Okta buys Permiso to secure AI agents at work

Okta says it has signed a definitive agreement to acquire Permiso Security, a cloud-native identity security company focused on threats across human, non-human, and AI agent identities.

The practical point is that enterprise AI agents are starting to look like real actors inside company systems. They can hold permissions, call tools, touch data, and behave in ways that traditional login checks may not catch. Permiso gives Okta more than 2,500 identity risk signals across over 70 identity and security partners, plus behavioral analytics for suspicious activity after access has already been granted.

Okta says it plans to fold Permiso into a broader identity threat detection and posture-management offering. That would help security teams find overprivileged accounts, anomalous agent behavior, unsafe tool usage, and other high-risk identity patterns across cloud and SaaS environments. Permiso also brings SandyClaw, a sandboxing product designed to inspect AI agent skills and prompts for supply-chain attacks before they reach customers.

TechCrunch reports the deal is worth about $200 million, though Okta has not disclosed financial terms. For customers, the bigger signal is strategic: AI security is moving from model safety into everyday identity controls, because agents are becoming another class of user that companies need to observe and contain.