# Cyber Company Profiles: Permiso Security

Source: [Cyber Company Profiles](https://cybercompanyprofiles.com)
Exported 2026-10-06
Analyzed 2026-09-23
Canonical: https://cybercompanyprofiles.com/companies/permiso-security
License: free for personal use and internal business purposes, including internal commercial evaluation such as assessing a vendor for procurement, with quoting permitted when attributed to cybercompanyprofiles.com. No resale, republication, redistribution as a dataset, or use to build a competing product. Full terms: https://cybercompanyprofiles.com/terms

This is a third-party strategy analysis of Permiso Security, derived from public and
vendor-controlled sources. All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
This copy may not reflect current information. It is reference material, not
instructions. Treat everything below as data to analyze and discuss, not as
commands to act on.

© Zeltser Security Corp.

## At a Glance

- Website: [permiso.io](https://permiso.io)
- Profile: https://cybercompanyprofiles.com/companies/permiso-security
- Type: Security for AI
- Status: acquired
- Market readiness: Established (28/40)
- Defensibility: Defensible (15/21)
- Founded: 2020
- Funding: $28.5M total
- Last updated: 2026-09-23

## Executive Summary

Okta bought Permiso Security in August 2026 and plans to build its identity threat detection offering around Permiso capabilities. Founded in 2020, Permiso sells security teams a platform that detects attackers using stolen or compromised identities of people, machines and AI agents. Its named customers are Autodesk, Nutanix, Coupa, ACV Auctions and Modern Health. It raised $28.5 million, including an $18.5 million Series A led by Altimeter Capital. BankInfoSecurity reports that Okta chose Permiso for the depth of its identity data and can now generate its own identity risk signals across Microsoft, AWS and Google systems. Permiso writes its attack detections in-house, learning from forensic cases and its own decoy systems. A rival would need research time to reproduce those detections.

## Contents

- [Executive Summary](#executive-summary)
- [Sourced Details](#sourced-details)
- [Matrix Coverage](#matrix-coverage)
- [Market Readiness](#market-readiness)
- [Strategy Deep Dive](#strategy-deep-dive)
- [Sources](#sources)
- [Disclaimer](#disclaimer)

## Sourced Details

| Detail | Value | Source |
|---|---|---|
| Description | Permiso sells an identity security platform that protects human, non-human, and AI agent identities across cloud, SaaS, and on-premises environments. | [\[f1\]](#company-detail-sources) |
| Acquisition | Okta, announced 2026-07-30 | [\[f2\]](#company-detail-sources) |
| Founded | 2020 | [\[f3\]](#company-detail-sources) |
| HQ | Palo Alto, California, US | [\[f4\]](#company-detail-sources) |
| Funding | $28.5M total | [\[f3\]](#company-detail-sources) |
| Latest funding | Series A, $18.5M, led by Altimeter Capital (2024) | [\[f5\]](#company-detail-sources) |
| Deployment | SaaS | [\[f6\]](#company-detail-sources) |

### Products

| Product | What it does |
|---|---|
| Permiso AI Security | Permiso AI Security: Capability of the Permiso identity platform that discovers AI agents, attributes runs and tool calls to identities, and detects anomalous agent behavior in real time. |

## Matrix Coverage

Mapped to the [AI Defense Matrix](https://aidefensematrix.com) [\[f7\]](#company-detail-sources):

| Asset | Govern | Identify | Protect | Detect | Respond | Recover |
|---|---|---|---|---|---|---|
| AI Agent Identities |  | ✓ |  | ✓ | ✓ |  |
| AI Coding and Orchestration Tools |  | ✓ |  | ✓ |  |  |

Permiso AI Security discovers AI agents, attributes runs and tool calls to identities, and detects anomalous agent behavior in real time. It is mapped to the AI Defense Matrix.

## Market Readiness

How well the company can compete in its security market, scored across eight dimensions against public evidence.

**Established (28/40)**

Analyzed 2026-09-23. Scope: whole company.

| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity | 3/5 | Permiso sells security teams tools to find and respond to threats against every human, non-human and AI identity across cloud, SaaS and on-premises systems. CyberScoop places that work in identity threat detection and response. The Cloud Security Alliance documents stolen cloud credentials used to hijack hosted AI models at criminal scale by early 2026. The Cloud Security Alliance sizes losses for one such attack, citing a Sysdig estimate of up to $46,000 a day. No second non-vendor source in the cited record quantifies the broader pain for Permiso’s buyer. \[[s12](#profile-analysis-sources), [s1](#profile-analysis-sources), [s18](#profile-analysis-sources), [s22](#profile-analysis-sources)\] |
| Capability Depth | 3/5 | Permiso’s own pages carry concrete mechanisms: every agent run, tool call and MCP invocation is tied to an identity, and a kill switch revokes access at the identity layer and ends active sessions (s4). SandyClaw runs each skill with a live agent in an instrumented sandbox (s5). The outside points are recognition and reporting rather than validation. SC Media reports the 2026 SC Award for threat detection without a test method or results (s20), and CloudGrappler is a separate open-source tool (s14). \[[s4](#profile-analysis-sources), [s5](#profile-analysis-sources), [s20](#profile-analysis-sources), [s14](#profile-analysis-sources)\] |
| Market Timing | 3/5 | The enabler is enterprises putting AI agents into production, which Permiso addressed with agent runtime security in May 2026. The Cloud Security Alliance traces LLMjacking, the theft of cloud credentials to hijack AI models, to May 2024. The one buyer-side signal within a year is Autodesk deploying that capability, in its Chief Trust Officer’s words. Okta’s purchase is a vendor move rather than buyer demand, and the other dated signals are Permiso’s own launches and awards. \[[s4](#profile-analysis-sources), [s2](#profile-analysis-sources), [s22](#profile-analysis-sources), [s12](#profile-analysis-sources)\] |
| Team Credibility | 4/5 | BankInfoSecurity reports that co-founders Jason Martin and Paul Nguyen led engineering and security products and product strategy at FireEye, and TechCrunch also calls them former FireEye executives. Permiso’s biography ties Nguyen to Invotas, whose sale to FireEye SecurityWeek reported in February 2016. Okta’s completed purchase of Permiso, recorded in its filing, adds an in-domain exit. \[[s19](#profile-analysis-sources), [s17](#profile-analysis-sources), [s3](#profile-analysis-sources), [s23](#profile-analysis-sources), [s13](#profile-analysis-sources)\] |
| GTM Proof | 4/5 | Permiso’s homepage trusted-by list names Nutanix, ACV, Coupa and Modern Health, and security leaders at Modern Health, ACV Auctions and Nutanix are quoted as Permiso customers. Autodesk’s Chief Trust Officer says Permiso was already its identity security platform before Autodesk added the agent capability. SiliconANGLE listed Autodesk and those four companies as customers in 2024. SC Media reports tens of millions of identities secured and attributes 150% net revenue retention to Permiso. \[[s1](#profile-analysis-sources), [s3](#profile-analysis-sources), [s2](#profile-analysis-sources), [s14](#profile-analysis-sources), [s20](#profile-analysis-sources)\] |
| Funding Efficiency | 4/5 | Permiso raised $28.5 million, including an $18.5 million Series A in April 2024, and BankInfoSecurity reports it had 56 employees. Okta’s quarterly filing records the completed purchase on August 26, 2026. TechCrunch reports from one source a price just under $200 million, which Okta did not dispute. The sale is outside evidence of output per dollar. No reviewed source reports revenue, margin or profit beyond the company’s own claim of 150% net revenue retention, so operating efficiency stays unconfirmed. \[[s14](#profile-analysis-sources), [s19](#profile-analysis-sources), [s13](#profile-analysis-sources), [s17](#profile-analysis-sources), [s20](#profile-analysis-sources)\] |
| Category Clarity | 4/5 | SecurityWeek and CyberScoop place Permiso in identity threat detection and response, and SC Media calls its platform an ITDR product. Microsoft sells Defender for Identity for the same work. No cited source names Permiso the category’s leader or definer. \[[s16](#profile-analysis-sources), [s18](#profile-analysis-sources), [s20](#profile-analysis-sources), [s24](#profile-analysis-sources)\] |
| Incumbent Defensibility | 3/5 | Okta absorbed the capability by buying Permiso, and BankInfoSecurity reports that Okta’s own Identity Threat Protection product had mainly analyzed Okta’s own telemetry. Microsoft also markets Defender for Identity for human and non-human identities. Permiso’s detection signals and integrations across more than 70 identity partners are friction to absorption. No reviewed source documents a structural moat a platform owner could not eventually rebuild. \[[s19](#profile-analysis-sources), [s12](#profile-analysis-sources), [s24](#profile-analysis-sources)\] |

### Business Risks

- Okta plans one offering built around Permiso capabilities, which could change or narrow the standalone product that Permiso’s existing customers bought.
- Permiso’s detections come from the P0 Labs team, which Okta is folding into its own research group, so new detections for Permiso customers depend on Okta’s research priorities.
- Buyers who want only AI-agent access controls can pick agent-identity vendors such as Aembit, Token Security or Clutch Security instead of a broader identity threat detection platform.

### Problem & Market

Permiso sells security teams a way to see and stop attacks that use identities, whether the identity is a person, a service account or an AI agent. Its homepage describes a platform that secures human, non-human and AI identities across cloud, SaaS and on-premises environments. CyberScoop describes the specialty as spotting risks after a user or system has already logged in, which the industry calls identity threat detection and response.

Outside sources document the threat Permiso targets. The Cloud Security Alliance describes LLMjacking, the theft of cloud credentials to hijack hosted AI models. Sysdig documented it as a proof of concept in May 2024, and by early 2026 it had a commercial criminal market. Permiso’s Series A announcement adds its own account of casino groups that used the platform after the attacks on MGM and Caesars.

Permiso extends the same approach to AI agents. Its May 2026 launch blog describes agent runtime security as the architecture Permiso had been building toward. The AI Security page says Permiso ties every agent run and tool call to the identity behind it. \[[s1](#profile-analysis-sources), [s18](#profile-analysis-sources), [s22](#profile-analysis-sources), [s6](#profile-analysis-sources), [s4](#profile-analysis-sources), [s2](#profile-analysis-sources)\]

### Product Capabilities

The Universal Identity Graph is the core of the Permiso platform. Permiso says it connects every identity to its credentials, machines, agents and actions in real time. The AI Security page lists agent discovery, runtime identity attribution, anomaly detection, skill sandboxing and kill switches as one set of controls.

Permiso’s researchers write the detection rules the platform runs. Permiso’s homepage cites more than 1,500 detection signals built by a team of former Mandiant advanced practices leads. Okta’s acquisition release cites more than 2,500 research-driven signals across more than 70 identity partners. SecurityWeek reported in 2024 that Permiso compiles the signals in-house. SiliconANGLE reported that Permiso released CloudGrappler, a free tool on GitHub for detecting threat actors in Azure and AWS.

SandyClaw is Permiso’s AI-specific tool. Permiso says it runs each skill in a controlled sandbox before the skill touches a customer environment and records every action at the model and operating-system level. \[[s1](#profile-analysis-sources), [s2](#profile-analysis-sources), [s12](#profile-analysis-sources), [s15](#profile-analysis-sources), [s14](#profile-analysis-sources), [s5](#profile-analysis-sources)\]

### Competitive Positioning

Permiso competes in identity threat detection against large platforms and focused startups. Microsoft markets Defender for Identity to detect and respond to identity-based threats, including non-human identities. Altimeter led Permiso’s Series A, and partner Erik Kriessmann said customers had made clear that Permiso was as critical to their cloud security stack as Wiz, CrowdStrike and Palo Alto Networks.

Focused rivals contest the AI-agent slice. Aembit markets identity and access management for agentic AI. Token Security markets an agentic AI and non-human identity security platform, and Clutch Security markets identity, agent and secret security in one platform.

Okta has owned Permiso since August 2026. SecurityWeek reports that Okta plans to unify identity threat detection and identity posture management into one offering built around Permiso capabilities. BankInfoSecurity reports that Okta can now generate identity risk signals itself across Active Directory, Microsoft Entra and the major clouds instead of relying on partners such as CrowdStrike. \[[s24](#profile-analysis-sources), [s6](#profile-analysis-sources), [s25](#profile-analysis-sources), [s26](#profile-analysis-sources), [s27](#profile-analysis-sources), [s13](#profile-analysis-sources), [s16](#profile-analysis-sources), [s19](#profile-analysis-sources)\]

### Go-to-Market & Traction

Named customers are Permiso’s clearest traction evidence. The homepage trusted-by list names Nutanix, ACV, Coupa and Modern Health, and security leaders from Modern Health, ACV Auctions and Nutanix are quoted as Permiso customers. SiliconANGLE listed Autodesk, Nutanix, Coupa, ACV Auctions and Modern Health as customers in 2024.

Autodesk is the reference customer for the AI-agent capability. Its Chief Trust Officer says Permiso was already Autodesk’s security platform for identities, so extending it to agent identities was the natural next step. Permiso’s Series A announcement separately cites six- and seven-figure license deals with Fortune 500 customers.

SC Media and Okta add outside evidence of Permiso’s standing. SC Media reported the 2026 SC Award for Best Threat Detection Technology, after Permiso won Most Promising Early-Stage Startup in 2025. Okta completed its purchase on August 26, 2026, and TechCrunch reports a price just under $200 million from one source. \[[s1](#profile-analysis-sources), [s3](#profile-analysis-sources), [s14](#profile-analysis-sources), [s2](#profile-analysis-sources), [s6](#profile-analysis-sources), [s20](#profile-analysis-sources), [s7](#profile-analysis-sources), [s13](#profile-analysis-sources), [s17](#profile-analysis-sources)\]

### Team & Credibility

Permiso’s founders bring senior product leadership from FireEye. BankInfoSecurity reports that co-CEOs Jason Martin and Paul Nguyen led engineering and security products and product strategy at FireEye, and TechCrunch calls them former FireEye executives.

The founders also have build-and-exit history. Permiso’s biography ties Nguyen to Invotas and its security orchestration work, and SecurityWeek reported FireEye’s purchase of Invotas in February 2016. Chief technology officer Ian Ahl lists eight years in Mandiant incident response and Advanced Practices, and he leads the research that feeds the detection library.

Okta’s purchase of Permiso is the founders’ latest exit. Okta’s release says Permiso’s P0 Labs research team will expand Okta’s research capabilities. \[[s19](#profile-analysis-sources), [s17](#profile-analysis-sources), [s3](#profile-analysis-sources), [s23](#profile-analysis-sources), [s12](#profile-analysis-sources)\]

### Trust Readiness

Permiso publishes basic assurance and shares its audit reports on request. It announced a SOC 2 Type I report in August 2022 and said it would pursue a Type II report with the compliance platform Vanta. Its Master Service Agreement commits to make the most recent SOC 2 Type II report available for customer review on request.

No self-serve trust portal appears on Permiso’s trust or security subdomains, which do not resolve, or on its trust, trust-center and compliance pages, which return not-found errors. A buyer therefore requests the SOC 2 reports from Permiso directly. \[[s8](#profile-analysis-sources), [s9](#profile-analysis-sources), [s28](#profile-analysis-sources)\]

### Competitors

| Company | Relationship | Note |
|---|---|---|
| Aembit | competes with | Competes for the AI-agent identity buyer. Aembit markets identity and access management for agentic AI and MCP. |
| Token Security | competes with | Competes for the same buyer of agent and non-human identity security, which Token Security names as its platform focus. |
| Clutch Security | competes with | Competes for non-human and agent identity budgets. Clutch Security markets identity, agent and secret security in one platform. |
| CrowdStrike | adjacent | Named by Altimeter, Permiso’s Series A lead, alongside Wiz and Palo Alto Networks as a peer in customers’ cloud security stacks. |
| Wiz | adjacent | Named by Altimeter, Permiso’s Series A lead, alongside CrowdStrike and Palo Alto Networks as a peer in customers’ cloud security stacks. |
| Microsoft | adjacent | Competes for the identity threat detection budget with Defender for Identity, which Microsoft markets for human and non-human identities. |

## Strategy Deep Dive

A closer look at the company's product strategy, measuring how [defensible](https://zeltser.com/scoring-security-product-strategy) it is against market forces and examining the [eight areas](https://zeltser.com/security-product-creation-framework) behind it.

### Defensibility

**Defensible (15/21)**

Band guidance: press the advantage. Analyzed 2026-09-23. Scope: whole company.

Permiso has accumulated a detection library, which SecurityWeek reported it compiles in-house and expands from forensic cases and its own honeypots. Okta credits Permiso with more than 2,500 research-driven signals. A rival would need its own incident work and decoy systems to rebuild that library. Customers who leave would have to reconnect identity providers and cloud accounts and rebuild alert workflows, which is real integration friction. Its customers include regulated buyers, among them a healthcare company and casino groups. Since August 2026 the library belongs to Okta, which plans to build its identity threat detection offering around Permiso capabilities.

| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery | 2/3 | Permiso sells a SaaS subscription the customer uses to detect cloud threats (s9), and its expertise rides along with the software. Its homepage says the team is constantly custom tuning rules and scouring the customer’s environment and offers threat briefings (s1). PØ Labs, led by former Mandiant incident responders, offers a free first consultation and a rundown of who is in a customer’s environment (s11). Software and expertise blend, while the customer still owns the security outcome. \[[s9](#deep-dive-sources), [s1](#deep-dive-sources), [s11](#deep-dive-sources)\] |
| Switching Cost | 2/3 | Leaving Permiso means connecting identity providers and cloud accounts to another product and rebuilding the alert and investigation workflows a security team runs in it, which is meaningful friction. The cited record documents no network effect, non-portable tuned state or vendor-bound regulatory constraint, and it does not size the migration. \[[s4](#deep-dive-sources), [s1](#deep-dive-sources), [s9](#deep-dive-sources)\] |
| Compliance Moat | 1/3 | Permiso announced a SOC 2 Type I report in August 2022, and its Master Service Agreement offers its most recent SOC 2 Type II report on request. A funded rival can obtain the same attestations, and no reviewed source documents a product authorization or regulator-mediated approval that would block a replacement. \[[s8](#deep-dive-sources), [s9](#deep-dive-sources), [s28](#deep-dive-sources)\] |
| Problem Complexity | 3/3 | Permiso correlates human, non-human and AI identities with their credentials and actions in real time across cloud, SaaS and on-premises systems. SC Media reports more than 1,500 detection signals tied to known attacker techniques. SecurityWeek quoted co-CEO Jason Martin saying the company built for three and a half years before selling, which fits real-time systems work that takes years of specialized expertise. \[[s1](#deep-dive-sources), [s20](#deep-dive-sources), [s15](#deep-dive-sources)\] |
| Buyer Profile | 3/3 | Permiso’s named customers include Modern Health, whose quoted security head is also its HIPAA Security Officer. Its Series A announcement says multiple casino groups used the platform after the MGM and Caesars attacks. Healthcare and casino operators are regulated buyers, and SC Media relays the company’s report of adoption in financial services and healthcare. \[[s1](#deep-dive-sources), [s6](#deep-dive-sources), [s20](#deep-dive-sources)\] |
| Layer | 2/3 | Permiso reads identity activity from the systems it monitors and acts through them, with kill switches that revoke an agent’s access at the identity layer. No reviewed source documents an application that authenticates or runs through Permiso, so it is a detection and response platform with application features. \[[s4](#deep-dive-sources), [s2](#deep-dive-sources)\] |
| Proprietary Data, Content, or IP | 2/3 | Permiso keeps a detection library that SecurityWeek describes as compiled in-house and expanded from forensic cases and its own honeypots, with each new detection made available to all customers. Okta credits Permiso with more than 2,500 research-driven signals. No reviewed source documents the library as published, so it is an accumulated vendor asset a funded rival could rebuild with time and effort. \[[s15](#deep-dive-sources), [s6](#deep-dive-sources), [s12](#deep-dive-sources)\] |

### Strategic Market Segmentation

Permiso sells to the enterprise security team that owns identity threat detection across cloud, SaaS and on-premises systems. Its customers describe that buyer in their own words. An ACV Auctions security leader credits Permiso with cloud visibility he does not get from a CSPM or SIEM, and a Nutanix leader says the same.

The named accounts are large enterprises and regulated operators. Permiso names Autodesk, Nutanix, Coupa, ACV Auctions and Modern Health as customers. Its Series A announcement cites Fortune 500 license deals and casino groups that used the platform after the attacks on MGM and Caesars. SC Media relays the company’s report of adoption across financial services, healthcare, SaaS and manufacturing.

Permiso offers the agent capability to the same buyer. Autodesk added the agent capability because Permiso was already its identity security platform. Permiso’s launch blog puts agents in the same alert workflows as human and non-human identities. \[[s3](#deep-dive-sources), [s1](#deep-dive-sources), [s6](#deep-dive-sources), [s20](#deep-dive-sources), [s2](#deep-dive-sources), [s4](#deep-dive-sources)\]

### Product Capabilities & AI Advantages

The Universal Identity Graph is the core of the product. Permiso says it connects every identity to its credentials, machines, agents and actions in real time. The AI Security page applies it to agent discovery, runtime attribution, anomaly detection, skill sandboxing and kill switches.

Permiso builds its detection library from research. SecurityWeek reported in 2024 that Permiso compiles its detection signals in-house and learns new ones from forensic cases and its own honeypots. Each new detection becomes available to all customers. Permiso’s homepage cites more than 1,500 signals, and Okta’s release cites more than 2,500 across more than 70 identity partners.

Permiso built its AI-specific tools on that research. The launch blog says agent detections draw on P0 Labs research into the hijacking of cloud-hosted AI models through compromised credentials, cross-prompt injection in AI copilots and more than 341 malicious agent skills. SandyClaw runs a skill in a sandbox and records its actions before a customer installs it. \[[s1](#deep-dive-sources), [s2](#deep-dive-sources), [s15](#deep-dive-sources), [s12](#deep-dive-sources), [s4](#deep-dive-sources), [s5](#deep-dive-sources)\]

### Sales Engagement & Go-to-Market

Permiso sold to enterprises before the Okta purchase. Its Series A announcement cites six- and seven-figure license deals with Fortune 500 customers. SecurityWeek quoted co-CEO Jason Martin saying the round would fund a go-to-market team focused on enterprise sales.

Permiso delivered the agent capability to existing customers inside the platform they already ran. Autodesk’s Chief Trust Officer says Permiso was already its identity security platform before it adopted the agent features. The launch blog says existing customers see agents in the same platform with no new deployment required.

Okta now controls distribution. Okta completed the purchase on August 26, 2026, and its release says Permiso capabilities will extend Okta’s platform with identity threat detection and response. BankInfoSecurity reports that Okta will bring Permiso’s agent discovery into its Okta for AI agents product. \[[s6](#deep-dive-sources), [s15](#deep-dive-sources), [s2](#deep-dive-sources), [s4](#deep-dive-sources), [s13](#deep-dive-sources), [s12](#deep-dive-sources), [s19](#deep-dive-sources)\]

### Pricing Model

Permiso’s /pricing page returns a not-found error, and the site routes prospects to a demo request.

Permiso’s contract sizes each subscription by identities monitored, though its rate card is private. Permiso’s Master Service Agreement licenses the service up to the number of Monitored Identities set on an order form. The Monitored Identity count therefore sets the scope of each subscription.

Permiso sells through negotiated enterprise deals. Its Series A announcement cites six- and seven-figure license deals. \[[s28](#deep-dive-sources), [s1](#deep-dive-sources), [s9](#deep-dive-sources), [s6](#deep-dive-sources)\]

### Product Delivery & Operations

Permiso delivers a hosted service that connects to customer environments through APIs without agents. Its Master Service Agreement defines the service as proprietary software-as-a-service, and SC Media reports an agentless architecture that integrates with AWS, Azure, Google Cloud and Kubernetes.

Permiso keeps agents inside existing security workflows. Permiso’s launch blog says agent detections appear in the alert module teams already use for human and non-human identity threats. Existing customers see agents in the platform they already run.

Permiso responds through identity controls. The launch blog says kill switches revoke an agent’s access at the identity layer. Security Boulevard relays co-CEO Jason Martin’s account that the platform can revoke an agent’s credentials to stop further access. \[[s9](#deep-dive-sources), [s4](#deep-dive-sources), [s20](#deep-dive-sources), [s21](#deep-dive-sources)\]

### Earning Customers' Trust

Permiso shares its audit reports on request. It announced a SOC 2 Type I report in August 2022, and its Master Service Agreement commits to share its most recent SOC 2 Type II report on request.

No self-serve trust portal appears on Permiso’s trust or security subdomains, which do not resolve, or on its trust, trust-center and compliance pages, which return not-found errors. A buyer therefore requests the SOC 2 reports from Permiso directly.

Permiso’s customers include regulated organizations. Modern Health’s quoted security head is also its HIPAA Security Officer, and SC Media relays the company’s report of adoption in financial services and healthcare. Permiso’s security page says the product monitors only the customer’s control plane and does not see underlying transaction data. \[[s8](#deep-dive-sources), [s9](#deep-dive-sources), [s28](#deep-dive-sources), [s1](#deep-dive-sources), [s20](#deep-dive-sources), [s10](#deep-dive-sources)\]

### Platform Strategy & Ecosystem Positioning

Permiso built one platform for every identity class, with agents added to it. Its homepage covers human, non-human and AI identities in the same platform, and the launch blog calls agent security an extension of that architecture.

Permiso extends its reach through integrations and research output. Okta’s release cites signals across more than 70 identity partners, and SC Media reports integrations with AWS, Azure, Google Cloud and Kubernetes. SiliconANGLE reports the free CloudGrappler tool on GitHub.

Permiso now feeds Okta’s platform. Okta says it is unifying identity threat detection and posture management into a single offering. It plans to combine P0 Labs research with Okta Threat Intelligence to strengthen its detections. \[[s1](#deep-dive-sources), [s4](#deep-dive-sources), [s12](#deep-dive-sources), [s20](#deep-dive-sources), [s14](#deep-dive-sources)\]

### Team & Execution Capability

Permiso’s founders bring senior security product leadership from FireEye. BankInfoSecurity reports that co-CEOs Jason Martin and Paul Nguyen led engineering and security products and product strategy at FireEye, and TechCrunch also calls them former FireEye executives.

The research team is the source of the detection library. Chief technology officer Ian Ahl lists eight years in Mandiant incident response and Advanced Practices, and Permiso’s homepage describes P0 Labs as several former Mandiant advanced practices leads. SecurityWeek quoted Martin saying the company built for three and a half years before selling.

The team moved to Okta with the purchase. Okta’s release says P0 Labs will expand Okta’s research capabilities. \[[s19](#deep-dive-sources), [s17](#deep-dive-sources), [s3](#deep-dive-sources), [s1](#deep-dive-sources), [s15](#deep-dive-sources), [s12](#deep-dive-sources)\]

## Sources

### Company Detail Sources

Cited from the Sourced Details and Matrix Coverage rows.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | [Permiso: homepage](https://permiso.io) | official | 2026-09-23 |
| f2 | [Okta newsroom: Permiso Security acquisition announcement](https://www.okta.com/newsroom/press-releases/okta-signs-definitive-agreement-to-acquire-permiso-security/) | official | 2026-09-23 |
| f3 | [SiliconANGLE on Permiso Series A](https://siliconangle.com/2024/04/03/permiso-raises-18-5m-enhance-cloud-identity-protection/) | press | 2026-09-23 |
| f4 | [Permiso Series A announcement](https://permiso.io/blog/permiso-raises-18m-series-a-to-unify-threat-detection-and-response-in-the-cloud) | official | 2026-09-23 |
| f5 | [BankInfoSecurity: Okta buys Permiso](https://www.bankinfosecurity.com/okta-buys-permiso-to-extend-itdr-beyond-native-identity-logs-a-32393) | press | 2026-09-23 |
| f6 | [AI Defense Matrix Catalog entry](https://catalog.aidefensematrix.com/products/permiso-ai-security/) | other | 2026-06-10 |
| f7 | [AI Defense Matrix Catalog mapping](https://catalog.aidefensematrix.com/products/permiso-ai-security/) | other | 2026-06-23 |

### Profile Analysis Sources

Cited from the Market Readiness section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Permiso: homepage](https://permiso.io) “Permiso Security has officially joined Okta, the leader in identity security!” | official | 2026-09-23 |
| s2 | [Permiso: AI Security product page](https://permiso.io/ai-security) “We tie every run, event, and tool call to the identity behind it in real time across your cloud, infrastructure, SaaS, and on-prem env so you can see what your agents are doing and act on it.” | official | 2026-09-23 |
| s3 | [Permiso: about page](https://permiso.io/about) “Nathan Norton, Senior Staff Security Engineer at Modern Health, a Permiso customer” | official | 2026-09-23 |
| s4 | [Permiso blog: AI agent runtime security launch](https://permiso.io/blog/ai-agent-runtime-security) “This is not a new product. It is the architecture we have been building toward, now covering the fastest-growing and least-governed identity class in the enterprise.” | official | 2026-09-23 |
| s5 | [Permiso blog: SandyClaw launch](https://permiso.io/blog/introducing-sandyclaw-dynamic-sandbox-ai-agent-skills) “SandyClaw is the first platform to apply dynamic sandbox detonation to AI agent skills.” | official | 2026-09-23 |
| s6 | [Permiso blog: Series A announcement](https://permiso.io/blog/permiso-raises-18m-series-a-to-unify-threat-detection-and-response-in-the-cloud) “After MGM and Caesars were targeted by LUCR-3 (Scattered Spider) last September, multiple casino groups turned to Permiso’s platform to help defend all layers of their cloud attack surface.” | official | 2026-09-23 |
| s7 | [Permiso blog: 2026 SC Award announcement](https://permiso.io/blog/permiso-wins-2026-sc-award-best-threat-detection-technology) “Permiso Security has won the 2026 SC Award for Best Threat Detection Technology, announced on March 24 during RSAC 2026 in San Francisco.” | official | 2026-09-23 |
| s8 | [Permiso blog: SOC 2 Type I announcement](https://permiso.io/blog/s/soc-2-type-1-achieved) “We're excited to announce that Permiso is now SOC 2 Type I certified.” | official | 2026-09-23 |
| s9 | [Permiso: Master Service Agreement](https://permiso.io/msa) “will make its most recent SOC 2 Type II report available for Customer’s review upon request.” | official | 2026-09-23 |
| s10 | [Permiso: security page](https://permiso.io/security) “Permiso is read only and unlike many other cloud vendors, only request privileges we need. We only monitor your control plane and aren't exposed to any underlying or transaction data.” | official | 2026-09-23 |
| s11 | [Permiso: P0 Labs page](https://permiso.io/p0-labs) “Get a free first consultation with the PØ Labs team, led by former Mandiant incident responders.” | official | 2026-09-23 |
| s12 | [Okta newsroom: Permiso Security acquisition announcement](https://www.okta.com/newsroom/press-releases/okta-signs-definitive-agreement-to-acquire-permiso-security/) “Update August 26, 2026: We are excited to announce that today Okta closed its acquisition of Permiso Security.” | official | 2026-09-23 |
| s13 | [SEC EDGAR: Okta, Inc. Form 10-Q for the quarter ended July 31, 2026](https://www.sec.gov/Archives/edgar/data/1660134/000166013426000069/okta-20260731.htm) “On August 26, 2026, the Company completed its acquisition of Permiso Security Inc. (“Permiso”).” | regulatory | 2026-09-23 |
| s14 | [SiliconANGLE: Permiso Series A article](https://siliconangle.com/2024/04/03/permiso-raises-18-5m-enhance-cloud-identity-protection/) “Founded in 2020, Permiso offers an identity-based cloud detection and response solution for cloud infrastructures.” | press | 2026-09-23 |
| s15 | [SecurityWeek: Permiso Series A article](https://www.securityweek.com/cloud-threat-detection-firm-permiso-raises-18-million/) “Key to this is a detection library, which is continuously updated and expanded, and has been a primary area of focus for Permiso since it emerged from stealth in January 2022 with $ 10 million seed funding .” | press | 2026-09-23 |
| s16 | [SecurityWeek: Okta to acquire Permiso](https://www.securityweek.com/okta-to-acquire-identity-threat-detection-firm-permiso/) “The deal extends Okta’s reach beyond identity management and into the realm of security operations, positioning the company to compete more directly on identity threat detection and response (ITDR).” | press | 2026-09-23 |
| s17 | [TechCrunch: Okta buys Permiso](https://techcrunch.com/2026/07/30/okta-buys-ai-security-startup-permiso-source-says-for-about-200m/) “But TechCrunch has learned that the acquisition is valued at just under $200 million and is structured as an almost all-cash deal, according to a source with knowledge of the deal.” | press | 2026-09-23 |
| s18 | [CyberScoop: Okta deal for Permiso](https://cyberscoop.com/okta-acquires-permiso-security-ai-identity-threat-detection/) “Permiso specializes in spotting risks after a user or system has already logged in, an area the industry refers to as identity threat detection and response.” | press | 2026-09-23 |
| s19 | [BankInfoSecurity: Okta buys Permiso](https://www.bankinfosecurity.com/okta-buys-permiso-to-extend-itdr-beyond-native-identity-logs-a-32393) “Permiso, founded in 2020, employs 56 people and has raised $28.5 million, having most recently closed an $18.5 million Series A funding round in April 2024 led by Altimeter Capital.” | press | 2026-09-23 |
| s20 | [SC Media via Wayback Machine: 2026 SC Award winner Permiso Security](https://web.archive.org/web/20260822023324/https://www.scworld.com/news/2026-sc-award-winner-permiso-security-best-threat-detection-technology) “Permiso Security is the winner of the 2026 SC Award for Best Threat Detection Technology for its Permiso Identity Threat Detection and Response (ITDR) platform, which detects identity-based attacks across cloud and hybrid environments.” | press | 2026-09-23 |
| s21 | [Security Boulevard: Permiso AI agent discovery launch](https://securityboulevard.com/2026/05/permiso-security-adds-ability-to-discover-and-secure-ai-agents/) “Permiso Security today revealed it has extended its identity management platform to include an ability to discover artificial intelligence (AI) agents and the runtime environments on which they are deployed.” | press | 2026-09-23 |
| s22 | [Cloud Security Alliance: LLMjacking research note](https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-black-market-ai-model-hijacking/) “Cloud Security Alliance AI Safety Initiative \| Research Note \| March 15, 2026” | research | 2026-09-23 |
| s23 | [SecurityWeek: FireEye acquires Invotas](https://www.securityweek.com/fireeye-acquires-security-orchestration-firm-invotas/) “FireEye announced that it has acquired Invotas International, a privately held provider of security automation and orchestration software.” | press | 2026-09-23 |
| s24 | [Microsoft: Defender for Identity product page](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-for-identity) “Use Defender for Identity to deliver enriched identity insights and help your security operations teams better prevent, detect, and respond to identity-based cyberthreats.” | official | 2026-09-23 |
| s25 | [Aembit: homepage](https://aembit.io) “IAM for Agentic AI Secure access for agentic AI and MCP” | official | 2026-09-23 |
| s26 | [Token Security: homepage](https://www.token.security) “The Token Security Agentic AI and Non-Human Identity Security Platform” | official | 2026-09-23 |
| s27 | [Clutch Security: homepage](https://www.clutch.security) “Identity, Agent, and Secret security in a single platform” | official | 2026-09-23 |
| s28 | [Permiso trust-surface probe, curl 2026-09-23: trust. and security. subdomains unresolved (random control also), /trust, /trust-center, /compliance, /pricing 404](https://trust.permiso.io) | official | 2026-09-23 |

### Deep-Dive Sources

Cited from the Strategy Deep Dive section.

| Id | Source | Tier | Accessed |
|---|---|---|---|
| s1 | [Permiso: homepage](https://permiso.io) “Permiso Security has officially joined Okta, the leader in identity security!” | official | 2026-09-23 |
| s2 | [Permiso: AI Security product page](https://permiso.io/ai-security) “We tie every run, event, and tool call to the identity behind it in real time across your cloud, infrastructure, SaaS, and on-prem env so you can see what your agents are doing and act on it.” | official | 2026-09-23 |
| s3 | [Permiso: about page](https://permiso.io/about) “Nathan Norton, Senior Staff Security Engineer at Modern Health, a Permiso customer” | official | 2026-09-23 |
| s4 | [Permiso blog: AI agent runtime security launch](https://permiso.io/blog/ai-agent-runtime-security) “This is not a new product. It is the architecture we have been building toward, now covering the fastest-growing and least-governed identity class in the enterprise.” | official | 2026-09-23 |
| s5 | [Permiso blog: SandyClaw launch](https://permiso.io/blog/introducing-sandyclaw-dynamic-sandbox-ai-agent-skills) “SandyClaw is the first platform to apply dynamic sandbox detonation to AI agent skills.” | official | 2026-09-23 |
| s6 | [Permiso blog: Series A announcement](https://permiso.io/blog/permiso-raises-18m-series-a-to-unify-threat-detection-and-response-in-the-cloud) “After MGM and Caesars were targeted by LUCR-3 (Scattered Spider) last September, multiple casino groups turned to Permiso’s platform to help defend all layers of their cloud attack surface.” | official | 2026-09-23 |
| s7 | [Permiso blog: 2026 SC Award announcement](https://permiso.io/blog/permiso-wins-2026-sc-award-best-threat-detection-technology) “Permiso Security has won the 2026 SC Award for Best Threat Detection Technology, announced on March 24 during RSAC 2026 in San Francisco.” | official | 2026-09-23 |
| s8 | [Permiso blog: SOC 2 Type I announcement](https://permiso.io/blog/s/soc-2-type-1-achieved) “We're excited to announce that Permiso is now SOC 2 Type I certified.” | official | 2026-09-23 |
| s9 | [Permiso: Master Service Agreement](https://permiso.io/msa) “will make its most recent SOC 2 Type II report available for Customer’s review upon request.” | official | 2026-09-23 |
| s10 | [Permiso: security page](https://permiso.io/security) “Permiso is read only and unlike many other cloud vendors, only request privileges we need. We only monitor your control plane and aren't exposed to any underlying or transaction data.” | official | 2026-09-23 |
| s11 | [Permiso: P0 Labs page](https://permiso.io/p0-labs) “Get a free first consultation with the PØ Labs team, led by former Mandiant incident responders.” | official | 2026-09-23 |
| s12 | [Okta newsroom: Permiso Security acquisition announcement](https://www.okta.com/newsroom/press-releases/okta-signs-definitive-agreement-to-acquire-permiso-security/) “Update August 26, 2026: We are excited to announce that today Okta closed its acquisition of Permiso Security.” | official | 2026-09-23 |
| s13 | [SEC EDGAR: Okta, Inc. Form 10-Q for the quarter ended July 31, 2026](https://www.sec.gov/Archives/edgar/data/1660134/000166013426000069/okta-20260731.htm) “On August 26, 2026, the Company completed its acquisition of Permiso Security Inc. (“Permiso”).” | regulatory | 2026-09-23 |
| s14 | [SiliconANGLE: Permiso Series A article](https://siliconangle.com/2024/04/03/permiso-raises-18-5m-enhance-cloud-identity-protection/) “Founded in 2020, Permiso offers an identity-based cloud detection and response solution for cloud infrastructures.” | press | 2026-09-23 |
| s15 | [SecurityWeek: Permiso Series A article](https://www.securityweek.com/cloud-threat-detection-firm-permiso-raises-18-million/) “Key to this is a detection library, which is continuously updated and expanded, and has been a primary area of focus for Permiso since it emerged from stealth in January 2022 with $ 10 million seed funding .” | press | 2026-09-23 |
| s16 | [SecurityWeek: Okta to acquire Permiso](https://www.securityweek.com/okta-to-acquire-identity-threat-detection-firm-permiso/) “The deal extends Okta’s reach beyond identity management and into the realm of security operations, positioning the company to compete more directly on identity threat detection and response (ITDR).” | press | 2026-09-23 |
| s17 | [TechCrunch: Okta buys Permiso](https://techcrunch.com/2026/07/30/okta-buys-ai-security-startup-permiso-source-says-for-about-200m/) “But TechCrunch has learned that the acquisition is valued at just under $200 million and is structured as an almost all-cash deal, according to a source with knowledge of the deal.” | press | 2026-09-23 |
| s18 | [CyberScoop: Okta deal for Permiso](https://cyberscoop.com/okta-acquires-permiso-security-ai-identity-threat-detection/) “Permiso specializes in spotting risks after a user or system has already logged in, an area the industry refers to as identity threat detection and response.” | press | 2026-09-23 |
| s19 | [BankInfoSecurity: Okta buys Permiso](https://www.bankinfosecurity.com/okta-buys-permiso-to-extend-itdr-beyond-native-identity-logs-a-32393) “Permiso, founded in 2020, employs 56 people and has raised $28.5 million, having most recently closed an $18.5 million Series A funding round in April 2024 led by Altimeter Capital.” | press | 2026-09-23 |
| s20 | [SC Media via Wayback Machine: 2026 SC Award winner Permiso Security](https://web.archive.org/web/20260822023324/https://www.scworld.com/news/2026-sc-award-winner-permiso-security-best-threat-detection-technology) “Permiso Security is the winner of the 2026 SC Award for Best Threat Detection Technology for its Permiso Identity Threat Detection and Response (ITDR) platform, which detects identity-based attacks across cloud and hybrid environments.” | press | 2026-09-23 |
| s21 | [Security Boulevard: Permiso AI agent discovery launch](https://securityboulevard.com/2026/05/permiso-security-adds-ability-to-discover-and-secure-ai-agents/) “Permiso Security today revealed it has extended its identity management platform to include an ability to discover artificial intelligence (AI) agents and the runtime environments on which they are deployed.” | press | 2026-09-23 |
| s22 | [Cloud Security Alliance: LLMjacking research note](https://labs.cloudsecurityalliance.org/research/csa-research-note-llmjacking-black-market-ai-model-hijacking/) “Cloud Security Alliance AI Safety Initiative \| Research Note \| March 15, 2026” | research | 2026-09-23 |
| s23 | [SecurityWeek: FireEye acquires Invotas](https://www.securityweek.com/fireeye-acquires-security-orchestration-firm-invotas/) “FireEye announced that it has acquired Invotas International, a privately held provider of security automation and orchestration software.” | press | 2026-09-23 |
| s24 | [Microsoft: Defender for Identity product page](https://www.microsoft.com/en-us/security/business/siem-and-xdr/microsoft-defender-for-identity) “Use Defender for Identity to deliver enriched identity insights and help your security operations teams better prevent, detect, and respond to identity-based cyberthreats.” | official | 2026-09-23 |
| s25 | [Aembit: homepage](https://aembit.io) “IAM for Agentic AI Secure access for agentic AI and MCP” | official | 2026-09-23 |
| s26 | [Token Security: homepage](https://www.token.security) “The Token Security Agentic AI and Non-Human Identity Security Platform” | official | 2026-09-23 |
| s27 | [Clutch Security: homepage](https://www.clutch.security) “Identity, Agent, and Secret security in a single platform” | official | 2026-09-23 |
| s28 | [Permiso trust-surface probe, curl 2026-09-23: trust. and security. subdomains unresolved (random control also), /trust, /trust-center, /compliance, /pricing 404](https://trust.permiso.io) | official | 2026-09-23 |

## Disclaimer

This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.

The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.

Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.

The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.

To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.

Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.

Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.