Okta, a US-based identity and access management provider, announced it has agreed to acquire Permiso Security, a company specialising in detecting and mitigating threats across human, non-human, and agentic identities in multi-cloud environments. The move is intended to add identity risk signals, behavioural analytics, and threat detection capabilities to the Okta Platform, extending its offering into identity threat detection and response (ITDR).
Addressing agentic identity risk
The acquisition addresses the expansion of identity types in enterprise environments, spanning human users, non-human accounts, and AI agents. According to figures cited in the announcement, 58% of executives reported an AI-related security incident or near miss over the past year. Attackers are increasingly using post-authentication techniques to circumvent traditional access controls, a trend that has pushed identity security teams to look beyond authentication-layer defences.
Permiso's platform draws on more than 2,500 research-driven signals gathered across over 70 identity partners, covering areas such as overprivileged access, unused permissions, anomalous agent behaviour and tool usage, policy violations, and high blast-radius activity. Once integrated with Okta's identity security fabric, these capabilities are intended to help organisations address operational blind spots by extending runtime detection and response across identity types, including AI agents operating locally, on SaaS platforms, or in cloud environments.
Among the capabilities described, Okta referenced a sandbox detonation function for AI agent skills and prompts, developed under the Permiso name SandyClaw, which applies dynamic behavioural analysis and a multi-engine detection stack to identify AI supply chain attacks before they reach customer environments. The combined offering is also expected to support automated response, allowing security teams to investigate and contain compromised or misconfigured AI agents.
Expanding into security operations
The transaction extends Okta's activities beyond identity management into security operations centre (SOC) functions, an area where the company is aiming to work more closely with enterprise chief information security officers on broader SecOps challenges. Permiso's research unit, P0 Labs, is expected to add post-authentication research capacity to Okta, complementing Okta Threat Intelligence and feeding into the company's detection and hunting capabilities.
The transaction is expected to close in the third quarter of Okta's fiscal year 2027, subject to customary closing conditions. Okta stated that the transaction is not expected to affect the guidance it issued on 27 May 2026.
Terms of the transaction, including the acquisition value, were not disclosed.
