Okta buys Permiso Security to put ITDR inside the identity provider

Okta has signed a definitive agreement to acquire Permiso Security, a Palo Alto company whose platform detects threats across human, non-human, and agentic identities in multi-cloud estates. Neither side disclosed a price. TechCrunch reported a figure just under 200 million dollars, structured as an almost all-cash transaction. Okta says Permiso's identity risk signals, behavioural analytics, and detections will fold into the Okta Platform to give it native ITDR: surfacing excessive privilege, ranking identity risk, and catching attacks that begin after authentication has already succeeded. The deal is expected to close in the third quarter of Okta's fiscal 2027, which runs from August to October 2026.

Why it matters

Okta has been strong at the front door and thin behind it. Once a session exists, the interesting attacker behaviour (token theft, role chaining, a service principal doing something it has never done) has largely been someone else's telemetry to analyse, which is why CrowdStrike and Microsoft Defender for Identity kept showing up next to Okta in deals rather than under it.

Buying Permiso is Okta deciding that detection belongs in the identity provider. For buyers mid-evaluation, the practical question is packaging: whether these detections arrive as a licensed add-on to Identity Threat Protection or as a separate product with its own price, and whether coverage extends past Okta's own logs into AWS, Azure, and GCP the way Permiso standalone does. Until close, treat Permiso as a live product with a new roadmap owner. Our ITDR buyer guide covers what to test, and the acquisitions tracker has the rest of this year's consolidation.

Source: Okta, price via TechCrunch