Okta is buying AI security startup Permiso for roughly $200 million, according to a source familiar with the deal. It’s the latest sign that securing AI agents and other automated systems has become a front-burner issue for large enterprises.

Permiso specializes in identity threat detection for cloud environments. That’s different from traditional identity management, which Okta already dominates. The acquisition gives Okta a way to spot when credentials get stolen or misused, particularly for non-human identities like service accounts, API keys, and increasingly, autonomous AI agents.

This matters because the nature of what needs securing is changing fast. A few years ago, identity security meant protecting employee logins. Now companies are dealing with thousands of AI agents, automation scripts, and service-to-service connections, each with its own access credentials. When those get compromised, the damage can spread quickly and quietly.

The timing isn’t coincidental. As AI agents become more capable and more autonomous, they’re also becoming bigger security targets. An AI agent with access to your customer database or financial systems is a lot more dangerous than a chatbot that answers support tickets.

The broader security spend

Okta’s move fits into a larger pattern of security consolidation. Companies don’t want to manage ten different security tools. They want integrated platforms that can handle identity, threat detection, and response in one place.

The $200 million price tag also tells you something about how investors and acquirers are valuing security infrastructure right now. Permiso was a relatively young company, founded in 2023. Getting to a nine-figure exit in roughly three years suggests strong demand for what they built.

For Okta, the acquisition addresses a gap in its product line. The company has done well selling identity management to enterprises, but as cloud environments get more complex and AI workloads proliferate, customers need more than just login management. They need continuous monitoring for unusual behavior, especially from automated systems that don’t follow normal human patterns.

AI creates new attack surfaces

The challenge with securing AI agents is that they don’t behave like humans. They might make thousands of API calls in a minute, access data across multiple systems simultaneously, or operate outside normal business hours. Traditional security tools that look for “unusual” behavior often can’t distinguish between a compromised agent and one that’s just doing its job.

That’s where specialized tools like Permiso’s come in. They’re built to understand what normal looks like for automated systems and flag deviations that might indicate a breach.

This is becoming more urgent as companies deploy AI agents with broader permissions. Early chatbots were mostly read-only. Newer agents can write to databases, trigger payments, modify code, and make decisions that have real business impact. If an attacker compromises one of those agents, they’re not just stealing data. They’re potentially able to take actions on behalf of the company.

The AI security market is still early, but it’s growing fast. Permiso isn’t the only startup in this space, and Okta won’t be the last big platform to make an acquisition here. As AI agents become standard business infrastructure rather than experimental projects, securing them will move from nice-to-have to non-negotiable.

For now, the message from Okta’s acquisition is clear: if you’re building or deploying AI agents at scale, you need to think seriously about how to secure their identities and monitor their behavior. The old playbook for identity security wasn’t designed for a world where most of your “users” aren’t human.