Okta Pays $200M for AI Security Firm Permiso

Okta just dropped roughly $200 million on Permiso, a startup that uses AI to watch what users do inside cloud environments after they log in. Sources familiar with the deal told Reuters the price sits around that figure. This is not a big company consolidation story. It is a signal about where the next wave of attacks is already hitting, and most small and midsize operators are completely blind to it.

What Is Happening Right Now

Permiso built what the security industry calls identity threat detection and response, or ITDR. The concept is straightforward: instead of only controlling who gets into your cloud systems, you watch what they do once they are inside. If a user account suddenly starts pulling files at 3 AM or accessing systems it has never touched before, Permiso flags it immediately.

Okta already dominates identity and access management, serving more than 19,000 organizations according to the company’s most recent earnings disclosures. Adding Permiso gives Okta a detection layer it has never had. You do not just manage the front door anymore. You watch the halls.

According to CrowdStrike’s 2025 Global Threat Report, identity attacks are now the leading method attackers use to get into enterprise environments. Stolen credentials, session hijacking, and privilege escalation account for the majority of successful breaches. The attackers are not breaking in. They are logging in.

The Real Story Here

Most people read “$200 million acquisition” and think big tech consolidation. That reading misses the point entirely.

According to IBM’s 2025 Cost of a Data Breach Report, the average breach involving stolen credentials cost $4.62 million per incident. That number has risen every year for the past decade. And the businesses taking the biggest hits are not always the Fortune 500 companies with full security teams. They are midsize operators who assumed identity management meant having a password policy and maybe two factor authentication.

The rich versus poor mindset plays out clearly here. The average business owner hears “identity security” and decides it does not apply to them because they are not a bank or a hospital. They set up basic logins and move on. The sharp operator understands that their cloud accounts, their payroll system, their financial tools, and their email are all active targets. One compromised credential can drain a business account, expose customer data, or lock you out of your own systems while attackers demand a ransom to restore access.

Okta’s own 2023 breach, which came through a compromised third party vendor, wiped billions off the company’s market cap in the days after disclosure according to financial reports at the time. The incident triggered a wave of customer security audits across the enterprise world and forced Okta to publicly acknowledge that identity management alone was not enough. You need to know when a legitimate credential is being used for illegitimate purposes.

That is exactly what Permiso does. And Okta paid $200 million for it because every one of their 19,000 enterprise customers is now asking the same question: how do we detect a breach before the attacker finishes the job?

If your business uses a platform like Gusto for payroll, think carefully about what sits inside that account. Bank routing numbers, direct deposit details, salary data, Social Security numbers for every employee. That is one of the highest value targets in any cloud stack. Identity threat detection is not an enterprise luxury reserved for companies with dedicated security teams. It is the new baseline for any company running sensitive operations in the cloud.

What I Would Do Right Now

I will be direct. Most people reading this are not going to buy an enterprise Okta contract with Permiso capabilities tomorrow. That is not the play. The play is to understand what this deal signals and get your own house in order before the signal becomes a siren.

First, audit every service account and user account across your cloud tools. Delete anything that has not been used in 90 days. Dormant accounts with active credentials are the single most common entry point attackers exploit.

Second, turn on login activity alerts for every critical system you run. Google Workspace, Microsoft 365, and AWS all have this built in. Most businesses never enable it. It costs nothing and gives you a baseline for detecting unusual activity.

Third, restrict who has admin access to your financial tools. If you manage company spending through a platform like Wallester for virtual business cards, the number of people who can create cards, adjust limits, or view transaction history should be minimal and documented. Every extra admin is an extra attack surface.

Fourth, watch how Okta integrates Permiso into their product line over the next two quarters. Whatever features they push into the standard tier will tell you what security capabilities are about to become table stakes across every identity platform your vendors use.

According to Gartner, spending on identity security tools is projected to grow at more than 15% annually through 2027. The market is telling you something. Okta confirmed it with a $200 million check.

The Bottom Line

Okta paying $200 million for a company that watches behavior after the login is one of the clearest signals yet that perimeter security alone is finished. The attackers are already inside. The only question is whether you will know it before they do real damage. Businesses that treat this deal as a big company headline will find out the hard way. The ones paying attention start auditing their access today.

Frequently Asked Questions

What is Permiso and why did Okta acquire it?

Permiso is an AI security company focused on identity threat detection and response, monitoring user behavior inside cloud environments after login rather than just at the point of access. Okta acquired Permiso for approximately $200 million to add behavioral detection capabilities to its existing identity and access management platform. The deal reflects rising demand for security tools that go beyond controlling who logs in to actively watching what they do.

How does the Okta Permiso acquisition affect small businesses?

The acquisition signals that identity-based attacks are now the primary threat vector for businesses of every size, not just large enterprises. Small and midsize companies relying on cloud tools for payroll, finance, and operations face the same risks without the dedicated security teams large companies employ. Auditing your accounts, limiting admin access, and enabling activity monitoring in the tools you already use are the first steps any operator should take.

What is identity threat detection and response?

Identity threat detection and response, or ITDR, is a security category built around spotting malicious activity that uses legitimate credentials to do unauthorized things. Instead of blocking unauthorized logins, ITDR watches for unusual behavior after a user is already inside a system, such as accessing files at unusual hours or escalating their own permissions. Permiso built one of the leading platforms in this space before Okta’s acquisition.

Is Okta stock a buy after the Permiso deal?

This is not investment advice and I am not a financial advisor. What I can say is that Okta is placing a direct bet on the fastest growing segment of enterprise security spending, and the Permiso acquisition positions them to capture more of that budget from existing customers. Whether the $200 million price was justified depends heavily on Permiso’s customer retention and revenue data, neither of which has been fully disclosed at the time of this writing.

What is the easiest way to protect my business from identity attacks?

Start with four steps: remove any accounts unused in the past 90 days, enable login activity alerts on every cloud platform you run, restrict admin access to the smallest possible number of trusted people, and use unique passwords with two factor authentication everywhere. These steps cost nothing and close the most common attack vectors that identity-based breaches exploit.