Okta bets nearly $200M on Permiso to secure AI and machine identities

Okta agreed on Thursday to acquire Permiso Security, an identity threat detection startup, in a transaction valued at just under $200 million. The undisclosed deal is structured as an almost entirely cash purchase and is expected to close in Okta’s fiscal third quarter of 2027, subject to customary conditions.

Identity security is moving beyond login

Enterprises increasingly allow applications, service accounts and autonomous AI agents to act inside cloud environments. Verifying them at login is no longer sufficient: security teams must continuously monitor what each identity does after access has been granted.

This shift expands the attack surface because compromised credentials can let an intruder move through cloud infrastructure while appearing legitimate. The same pressure is reshaping access management for the age of AI agents, with businesses seeking controls designed for autonomous software rather than human users alone.

What Permiso adds to Okta

Permiso emerged from stealth in 2022 and specializes in identifying suspicious post-authentication behavior. Founded by former FireEye executives Paul Nguyen and Jason Martin, the company detects attacks that rely on stolen or compromised identities to navigate cloud systems.

The startup later extended its platform to AI agents and other machine identities. In April, it introduced SandyClaw, which analyzes AI-agent skills in a sandbox to identify malicious behavior before deployment.

“Permiso will extend Okta’s identity security fabric with proven identity threat detection and response capabilities, and an incredible threat research and security team that will advance Okta’s threat detection and prevention capabilities,” Okta chief product officer Ely Kahn said.

Funding and transaction context

Permiso has raised about $29 million. Its financing included an $18.5 million Series A led by Altimeter Capital in April 2024, when the Palo Alto company was valued at approximately $80 million post-money. Okta declined to disclose the acquisition price; its spokesperson did not dispute the near-$200 million figure but would not discuss the terms.

For businesses deploying AI agents, the practical requirement is to treat every agent as a privileged identity with defined permissions, behavioral monitoring and rapid revocation. Authentication remains necessary, but continuous detection after access is becoming the decisive control.