CrowdStrike agrees to buy SGNL for 740 million dollars

CrowdStrike has signed a definitive agreement to acquire SGNL for approximately 740 million dollars, predominantly cash with a stock component subject to vesting. SGNL was founded in 2021 by former Google executives and builds continuous identity: authorisation re-evaluated in real time using the Continuous Access Evaluation Profile, plus just-in-time access that grants privilege for a task and withdraws it afterwards rather than leaving it standing. CrowdStrike is folding it into Falcon, where the identity business has passed 435 million dollars in annual recurring revenue, with the stated goal of granting and revoking access for human, non-human, and AI identities based on live risk. The deal is expected to close in CrowdStrike's fiscal 2027.

Why it matters

Most identity products still make one decision at login and then trust a session for hours. CAEP inverts that: the identity provider pushes a signal, the relying party re-evaluates, and access ends mid-session when risk changes. It is the right answer to token theft and session hijacking, and it has been standards-ready for years while adoption lagged because both sides of the exchange had to implement it.

CrowdStrike buying it matters because it holds the risk signal. An endpoint detection product that already knows a device is compromised is well placed to cut sessions rather than raise an alert.

In hindsight this deal set the pattern the rest of 2026 followed: platform vendors buying identity control planes rather than building them, from Palo Alto and CyberArk to Okta and Permiso. The acquisitions tracker has the full list.

Source: CrowdStrike