Agentic sprawl creates security gap as governance struggles to keep pace

Identity security’s next big challenge isn’t human. Enterprise-scale agentic identity sprawl is upon us – raising the question, “when every AI agent becomes an identity, who governs them?” According to research from Gartner, by 2028, the average global Fortune 500 enterprise will have over 150,000 agents in use.

This is a problem, given the other side of it: according to the Cloud Security Alliance, 78 percent of organizations don’t have documented, formally adopted policies for creating or removing AI identities. IT security teams are losing the race with agentic AI, and they know it: 79 percent of organizations have low or moderate confidence in their ability to prevent attacks via NHIs.

Okta, Cyera and others are responding with mergers and integrations that aim to consolidate assets, capabilities and customer controls.

Ghost credentials in the machine

An article in Dark Reading looks at the scale and complexity of the problem presented by dormant nonhuman identities (NHIs) – tokens, agents and service accounts that live outside traditional trust boundaries but can still move laterally through the environment. These so-called ghost credentials are still active in the cloud and still have permissions – but no owner, purpose, or lifecycle. Capable of lateral movement and privilege escalation, they create security blind spots.

The piece cites research from Aleksandr Krasnov of Ducker Tech Consulting, which shows that “a single developer may have up to 244 non-human identities, creating severe scalability and management challenges for larger enterprises.”

In broad terms, “organizations have lost track of what and who they trust in heavily automated environments.”

To help address the problem, Krasnov has developed an open-source tool, NHI Hound, which “inventories and classifies human and non-human identities, exposes implicit trust links, and simulates potential abuse paths between accounts.” The tool has shown successful results in pilots with small to medium-sized enterprises, and Krasnov says he is working to make it suitable for larger organizations with more complex ecosystems of both human and non-human identities.

Okta acquires Permiso Security

Okta has signed a definitive agreement to acquire Permiso Security, a cloud-native identity security platform that detects and mitigates threats across human, non-human, and agentic identities in multi-cloud environments, according to a press release.

The acquisition is “set to expand Okta’s footprint beyond identity management into the core Security Operations Center,” with Permiso’s offerings augmenting Okta’s research capabilities by “bringing post-authentication insight into suspicious behavior across cloud and AI environments.”

The transaction is expected to close in the third quarter of Okta’s fiscal 2027, subject to the satisfaction of customary closing conditions. Per the announcement, it is expected to have no impact on Okta’s guidance issued on May 27, 2026. Financial terms have not been disclosed.

The acquisition will enable Okta to integrate new identity risk signals, behavioral analytics and threat detections from Permiso, strengthening its comprehensive identity threat detection and response (ITDR) capabilities. Permiso’s tech uses more than 2,500 research-driven signals, such as overprivileged access, unused permissions, anomalous agent behavior and tool usage, policy violations, and high blast radius behavior, to identify blind spots in real time.

Ely Kahn, chief product officer at Okta, says Permiso will “extend Okta’s identity security fabric with proven identity threat detection and response capabilities, and an incredible threat research and security team that will advance Okta’s threat detection and prevention capabilities.”

The transaction is yet another instance of the trend toward consolidation in the industry, both in terms of corporate ownership and product offerings. The unification of teams and capabilities puts more comprehensive coverage into a single security product. Okta, ostensibly an identity and access management (IAM) platform, is evolving to offer advanced identity threat detection, continuous visibility into agent behavior, and a “dynamic sandbox for AI agent skills and prompts” called SandyClaw, which “detects AI supply chain attacks in AI agent skills and prompts before they reach customer environments.”

Cyera buys Oasis Security in $1B deal

Israeli data security startup Cyera has announced an agreement to buy local cybersecurity startup Oasis Security in a deal valued at $1 billion. According to The Times of Israel, Cyera plans to bolster its data security platform by integrating data protection with Oasis’s technology for managing and securing NHIs.

Oasis (which commissioned the aforementioned Cloud Security Alliance report on NHIs) has raised more than $195 million in funds to date, backed by Accel, Cyberstarts, Sequoia Capital and Craft Ventures. Its CEO, Danny Brickman, says that from day one, “we recognized that non-human identities would become one of the key security challenges of the AI ​​era.”

Cyera founder Yotam Segev says that “every security decision begins with understanding two things: what data needs protection and who, or what, is seeking to access it. Oasis enables us to unite these two worlds on a single platform, giving organizations the level of control they need to adopt AI securely.”

In addition to Oasis, this year Cyera has acquired Israeli startups Genie Security and Ryft, following acquisitions of Otterize and Shape AI in 2025.

Article Topics

acquisitions  |  AI agents  |  Cyera  |  digital identity  |  identity governance  |  identity security  |  Okta  |  Permiso