduled to close in the third quarter of Okta’s fiscal year 2027, subject to customary conditions.

Earlier this month, Okta announced new products for securing AI agents. These enable organisations to manage agent-to-agent connections, control access privileges in real time, and review agent activity.

The company said its platform will support registration, discovery, and governance of AI agents, while enforcing least-privilege access principles and deactivating rogue entities.