Identity vendors made 18 of 33 identity acquisitions in 2025 and 2026, but paid $0.79 billion of $62.96 billion

Identity companies make most identity acquisitions, but companies from outside identity pay for almost all of them. Of the 33 identity acquisitions announced in 2025 and 2026, identity vendors made 18, yet they account for only about $0.79 billion of the $62.96 billion in priced deal value, according to SWI's Identity Consolidation Report 2026. The report reads the 63 deals in SWI's acquisitions record against the ownership line of all 297 vendor profiles, in a snapshot dated October 31, 2026.

The deal count jumped after 2024

SWI's record holds 63 identity-market acquisitions, and 33 of the 54 announced since January 2023 came in 2025 and 2026 alone: 19 in 2025 and 14 in 2026 to October 31. 2026 has no dominant buyer. All 14 identity acquisitions announced in 2026 had different buyers, and 9 of those 14 were not identity vendors. The most recent, Infotech's purchase of Zluri on October 14, came from an IT research and advisory firm.

For a buyer of identity software, that spread matters more than the count. In 2026 the acquirer was more often from outside identity than inside it, which means the vendor you depend on can end up inside a data, HR, network or research company with its own plans for the product.

The buyer inversion

The report calls the split between deal count and deal value the buyer inversion. Identity vendors such as Okta, SailPoint and Delinea mostly buy features through tuck-ins. Security, IT and data platforms paid almost all of the rest of the priced value, led by Palo Alto Networks' roughly $25 billion purchase of CyberArk and Google's $32 billion agreement for Wiz, which SWI profiles as a CIEM vendor.

That concentration is the honest caveat: Wiz and CyberArk alone account for $57 billion of the $62.96 billion. Take Wiz out, and IT, data and workflow buyers still paid about $1.54 billion in 2025 and 2026 for Veza and Natoma, roughly twice what every identity vendor combined paid for priced deals. Platforms are buying the access control for systems they already run.

AI-agent identity went from category to target in 87 days

SWI profiles 14 AI-agent and non-human identity vendors. Five of them were bought in an 87-day window, from Cisco's Astrix Security announcement on May 4, 2026 to Okta's Permiso Security agreement on July 30, 2026. In between, Snowflake bought Natoma, SailPoint bought Entro Security and Cyera agreed to buy Oasis Security. All five have closed.

The five buyers were a network vendor, a data platform, a governance incumbent, a data security company and an IAM incumbent. If you bought a non-human identity tool in 2025, check who owns it now. The non-human identity platforms ranking tracks the current field.

67% of identity vendors are still independent

Consolidation is concentrated, not universal. 67% of the 297 identity vendors SWI tracks are still independent, meaning not acquired, not pending acquisition, not a product line of a larger company and not controlled by private equity or another financial sponsor. PKI (22%), IAM (40%) and PAM (42%) are the least independent categories. In PKI, four of nine vendors are PE-owned, including DigiCert, Keyfactor and Sectigo. Decentralized identity, at 88%, is the most independent. IGA is the category moving now: with Zluri closed and C1 pending with Workday, its independence rate is 55%.

Reported prices run high, and most deals have none

Deal prices often reach the public twice: as a headline at announcement, and later in the buyer's SEC filing. In all four identity deals where a press-reported price could be checked against a filing, the filing was lower: CrowdStrike's purchase of SGNL by 14%, Axiom Security by 28%, Entro Security by 39% and Spera Security by at least 42%. Part of the gap is accounting, since filings book retention packages separately, and four deals is a small sample. The report's rule still holds: treat a reported price as a ceiling, not a valuation benchmark.

Most deals carry no price at all. Only 17 of the 54 identity acquisitions announced since 2023 came with a disclosed dollar price, and 30 had no dollar figure at all, disclosed or reported.

What to do with the closing window

Deals that were signed and then closed took a median of 56 days; deals of $1 billion or more took a median of 134 days, against 29 days for smaller priced deals. That window is when contract terms are still yours to protect. The report's checklist covers change-of-control clauses, renewal caps, end-of-sale notice and the questions to put to an acquirer in writing. For the reverse case, merging two identity estates, see IAM for mergers and acquisitions.

How we did it

Deals come from SWI's acquisitions record, which a build check cross-references against the ownership line of every vendor profile in both directions, and every price is labelled disclosed (stated by a party to the deal), reported (by a named outlet citing sources) or undisclosed. Figures are nominal dollars of different kinds (equity value, enterprise value, purchase consideration), and the report adds them anyway and says so. Limits: the tracked universe is SWI's profile set plus a targeted search for deals since January 2023, so counts are a floor rather than a census, and ownership classes are editorial judgements listed in the generator script so they can be challenged.

Use the data: download the deal table as CSV or JSON, and the independence rates as CSV or JSON with per-vendor classes. All are free to reuse under CC BY 4.0 with attribution to Start with Identity and a link to the report.