Oort built identity threat detection and response (ITDR) technology that gives security teams one view of identity risk across directories, identity providers and SaaS platforms. Oort is now part of Cisco, and its technology now ships as Cisco Identity Intelligence within the Duo portfolio.
The product addresses a common gap: identity data is spread across several vendors’ systems, so misconfigured accounts, weak controls and suspicious sign-ins are hard to see in one place. Cisco Identity Intelligence collects that data, correlates each person and account across sources, and scores the risk of human users and non-human identities, including AI agents.
At A Glance
| Vendor | Oort (part of Cisco) |
|---|---|
| Category | Identity threat detection and response (ITDR) and identity security posture |
| Identities covered | Human users, service accounts, shared mailboxes, network devices, machine and agentic identities |
| Deployment | Cloud-native, API-driven, agentless SaaS |
| Agentic AI | Agentic identity type, shared agent account check, OpenAI integration |
| Market classification | Identity Verification |
What Oort Does
Rather than replacing a directory or identity provider, Cisco Identity Intelligence sits alongside the existing identity stack and works across vendors. It looks for two kinds of problem: weak configuration that could be exploited later, and suspicious behaviour that is happening now. Findings are pushed out to the teams and tools that act on them, and Duo can carry out the fix directly, so the same product covers both seeing the risk and closing it. It works the same way whichever vendors supply the identity stack.
Products
Cisco Identity Intelligence
Cisco Identity Intelligence is the successor to the Oort platform and the main product today. Security teams use it to see users, applications and devices in one console, track an Identity Posture Score for the organisation and a User Trust Level for every user, and run campaigns to work through findings. A public API, webhooks and notification integrations let other tools consume its results.
Identity Posture And Threat Checks
The checks are where most of the value sits for an identity or security operations team. Posture management checks catch weaknesses before they are exploited, such as accounts with no MFA configured or Kerberoastable accounts in Active Directory. Threat detection insights flag activity in progress, such as impossible travel between sign-ins.
Non-Human Identities And NHI 360
A dedicated NHI view helps teams find and clean up service accounts, shared mailboxes, network devices and other machine identities that often have no clear owner. Each entry shows its name, type, source, status, providers, tags, creation date and last activity. Types include service account, breakglass and Agentic, and tags highlight upcoming key or password expiry and accounts with no assignment required. The NHI checks run against whichever identity data sources are connected.
Duo Identity Security
Duo Identity Security is the Duo packaging of Cisco Identity Intelligence, included in the Duo Advantage and Duo Premier editions. It suits Duo customers who want cross-vendor identity threat detection and posture insight next to Duo’s own controls for blocking and remediating compromised accounts.
How It Works
Cisco Identity Intelligence runs as a cloud tenant and connects to identity sources over APIs, with no agents to install.
| Component | What it does |
|---|---|
| Data integrations | Connectors pull users, accounts and activity from identity providers, directories, HR systems and SaaS platforms. Okta logs can stream through AWS EventBridge and Entra ID logs through Azure Event Hub. |
| Identity correlation | When users sync from Active Directory or Entra ID, identities are matched on the source directory’s unique IDs. Otherwise matching relies on email addresses. |
| Analysis | Once a source is configured, ingestion and analysis start automatically. The first synchronisation can take a few days. |
| Trust levels | Each user is placed in a trust level such as Questionable, where some risk signals call for review, or Untrusted. |
| Write back | Identity Intelligence can act through Duo, for example to disable a compromised user or remove a suspicious phone. |
Identities And Systems Covered
| Human users | Workforce users correlated across directories, identity providers and HR records. |
|---|---|
| Non-human identities | Service accounts, shared mailboxes, network devices, breakglass and other machine identities. |
| AI agents | An Agentic identity type and checks for shared agent accounts. |
| Directories and identity providers | Microsoft Active Directory, Microsoft Entra ID, Okta, Auth0, Duo, AWS Identity Center. |
| SaaS and cloud | AWS, GitHub, Google Workspace, Salesforce, OpenAI. |
| HR systems | Workday, by file import or Report as a Service, and other HR platforms through SCIM. |
Agentic AI Capabilities
Agentic Application Reuse Check
This posture check flags agent accounts that are shared across several services or applications, and alerts when the account’s risk score passes 100. It currently works with Okta.
OpenAI Integration
The integration reads the OpenAI Compliance API to show who has access to OpenAI models, how models are used and configured, and which tools users can reach. Conversation metadata is collected by default. Identity Intelligence uses this to surface misconfigured tools, misuse of tools, privilege escalation and data loss risks. Insights based on conversations are in Alpha, without guaranteed availability.
Integrations
| Area | Integrations |
|---|---|
| Notification and ticketing | Microsoft Teams, Slack, Jira, ServiceNow |
| SIEM | Azure Sentinel |
| Cisco security | Cisco Secure Access data integration, Duo write back |
Company Background
| Founder | Matt Caulfield (founder and CEO of Oort). |
|---|---|
| Funding | A reported $15 million across seed and Series A rounds (October 2022), co-led by .406 Ventures with Energy Impact Partners. |
| Status | Cisco announced its intent to acquire Oort on 13 July 2023 and completed the deal on 31 August 2023. |
| Integration into Cisco | Oort’s team joined Cisco’s Security Business Group, and its technology became part of the Duo IAM and XDR portfolios. |
Note: This overview is compiled from Oort’s publicly available information as of 4 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.