Identity Consolidation Report 2026: Who Owns Identity Now

Identity companies make most identity acquisitions, but most of the money comes from outside identity. Of the 33 identity acquisitions announced in 2025 and 2026 in SWI's record, identity vendors made 18, yet they account for only about $0.79 billion of the $62.96 billion in priced deal value. The money came from security platforms, led by Palo Alto Networks' roughly $25 billion purchase of CyberArk, and from IT, data and workflow platforms such as ServiceNow, Workday and Snowflake. Even so, 67% of the 297 identity vendors SWI tracks are still independent on October 31, 2026. Consolidation is concentrated, not universal: PKI, IAM and PAM are mostly owned by someone else already, and AI-agent identity went from startup category to acquisition target in 87 days.

This report reads the acquisitions record SWI maintains against the ownership line of every vendor profile, classifies every price by where it comes from, and ends with what to do when the vendor you depend on is the one being bought. The data is downloadable below and free to reuse with attribution.

Methodology

Data snapshot. Deals come from data/acquisitions.json as of October 31, 2026. That file is the record behind the /acquisitions/ page, and a build check cross-references it with the ownership: line of every vendor profile in both directions, so a vendor described as independent on its profile and acquired in the deal table fails the build. Vendor ownership comes from the frontmatter of the 297 profiles across 17 categories.

Inclusion. A deal is included when a company takes control (100% or a majority stake) of a company or business line whose main product is identity: IAM, CIAM, IGA, PAM, ITDR, non-human and AI-agent identity, CIEM, secrets and machine identity, PKI, MFA, identity verification, authorization, decentralized identity, password management, or identity services. The record covers every deal touching a profiled vendor, whatever the year, plus a targeted search for identity deals announced from January 2023 to October 2026. Excluded: funding rounds and minority stakes (KKR's growth investment in Saviynt, for example), team hires without a company purchase, and adjacent deals such as browser security or detection and response. Wiz is included because SWI profiles it as a CIEM vendor, but it is flagged wherever it moves a total.

Price status. Every deal carries one of three labels:

• Disclosed: a party to the deal stated the figure, in a press release, investor release or SEC filing.
• Reported: no party stated it, and a named outlet (TechCrunch, Globes, Calcalist and similar) reported it citing sources. Where a range was reported, the dataset uses the lower bound.
• Undisclosed: no figure was stated or credibly reported. This is a valid answer, and it is the most common one.

Each priced deal names its basis in the price_basis column. Figures are nominal US dollars. They are not all the same kind of number: Palo Alto's figure is equity value, IBM's is enterprise value, BioCatch's is the valuation at which Permira bought a majority stake, IonQ's is the ceiling including earnout, and filings record purchase consideration. Totals in this report add them anyway and say so.

Deal year is the announcement year, or the closing year where no announcement date exists.

Limits. The tracked universe is SWI's profile set plus the targeted search, so counts are a floor, not a census of the market. Before 2023 the record holds only deals that touch a profiled vendor, which is why year-on-year growth is measured from 2023. Ownership classes are editorial judgements, listed in full in the generator script so they can be challenged. Dates and prices were checked against the linked source on October 30 and 31, 2026.

Finding 1: the deal count doubled after 2024, and 2026 has no dominant buyer

2025 is the value year because two very large deals were announced in it: Google's $32 billion agreement for Wiz in March and Palo Alto Networks' CyberArk agreement in July. Without Wiz, disclosed value from 2023 to 2026 is about $39 billion. 2026 is the volume-at-mid-size year: 14 deals, none above $1.3 billion, and every one by a different buyer. The latest came from furthest outside: Infotech, an IT research and advisory firm, completed its purchase of the SaaS and access governance vendor Zluri on October 14, terms undisclosed.

The largest priced identity deals in the record:

Since 2023, Okta, Delinea and SailPoint are the most frequent buyers, with three identity acquisitions each. Okta bought detection and privilege (Spera Security, Axiom Security, Permiso Security); Delinea bought detection, governance and access (Authomize, Fastpath, StrongDM); SailPoint bought privilege, governance and machine identity (Osirium, Imprivata's IGA business, Entro Security).

Finding 2: the buyer inversion

We call this the buyer inversion: identity vendors make most identity deals, and outsiders spend most of the money.

Priced value combines disclosed and reported figures. The IT, data and workflow total is mostly Wiz; without it, that group still paid about $1.54 billion in 2025 and 2026 (Veza and Natoma), roughly twice what every identity vendor combined paid for priced deals in the same two years.

The shift in who buys is as clear as the shift in what they pay. In 2023 and 2024, one deal in the record had an IT, data or workflow buyer (IBM for HashiCorp). In 2025 and 2026 there were seven: Google for Wiz, Twilio for Stytch, ServiceNow for Veza, Snowflake for Natoma, Vercel for Better Auth, Workday for C1, and Jamf for Identity Automation. Each already runs a platform where access decisions get made, whether that is the cloud, the IT workflow, the data warehouse, the developer platform, the managed device or the HR record, and bought the access control for it.

Identity vendors, by contrast, buy features. Okta paid $54 million for Axiom, SailPoint $122.6 million for Entro, 1Password a reported $250 million or more for Apono. These are tuck-ins that fill a gap in an existing platform, and 16 of the 31 identity-vendor deals since 2023 closed on the day they were announced.

Finding 3: AI-agent identity went from category to target in 87 days

SWI profiles 14 vendors in its AI and non-human identity category. Five of them were acquired between May 4 and July 30, 2026:

All five have closed. That is 36% of a tracked category gone in under three months, a faster absorption than any other category in the record. The buyers were a network vendor, a data platform, a governance incumbent, a data security company and an IAM incumbent, five different theories of where agent identity belongs. Each target sold a way to discover, govern or broker the credentials and connections that machines and agents use. SWI covered each deal as it happened: Astrix, Natoma, Entro, Oasis and Permiso.

Not every AI-identity deal is a non-human identity deal. CrowdStrike's purchase of SGNL (continuous authorization, closed February 20, 2026; SWI coverage) and Silverfort's purchase of Fabrix Security (AI decisioning, April 28, 2026) were both pitched at agent access. Add Delinea's StrongDM deal and Workday's C1 deal, whose announcements also led with AI agents, and 9 of the 14 identity acquisitions announced in 2026 were pitched on securing them. See what is non-human identity for the underlying problem.

Finding 4: the independence rate, by category

The independence rate is the share of tracked vendors in a category that are not acquired, not pending acquisition, not a product line of a larger company, and not controlled by private equity or another financial sponsor. It answers a buyer's practical question: if I pick a vendor in this category today, how likely is it already to answer to someone else?

Four readings stand out.

PKI is a private-equity asset class. Four of nine PKI vendors are PE-owned (DigiCert, Keyfactor, Sectigo and AppViewX), two more were acquired (HID Global and EJBCA), and the only independents are Let's Encrypt, a nonprofit, and Smallstep. Consolidation here is a decade old and continues through tuck-ins: Sectigo bought Entrust's public certificate business in January 2025, and Keyfactor bought InfoSec Global and CipherInsights in May 2025 for post-quantum cryptographic discovery.

PAM is where acquisition, not ownership structure, did the work. Six of 19 PAM vendors (32%) were acquired, the highest acquired share of any large category: CyberArk, StrongDM, Apono, Procyon, Osirium and HashiCorp Boundary. Seven PAM deals since 2024 make it the joint second most active deal category, alongside ITDR and IGA, behind identity verification.

The least consolidated categories are the most fragmented. Identity verification has 44 tracked vendors and the most deals since 2024 (eight), yet stays 82% independent, because the deals are mostly vendors buying vendors (Incode, Signicat, Socure, LexisNexis Risk) rather than outsiders absorbing the category. No tracked password-management vendor has been acquired.

IGA is the category moving now. With Zluri closed and C1 pending, 4 of 20 IGA vendors (20%) are acquired or pending, and its independence rate is 55%. Both buyers come from outside identity: an HR platform and an IT research firm.

Private equity is larger than its deal count suggests. Twenty-one vendors are owned by a PE firm or other financial sponsor without a tracked deal, and three more were acquired by PE firms (ForgeRock by Thoma Bravo, BioCatch by Permira, IDnow by Corsair Capital), so 24 of 297 tracked vendors (8%) answer to a financial owner. One of the 21 is Appgate, which went private in a 2024 Chapter 11 recapitalization backed by Magnetar; we count that as sponsor ownership, not an acquisition, and it moves zero trust from 77% to 69% independent. PE's typical move is the merger of two holdings, as when Thoma Bravo folded ForgeRock into Ping Identity, rather than a platform buying a feature.

Finding 5: the headline premium

Deal prices reach the public twice: once as a headline at announcement, often sourced to people familiar with the deal, and later as a line in the buyer's SEC filing. In the four identity deals where both exist, the filing was lower every time. We call the difference the headline premium.

Part of the gap is accounting, not exaggeration. Filings record purchase consideration, and retention packages for the acquired team are booked as compensation instead: SailPoint, for example, committed up to $7.3 million of restricted stock to Entro staff on top of the $122.6 million. A headline figure may fold such packages and earnouts into one number. Four deals is a small sample, and where the earlier figure came from the buyer itself the filing can run the other way: Snowflake's stated $110 million for Natoma became $128.3 million of preliminary consideration, most of it paid in stock. The practical rule still holds: a reported identity deal price is a ceiling, not a valuation benchmark. If you are using one to price your own company or judge a vendor's bargaining position, wait for the filing.

Finding 6: most identity deals have no public price, and the closes are fast

Of the 54 identity acquisitions announced since January 2023, 17 came with a disclosed dollar price, 7 more with a reported one, and 30 with no dollar figure at all. (One of the 30, SailPoint's purchase of the UK-listed Osirium, was disclosed in pounds at about £3.1 million of equity.) Privately held buyers rarely publish: of 29 deals by private acquirers since 2023, two carried a stated figure (Socure's $136 million for Effectiv and the $1.3 billion valuation in Permira's BioCatch deal), five a press-reported one, and 22 none. Delinea has published no price for any of its three. Public acquirers buying small targets often say nothing at announcement and reveal the number months later in a 10-Q.

On timing, 49 deals in the record have exact announcement and closing dates. 22 of them closed on the day they were announced, typical of small private deals. The other 27 were signed and then closed, with a median of 56 days between the two. Size is the main driver: the nine signed-then-closed deals priced at $1 billion or more took a median of 134 days, the eleven smaller priced deals a median of 29.

Two identity deals were pending on October 31, 2026: Workday's purchase of C1, which Workday expects to close by January 31, 2027, and IonQ's all-stock purchase of Elisity, expected in the fourth quarter of 2026. For a buyer, the window between signing and closing is when terms are still yours to protect, which is the subject of the last section.

The platform thesis, and the evidence against it

The thesis: identity stops being a product category and becomes a feature of the security suite (Palo Alto Networks, Cisco, CrowdStrike) or of the system of record (ServiceNow, Workday, Snowflake). The data supports it in three places. Outsiders paid almost all the money in 2025 and 2026. The anchor vendor of an entire category, CyberArk, now sits inside a network-security company and sells under its Idira brand, with Venafi and Conjur renamed alongside it. And the newest category, AI-agent identity, lost more than a third of its tracked vendors to platform buyers within a single quarter.

ServiceNow's Veza purchase shows the cost of the thesis for buyers. As SWI put it when the deal closed, putting Veza's permissions graph inside ServiceNow was "strategically obvious and commercially awkward": Veza sold well as a neutral visibility layer over SailPoint or Saviynt, and that neutrality is harder to keep from inside a platform with governance ambitions of its own. Workday buying C1 raises the same question for the governance layer above HR data.

The evidence against is also in the data:

• Identity vendors are still the most active buyers. They made 36 of the 63 deals in the record and 18 of 33 in 2025 and 2026. Okta, SailPoint, Delinea, Silverfort and 1Password are consolidating identity around identity platforms, not into security suites.
• Two thirds of the market is independent. 200 of 297 tracked vendors answer to no larger owner. In CIAM, identity verification, MFA, password management and decentralized identity, independence is 70% or higher.
• Acquired products often stay standalone. CyberArk continues as a standalone platform inside Palo Alto Networks, Auth0 has run as a separate developer product inside Okta since 2021, and Oasis is to continue as a dedicated unit inside Cyera. Absorption into a suite is a choice the acquirer makes later, not an automatic result of the deal.
• The money is concentrated. Two deals (Wiz and CyberArk) account for $57 billion of the $62.96 billion in priced 2025 and 2026 value. Remove them and the remaining 2025 and 2026 deals look like an active but ordinary tuck-in market.

Our reading: identity is consolidating along the edges where it touches something a platform already owns, such as privileged infrastructure access, machine credentials, permissions on data, and workflow approvals. The core of workforce and customer authentication remains a contested, independent market. A practitioner should expect the products that govern machine and agent access to be owned by a security or IT platform within a few years, and plan contracts accordingly.

What to do when your identity vendor gets acquired

An acquisition is not a reason to migrate. It is a reason to renegotiate while you still have bargaining power and to set the conditions under which you would migrate. Use the gap between announcement and close (a median of 56 days in this data, longer for large deals) to do the following.

In the first two weeks: read the contract

• Change-of-control and assignment. Check whether the contract lets the vendor assign it to an acquirer without your consent, and whether you get a termination right on change of control. If you have one, it is your strongest lever; do not let it lapse unused.
• Renewal price caps. Look for a cap on renewal increases (a fixed percentage or CPI-linked). If there is none, ask for one now, before the price list is folded into the acquirer's suite.
• End-of-life and end-of-sale notice. Ask for a contractual minimum notice period before end of sale or end of support. Twelve months is the floor; 24 months is reasonable for an identity system with many integrations.
• Data and configuration export. Confirm you can export users, groups, policies, role and entitlement models, audit logs, and connector configuration in a documented format, and that this survives termination for at least 90 days.
• Sub-processors and data residency. An acquirer often moves hosting, support and data processing onto its own infrastructure. Your data processing agreement should require notice of new sub-processors and region changes, with a right to object.
• Support and SLA continuity. Ask that existing SLAs, support tiers and named contacts carry over unchanged for the rest of the term.
• Source-code escrow for self-hosted components, if the product runs on your infrastructure.

Questions to put to the acquirer in writing

1. Will the product remain available to buy standalone, without the acquirer's other products? For how long?
2. Will the current price metric (per user, per identity, per connector) stay, or move to the acquirer's metric?
3. Which connectors and integrations to competing products (a rival IdP, SIEM, ITSM or cloud) will continue to be supported, and for how long?
4. What is the published roadmap for the next 12 months, and which items have changed since the announcement?
5. Will the product be rebranded, and does a rebrand change the contract entity, the support channel or the hosting region?
6. What happens to the open-source or community edition, if there is one?
7. Will the target's engineering and support teams stay intact, and who owns the product after close?

Get the answers in a letter or contract amendment. Statements on an investor call and in an FAQ are not commitments.

Migration triggers

Do not wait for renewal to decide. Start a formal migration evaluation when any of these occur:

• The product is renamed into the acquirer's suite and the standalone SKU disappears from the price list. CyberArk's Conjur and Venafi products, for example, were renamed as Idira Secrets Manager and Idira Certificate Manager on May 12, 2026.
• Standalone purchase is withdrawn or new features ship only in the bundle.
• Connectors to a competitor of the acquirer are deprecated, or quietly stop receiving updates.
• The maintainers recommend a successor. After Auth.js maintenance passed to the Better Auth team in September 2025, the maintainers recommended that new projects start with Better Auth while Auth.js keeps receiving security patches. That is a soft end of life.
• Key engineering or product leaders leave in the first two quarters after close.
• An end-of-sale or end-of-support date is announced. Microsoft's retirement of Entra Permissions Management, with end of support on November 1, 2025, is the reminder that a product inside a large company can also simply stop.
• The neutrality you bought it for is gone. If you chose the product as an independent layer over another vendor, and the acquirer competes with that vendor, re-evaluate even if nothing has broken yet.

If you are on the other side, merging two identity estates after your own company's deal, see IAM for mergers and acquisitions.

About the data

The dataset has two parts, both generated by scripts/reports/identity-consolidation-report.mjs from the files described in Methodology:

• Identity acquisitions 2026: one row per deal (63 rows), with acquirer, target, category, announced and closed dates, status, price_usd, price_status, price_basis, acquirer type, deal year, the SWI profile of the target where one exists, and a source URL. Most source URLs are the press release or the SEC filing that carries the price; where no primary source still resolves, a reputable outlet's report is used, and one deal (WorkOS and Warrant) has none because the announcement post now redirects.
• Identity vendor independence: one row per category, plus the ownership class of each of the 297 vendors so any category figure can be recomputed or disputed.

Acquirer types are: identity vendor, security platform, IT, data or workflow platform, private equity, and other. A vendor counts as a product line of a larger company when it is one product of a diversified company (Microsoft, AWS, Google, Oracle, Zoho and similar). The full classification tables are at the top of the script.

The underlying record changes as deals are announced and closed; the /acquisitions/ page always shows the current state, and this report is a dated snapshot of it. Corrections with a source are welcome and credited. Every deal-level fact here was checked against its linked source on October 30 or 31, 2026.