Okta Acquires AI Security Startup Permiso for ~$200M to Tackle Non-Human Identity Threats

Okta has acquired Permiso, an AI-focused cloud security startup, for approximately $200 million. The deal bolsters Okta's identity threat detection capabilities at a time when enterprises are scrambling to secure AI agents and non-human identities across complex cloud environments.

Okta has acquired Permiso, a cloud identity security startup, for approximately $200 million, according to a source familiar with the deal. The acquisition signals how seriously enterprise software vendors are treating the security risks introduced by AI agents, service accounts, and other non-human identities that now proliferate across modern cloud infrastructure.

What Permiso Does

Founded in 2021, Permiso specializes in identity threat detection and response (ITDR) — specifically tracking and securing non-human identities like API keys, OAuth tokens, service accounts, and increasingly, AI agents. These identities often fly under the radar of traditional security tooling, which was designed primarily for human users.

Permiso's platform monitors behavior across cloud environments — AWS, Azure, Google Cloud, Snowflake, and others — to detect anomalous activity tied to these machine identities. As enterprises deploy more autonomous AI systems that authenticate and act independently, the attack surface expands dramatically.

Why This Matters for Okta

Okta's core business is identity — managing who (and what) has access to enterprise systems. But the company has faced pressure to move beyond credential management into active threat detection as the identity layer becomes the primary target for attackers.

Non-human identities now outnumber human ones by an estimated 45-to-1 in many enterprise environments, according to industry research. Securing them requires continuous behavioral monitoring, not just provisioning and access control — exactly what Permiso brings to the table.

The acquisition lets Okta offer a more complete security story to CISOs who are grappling with AI agent governance: How do you know what your AI systems are doing, what data they're accessing, and whether they've been compromised or manipulated?

Strategic Timing

The deal comes as agentic AI moves from pilot projects to production deployments across Fortune 500 companies. Enterprises are standing up AI agents that autonomously browse the web, query databases, call APIs, and execute workflows — all using credentials that need to be issued, monitored, and revoked.

This has created a new category of security urgency. Competitors are moving fast:

CrowdStrike has been investing heavily in identity threat detection through its Falcon Identity Protection suite
SentinelOne acquired PingSafe in early 2024, partly to address cloud identity risks
Microsoft continues to deepen Entra ID's threat detection capabilities natively across its cloud stack

Okta needs differentiated capability here — particularly with customers who don't live entirely within Microsoft's ecosystem.

Implications for Founders and Security Teams

For startup founders building on cloud infrastructure, the Permiso acquisition is a signal worth paying attention to:

AI agents are now a security perimeter, not just a productivity tool. If your product deploys agents that authenticate with third-party APIs, you need a credential management and monitoring strategy from day one.
Non-human identity management is becoming a board-level concern, not just an engineering task. Vendors are investing heavily because enterprises are willing to pay for solutions.
ITDR as a category is consolidating fast. Startups building in this space should expect more M&A activity as platform vendors race to offer unified identity security.

For Okta, the $200 million price tag is a relatively modest bet to shore up a capability gap that could otherwise become a competitive liability as AI-native enterprise architectures become the norm.