Okta Invests $200 Million to Tackle AI Identity Threats with Permiso Acquisition

Okta is stepping up its security game by acquiring Permiso Security for about $200 million in cash, according to TechCrunch. This move marks one of Okta’s biggest purchases since it snapped up Auth0 for $6.5 billion in 2021. Permiso’s technology focuses on identifying and combating threats connected to human, machine, and AI agent identities across multi-cloud environments.

The deal addresses a critical blind spot in identity security the surge of AI and non-human identities that traditional systems struggle to manage. According to the Cloud Security Alliance, the ratio of non-human identities to human ones now stands at 144 to 1. Yet, only 21% of organizations have governance programs for these identities, with AI agents growing fastest and being the least regulated.

Technology Designed for AI-Age Identity Risks

Permiso brings over 2,500 identity risk signals from more than 70 identity partners, plus behavioral analytics to spot unusual access patterns. It has developed two specialized tools for AI agents: an automated AI identity response system to investigate and contain compromised agents; and SandyClaw, a dynamic sandbox designed to detect supply chain attacks hidden in AI agent skills and prompts. SandyClaw is the first tool of its kind, aimed at preventing malicious AI payloads before they can execute.

Ely Kahn, Okta’s Chief Product Officer, explained that Permiso’s team and technology will enhance Okta’s ability to detect and respond to identity threats. The founders of Permiso, Paul Nguyen and Jason Martin, both hail from FireEye (now Trellix) and bring deep expertise in identity-based attack techniques. Their SandyClaw sandbox tackles the same supply chain risks highlighted by various security researchers, including malware hidden in fake AI skills that evade standard detection tools.

This acquisition positions Okta to better defend a rapidly evolving digital landscape where AI agents and machine identities are becoming everyday targets for cyberattacks.

Material is for informational purposes only and not financial advice.