Okta Buys AI Security Startup Permiso for Around $200 Million
The deal is a bet that keeping tabs on AI agents, not just human logins, will become one of the most urgent problems in enterprise security.
Key points
- Okta agreed to acquire Permiso Security for just under $200 million, almost entirely in cash, according to a source first reported by TechCrunch AI.
- Permiso, founded in 2022, builds software that watches for suspicious behaviour inside cloud systems after access has already been granted.
- The startup raised roughly $29 million total before the deal, including an $18.5 million Series A in April 2024 that valued it at about $80 million.
- The acquisition is expected to close in the third quarter of Okta's fiscal year 2027.
- Permiso launched a tool called SandyClaw in April 2025 to test AI agents for harmful behaviour before companies deploy them.
Okta, the company best known for the "Sign in with Okta" button many employees see every morning, has agreed to buy a startup called Permiso Security. The price: just under $200 million, almost entirely cash. Okta did not announce a figure, but a source with direct knowledge confirmed the number to TechCrunch AI, and Okta did not deny it when asked.
What does Permiso actually do?
Permiso watches what happens after someone logs in. That matters because most security tools focus on the door, not on what visitors do once they are inside.
Think of a building with a keycard system. Traditional identity tools check whether your card is valid at the entrance. Permiso watches whether, once inside, you start opening doors you have no reason to open. It flags that behaviour in real time, inside cloud computing environments where companies store data and run software.
Founded in 2022 by Paul Nguyen and Jason Martin, both former executives at the cybersecurity firm FireEye, Permiso built its reputation catching attacks where criminals use stolen credentials, that is, stolen usernames and passwords, to quietly move through a company's cloud systems.
Why does this deal matter for AI?
The urgent new problem is AI agents. An AI agent is software that can carry out multi-step tasks on its own, booking meetings, pulling data, sending messages, without a human clicking through each step. Companies are deploying them fast, and every one of those agents needs access to company systems.
That creates millions of new "machine identities", accounts that belong to software rather than people. If an attacker hijacks one, they can do serious damage while hiding behind what looks like normal automated activity.
Permiso had already started monitoring these machine identities. In April 2025 it launched SandyClaw, a tool that tests AI agents in a safe, isolated environment (a sandbox, a sealed-off testing area where code cannot cause real harm) to catch malicious behaviour before any agent goes live.
Okta's chief product officer Ely Kahn said Permiso would extend Okta's "identity security fabric" with threat detection and response capabilities.
What does this mean for ordinary employees?
If you use Okta at work, this deal will likely show up eventually as tighter monitoring of automated tools your company runs, not your personal login. The practical effect for most employees is invisible. The protection, if it works as intended, is real: it makes it harder for attackers to quietly hijack a background software account and use it to steal data.
Permiso had raised about $29 million total before this deal. Selling for up to $200 million represents a significant return on that investment, and a clear signal that securing AI agents is now valuable enough to write very large cheques for.
Watch for: Any workplace app that suddenly asks to re-verify your permissions, or new notices about AI tools being reviewed before deployment. Both are signs your company is taking machine identity security seriously.
