Notifications
Clear all
Topic starter
23/06/2026 9:23 pm
TL;DR: CrowdStrike's $740 million acquisition of SDNL, a company with $63 million in funding and a CAEP-based continuous authorization model, signals that real-time authorization for human, machine, and AI agent identities is now a budgeted security category, according to EnforceAuth. The deeper issue is that access review, RBAC, and static IAM assumptions break when decisions happen continuously across delegation chains.
NHIMG editorial — based on content published by EnforceAuth covering CrowdStrike's acquisition of SDNL: authorization, AI agent governance, and the growing decision-level access gap
By the numbers:
- CrowdStrike announced it was acquiring SDNL for $740 million on January 8, 2026.
- SDNL had raised $63 million in total funding before the acquisition.
Questions worth separating out
Q: What breaks when authorization is handled only through RBAC?
A: RBAC breaks when the risk is not membership in a role but the specific decision an identity makes at runtime.
Q: Why do AI agents and machine identities complicate authorization decisions?
A: They complicate authorization because they can act continuously, delegate authority, and chain tool use faster than human review cycles can intervene.
Q: How do security teams know if access reviews are actually working?
A: Access reviews are working only if they remove privileges before those privileges create operational risk, not after the fact.
Practitioner guidance
- Separate entitlement approval from execution-time policy Map which identities can authenticate, which can inherit access through delegation, and which decisions still need to be checked at runtime before execution.
- Inventory delegation chains for machine and agent identities Trace how service accounts, tokens, APIs, and AI agents inherit authority across environments.
- Reassess periodic access reviews for runtime-sensitive roles Classify which permissions support real-time operations, then decide whether review cadence alone is enough.
What's in the full analysis
EnforceAuth's full analysis covers the operational detail this post intentionally leaves for the source:
- CrowdStrike's acquisition framing and the specific market signals it creates for authorization budgets
- SDNL's CAEP and continuous identity architecture details for teams evaluating runtime authorization models
- The article's breakdown of decision-centric authorization across applications, infrastructure, data, and AI workloads
- The author's discussion of policy-as-code, OPA, Cedar, and Zanzibar compatibility for implementation teams
👉 Read EnforceAuth's analysis of the CrowdStrike SDNL acquisition and authorization gap →
SDNL inside CrowdStrike: what it means for IAM teams?
Explore further
25/06/2026 2:41 am
Authorization has become the control plane for modern identity risk. The acquisition does not just validate a product category, it validates the need to govern decisions after authentication has already succeeded. That shift matters because the security problem is no longer only who can log in, but what that identity can do once it is inside the environment. Practitioners should treat authorization as an independent governance layer, not a checkbox inside IAM.
A few things that frame the scale:
- 97% of NHIs carry excessive privileges, increasing unauthorised access and broadening the attack surface, according to the Ultimate Guide to NHIs.
- Only 20% have formal processes for offboarding and revoking API keys, and even fewer have procedures for rotating them.
A question worth separating out:
Q: Who is accountable when a valid identity makes a harmful decision?
A: Accountability usually sits with the control owner who allowed the decision path to exist, not just the person or system that executed it. In practice, that means IAM, PAM, platform, and application teams share responsibility for defining the approval boundary, logging the decision, and making the policy auditable. Without that, valid access can still produce invalid outcomes.
👉 Read our full editorial: CrowdStrike's SDNL acquisition exposes the authorization gap
