Okta is buying Permiso Security, a startup focused on spotting identity threats in the cloud. The move stretches Okta beyond authentication into watching what accounts and AI agents do once they are inside a system.
Permiso draws on more than 2,500 signals from over 70 identity-related partners to flag excessive permissions, unused credentials, unusual behavior from AI agents, and policy violations. Chief product officer Ely Kahn says the deal fuses two product lines that have long worked apart: live threat detection and identity posture management.
Combining the two produces higher-confidence alerts, Kahn said, citing a dormant admin account flagged by posture tools that later shows a login from an unfamiliar IP. Permiso also brings visibility into identity systems outside Okta, such as Microsoft Entra ID and Active Directory.
SandyClaw, a Permiso capability coming with the deal, runs AI agent skills and prompts in a sealed sandbox to root out supply-chain attacks hidden in AI tools. Okta points to survey data in which 58% of executives said their organizations suffered an AI-linked security event or close call in the last year. The transaction is expected to close in the third quarter of Okta’s 2027 fiscal year; terms were not disclosed.
