# Okta agrees to acquire Permiso and push identity security into the SOC > Source: > Published: 2026-07-30 18:48:03+00:00 [Okta said on July 30th](https://www.okta.com/newsroom/press-releases/okta-signs-definitive-agreement-to-acquire-permiso-security/) that it signed a definitive agreement to acquire Permiso Security, the cloud identity threat-detection provider founded by former FireEye executives Paul Nguyen and Jason Martin. Financial terms were not disclosed. The transaction gives Okta technology for detecting what human users, service accounts and AI agents do after they authenticate. That moves Okta deeper into security operations, where teams investigate compromised credentials, excessive permissions and suspicious behavior across cloud services. Nguyen and Martin built [Permiso](https://permiso.io/about) around experience acquired during an earlier change in enterprise security. Nguyen began as a white-hat hacker at @stake and Neohapsis before founding security-orchestration provider Invotas, which FireEye acquired. Martin co-founded Secure DNA before becoming executive vice president of global engineering and security products at FireEye and Mandiant. Permiso's founding group also included Stephen Demjanenko, an engineering and product executive who had worked at Meraki, and Phani Modali, a former FireEye engineering leader. Nguyen described Permiso's original thesis as finding the next evolution in cloud security: moving from tools that show vulnerabilities toward products that detect active attacks and support a response. ### Okta moves beyond the login screen Traditional identity and access management products decide whether an account should be allowed into an application. Permiso follows identities after access is granted, correlating behavior across identity providers, cloud infrastructure, software services and development systems. That distinction has become more important as enterprises deploy service accounts and AI agents that can use tools, access data and act across applications without a person controlling each step. An agent with excessive permissions can create the same operational risk as a compromised employee account, while generating activity that legacy authentication products were not built to interpret. Okta says Permiso uses behavioral analytics and more than 2,500 research-driven signals across over 70 identity partners. Those signals cover unused permissions, anomalous agent activity, policy violations and behavior with a potentially large blast radius. The figures are supplied by Okta and Permiso. Permiso's [Universal Identity Graph](https://permiso.io/blog/permiso-universal-identity-graph) was designed to connect accounts belonging to the same person or machine across infrastructure, software and identity systems. That can allow an investigation to follow an attacker who authenticates through an identity provider, assumes a cloud role and moves into a software application without treating each step as an unrelated alert. Okta plans to combine those runtime detections with its identity security posture and threat-response products. Okta Chief Product Officer Ely Kahn said Permiso would also add threat researchers to Okta's security operation. Kahn joined Okta in 2026 after serving as chief product officer at SentinelOne and previously co-founding Sqrrl, a threat-hunting provider acquired by Amazon Web Services. Okta stated directly that the acquisition will expand its footprint into the core Security Operations Center. That puts the identity provider in competition for budget held by CISOs and security operations leaders, alongside its established authentication, governance and access-management products. The Permiso agreement follows Okta's acquisition of Axiom Security, which added privileged access management for cloud infrastructure, databases and software services. An [Okta regulatory filing](https://www.sec.gov/Archives/edgar/data/1660134/000166013426000051/okta-20260430.htm) valued the Axiom purchase consideration at $54 million. Together, Axiom and Permiso fill two adjacent gaps: controlling privileged access and detecting abuse after access has been granted. ### Permiso raised $28.5 million Permiso emerged from stealth in January 2022 with a [$10 million seed round](https://permiso.io/blog/s/former-fireeye-executives-emerge-from-stealth-with-10m-seed-round-to-tackle-cloud-detection-and-response/) led by Point72 Ventures. Foundation Capital, Work-Bench, 11.2 Capital and Rain Capital also participated, alongside security executives including former Netflix security leader Jason Chan and Databricks product-security leader Travis McPeak. Altimeter Capital led Permiso's [$18.5 million Series A](https://permiso.io/blog/permiso-raises-18m-series-a-to-unify-threat-detection-and-response-in-the-cloud) in April 2024, with Point72 Ventures returning. That brought Permiso's publicly announced funding to $28.5 million. At the time of the Series A, Permiso said it had signed multiple six- and seven-figure licenses with Fortune 500 customers. Permiso and Okta have named Autodesk as a customer, while Permiso's public materials have also identified ACV Auctions and Nutanix as users. Permiso has not published revenue or annual recurring revenue. The agreement is expected to close during the third quarter of Okta's fiscal 2027, subject to customary closing conditions. Okta said the transaction will not change the financial guidance it issued on May 27th.