Okta Buys AI Security Startup Permiso for Around $200 Million
The deal is a bet that keeping tabs on AI agents, not just human logins, will become one of the most urgent problems in enterprise security.
Key points
- Okta agreed to acquire Permiso Security for just under $200 million, almost entirely in cash, according to a source reported by TechCrunch AI.
- Permiso, which emerged from stealth in 2022, builds software that watches for suspicious behaviour inside cloud systems after access has already been granted.
- The startup raised roughly $29 million before the deal, including an $18.5 million Series A in April 2024 that valued it at about $80 million.
- Okta expects the acquisition to close in the third quarter of its fiscal year 2027.
- Permiso launched SandyClaw in April 2025 to test AI agents for harmful behaviour before companies deploy them.
Okta, the company behind the "Sign in with Okta" button many employees see every morning, has agreed to buy Permiso Security. The price is just under $200 million, almost entirely cash. Okta didn't disclose a figure, but a source with direct knowledge confirmed the number to TechCrunch AI, and Okta didn't dispute it when asked.
What does Permiso actually do?
Permiso watches what happens after someone logs in. Most security tools focus on the door, not on what visitors do once they're inside.
Founded in 2022 by Paul Nguyen and Jason Martin, both former FireEye executives, Permiso built its reputation catching attacks where criminals use stolen credentials to move quietly through a company's cloud systems. Its software flags that behaviour in real time.
Why does this deal matter for AI?
The urgent new problem is AI agents: software that carries out multi-step tasks on its own, booking meetings, pulling data, sending messages, without a human approving each step. Companies are deploying them fast, and every agent needs its own access to company systems.
That creates vast numbers of new "machine identities", accounts belonging to software rather than people. If an attacker hijacks one, they can cause serious damage while hiding behind what looks like routine automated activity.
Permiso had already started monitoring machine identities before this deal. In April 2025 it launched SandyClaw, a tool that tests AI agents inside a sandboxed environment (a sealed-off testing area where code cannot cause real harm) to catch malicious behaviour before any agent goes live.
This acquisition follows Cyera's $1 billion purchase of Oasis Security on 29 July, which we reported on the same theme. Two nine-figure bets on machine-identity security in a fortnight signals the market is moving fast, not just maturing.
Okta's chief product officer Ely Kahn said in a prepared statement that Permiso would extend Okta's "identity security fabric" with threat detection and response capabilities.
Should you worry about your own workplace?
Probably not about your personal login. What's changing is the monitoring of automated tools running in the background of your company's systems. The protection, if it works as intended, is real: it makes it harder for attackers to hijack a background software account and use it to steal data without anyone noticing.
Permiso raised about $29 million total. Selling for just under $200 million is a strong return, and a clear signal that securing AI agents is now valuable enough for very large cheques. Our earlier story on the AI tools your colleagues quietly connected to work systems shows why boards are paying attention: most companies still don't know what automated software is running, let alone whether it's been compromised.
If your company asks you to re-verify permissions for workplace apps, or announces a review of AI tools before further deployment, that's the practical shape this shift takes.
