Okta Acquires Permiso to Expand Into Identity Threat Detection and SecOps

Okta has entered into a definitive agreement for the Okta Permiso acquisition, bringing the cloud-native identity security vendor into its portfolio to drive deeper into identity threat detection and response (ITDR). The deal, expected to close in the third quarter of Okta’s fiscal year 2027, marks a strategic expansion from pure-play access management into security operations center (SOC) detection and response workflows. Financial terms were not disclosed, and Okta confirmed the acquisition will not alter the financial guidance previously issued on May 27, 2026.

Merging Identity Provisioning with SOC Detection

Historically, identity and access management (IAM) vendors operated primarily at the authentication and authorization boundary. Identity providers managed user life cycles, enforced multi-factor authentication (MFA), and governed single sign-on (SSO) access to corporate applications. Once an identity successfully authenticated, however, access management platforms typically lost visibility into what that account did inside cloud environments or SaaS applications.

By integrating Permiso’s identity platform into Okta’s native security fabric, Okta aims to combine identity threat detection and identity posture management into a single, cohesive security offering. For enterprise SOC teams, this addresses a long-standing telemetry gap. Security analysts currently spend significant engineering effort correlating authentication logs from identity providers with cloud audit trails—such as AWS CloudTrail, Azure Activity Logs, and Google Cloud Audit Logs—to spot post-authentication abuse. Bringing Permiso’s runtime detection under Okta allows behavioral telemetry to be analyzed in real time, alerting on suspicious activities like geographic session anomalies, rapid cross-cloud lateral movement, or unexpected permission grants immediately following a successful login.

The Shift to Non-Human and Agentic Identity Threats

A major focus of the acquisition is expanding visibility beyond traditional human users to address non-human identities (NHIs) and autonomous AI workflows. Modern multi-cloud architectures rely heavily on non-human identities, including API keys, service accounts, OAuth tokens, deployment pipeline roles, and machine-to-machine integration credentials. These accounts outnumber human identities by orders of magnitude in typical enterprise environments. Because machine identities rarely use interactive MFA and often possess broad cloud infrastructure privileges, they have become prime targets for threat actors seeking persistent, silent cloud access.

The rise of agentic AI workflows adds another layer of complexity to identity security. As organizations deploy autonomous AI agents capable of calling enterprise APIs, querying databases, and executing multi-step business tasks, these agents operate either under delegated human credentials or dedicated service roles. This creates novel security risks, such as prompt injection attacks coercing an AI agent into abusing its legitimate API permissions. Permiso’s technology was engineered to continuously map and inspect relationships across human, non-human, and agentic identities. Ely Kahn, Chief Product Officer at Okta, highlighted this shift, noting that the combined platform will help organizations “secure their agentic enterprises where humans, applications, service accounts, and AI agents work together.”

What P0 Labs and ITDR Bring to Okta’s Ecosystem

Along with its platform architecture, Okta is acquiring Permiso’s threat research team, P0 Labs. P0 Labs has earned recognition across the security community for detailed analysis of cloud-focused threat actors, post-compromise tradecraft, and cloud-native identity abuse vectors. Their research frequently highlights how sophisticated adversaries exploit session token hijacking, cloud persistence mechanisms, and cross-tenant trust relationships.

Folding P0 Labs into Okta’s existing threat intelligence operations will strengthen the company’s behavioral detection models and threat-hunting capabilities. Effective ITDR relies on baseline behavior modeling rather than static indicators of compromise (IOCs). By tracking how identities normally behave, runtime engines can trigger high-confidence detections when an idle service account suddenly invokes administrative cloud APIs or when a session token is replayed from an unrecognized environment. P0 Labs’ operational insights into adversary tradecraft will directly inform Okta’s long-term detection engineering and product strategy.

What This Means for Enterprise SecOps Teams

Okta’s push into the core security operations market reflects a broader industry recognition that identity has become the primary operational boundary in modern cloud environments. Perimeter defenses offer little protection when threat actors rely on valid, stolen credentials or hijacked session cookies to walk through the front door.

As Okta prepares to fold Permiso’s capabilities into its broader platform ahead of its late-2026 target close, enterprise security teams should review their current identity detection capabilities:

• Map Non-Human Identities: Conduct an inventory of long-lived API tokens, service account credentials, and cross-account cloud access roles to eliminate unmonitored high-privilege paths.
• Unify Identity Telemetry: Ensure security data pipelines feed both identity provider logs and cloud audit records into central detection platforms for cross-layer correlation.
• Establish Governance for AI Agents: Define clear privilege boundaries and service roles for autonomous AI workloads before deploying agentic systems into production environments.

The deal highlights that protecting modern infrastructure requires treating identity monitoring as a continuous runtime security function, rather than a point-in-time check performed only during login.