Permiso Security is an identity security company, now part of Okta, that finds and protects every identity an organisation runs, whether a person, a non-human account or an AI agent, across cloud, SaaS and on-premises environments. It is built for security teams that need one view of who and what can act in their estate, and early warning when one of those identities is misused.
The problem it addresses is simple to state: most organisations cannot say how many identities they have, which of them are exposed, or when one starts behaving like an attacker.
At A Glance
| Vendor | Permiso Security, part of Okta |
|---|---|
| Category | Identity security posture management, ITDR, non-human identity security |
| Identities covered | Human, non-human and AI identities |
| Deployment | Cloud and on-premises environments |
| Agentic AI | Agent runtime attribution, MCP invocation logging, SandyClaw skill sandbox |
| Customers | Nutanix, ACV Auctions, Coupa, Modern Health |
| Market classification | Identity Security Posture Management; also NHI Platforms & Machine Identity, Identity Threat Detection & Response |
What Permiso Security Does
Attackers increasingly log in rather than break in, using stolen credentials, leaked keys or over-privileged service accounts. Permiso tackles this in three steps. It builds an inventory of identities wherever they live, reduces the exposure of those identities, and watches their activity for signs of compromise. A risk score ties the three together so teams know which identities to deal with first. The same approach applies whether the identity belongs to an employee, a former vendor, a cloud service account or an AI agent, because attackers will use whichever one is easiest to take over.
Products
Discover
Discover is the starting point: an inventory and visibility tool that lists human, non-human and AI identities wherever they sit in the enterprise. It gives teams that have never mapped their identities a complete picture before they set policy.
Protect
Protect is the posture management module, for teams that want to shrink their attack surface before an incident. It highlights the identities most likely to be compromised and cuts privilege creep across identity providers, IaaS, PaaS and SaaS. It also shows where MFA is missing, tracks the age and rotation of passwords and access keys, and helps remove zombie accounts, including former vendor accounts, that are no longer active.
Defend
Defend is the ITDR module, used by security operations to catch account takeover, credential compromise and insider threats within minutes. It stitches user activity together across identity providers so a single identity can be followed through IaaS, PaaS and SaaS events, and flags behaviour that departs from the norm.
Risk Score Engine
The Risk Score Engine gives every identity a continuous score built from three factors. Behaviour shows whether an identity is acting out of character. Likelihood separates an identity that has actually been compromised from one that merely could be. Impact measures the damage if it were. An organisation-level score is benchmarked against similar companies.
Non-Human Identity Security
This solution is for teams that have lost track of machine credentials. It inventories keys, tokens, service accounts, roles and groups, monitors API keys, access tokens and other secrets, and finds orphaned, stale and over-permissive NHIs across cloud environments.
How It Works
Permiso connects to identity providers, cloud platforms, SaaS applications and on-premises systems and tracks identities and their activity across them at runtime. Activity from every source is linked in a Universal Identity Graph, which the Risk Score Engine draws on. Detection rules written by P0 Labs, Permiso’s threat research team, run against that combined activity, and scores are tracked over time so teams can see whether risk is rising or falling. Since the Okta acquisition, the same detections also extend Okta’s ITDR offering.
Identities And Systems Covered
| Human users | Workforce and vendor accounts across identity providers and SaaS. |
|---|---|
| Non-human identities | Keys, tokens, service accounts, roles, groups, API keys and access tokens. |
| AI agents | Agents, sub-agents and MCP servers, including agents running in Lambda functions, containers and VMs. |
| Identity providers | Okta, Ping Identity, Microsoft Entra ID and Duo Security. |
| Cloud | AWS (including IAM, CloudTrail, S3, EC2, Secrets Manager and GuardDuty), Microsoft Azure (including Key Vault and RBAC) and Google Cloud Platform. |
| SaaS and code | Google Workspace, Microsoft Exchange, SharePoint, OneDrive, Slack, Zoom, Notion, Confluence, Salesforce, Snowflake, Databricks, Tableau, Grafana Labs, GitHub, GitLab and Bitbucket. |
Agentic AI Capabilities
Agent Runtime Attribution
Every agent run, event and tool call is attributed to an identity as it happens, across agents, sub-agents and MCP servers. MCP invocations are visualised and written to the audit trail. Agents hidden in serverless functions, containers and VMs are surfaced, and kill switches allow a misbehaving agent to be contained at machine speed.
SandyClaw
SandyClaw “runs every skill in a controlled sandbox before it touches your environment”, recording every action, tool call and downstream request. It lets teams test AI agent skills and prompts before allowing them into production. The same identity detection also watches for LLM hijacking across the model providers an organisation uses.
Integrations
| Area | Integrations |
|---|---|
| Ticketing | Jira, ServiceNow, Zendesk |
| Security and DevOps | 1Password, Cloudflare, JFrog Artifactory, Semgrep, Sentry, Terraform |
| AI providers | OpenAI, Anthropic |
Company Background
| Ownership | Okta signed a definitive agreement to acquire Permiso on 30 July 2026 and completed the deal on 26 August 2026. |
|---|---|
| Leadership | Jason Martin and Paul Nguyen, co-founders and co-CEOs; Ian Ahl, CTO. |
| Research | P0 Labs offers cloud incident response and compromise assessment services, and under Okta also feeds Okta Threat Intelligence. |
Note: This overview is compiled from Permiso Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.