Permiso

Permiso Security operates an identity security platform that inventories and monitors human, non-human, and AI identities across cloud service providers, SaaS applications, identity providers, CI/CD pipelines, and on-premises environments. The platform is organized into three product areas: Discover, which builds a comprehensive identity inventory; Protect, which continuously evaluates identity risk posture based on usage patterns, exposure, and entitlements to surface high-risk identities, stale or zombie accounts, excessive privileges, and toxic access combinations; and Defend, which monitors for anomalous behavior, lateral movement, and early signs of compromise to support investigation of identity-driven attacks. Capability categories the company markets include identity visibility and intelligence, identity security posture management (ISPM), and identity threat detection and response (ITDR) covering credential compromise, account takeover, and insider threat, with named coverage of AWS, Azure, Okta, and Microsoft 365.

The company's core technical construct is the Universal Identity Graph, which links identities to the credentials they own, the machines they create, the agents they run, and the actions they take, stitching activity across authentication boundaries such as federation, role assumption, access tokens, and direct login. Earlier company materials describe this as creating a composite or "meta" identity that reconstructs user sessions from disparate runtime events, pairing runtime activity with static, posture-based data to generate attributed, high-fidelity alerts rather than single-event detections. In 2026 Permiso extended the approach to AI agents through Identity Runtime Attribution, giving visibility into agent runs, tool calls, MCP invocations, and sub-agent spawns across the agent lifecycle, plus behavioral anomaly detection; the company frames the gap as what happens after authentication, where identity providers lose visibility into non-deterministic agent behavior. In April 2026 it also introduced SandyClaw, a platform for analyzing AI agent skills in a sandboxed environment to identify malicious behavior before deployment.

Research is produced by P0 Labs, the company's cloud and identity threat research group, which includes former Mandiant advanced practices leads and has developed more than 1,500 detection signals fed into the product; its published research covers topics such as prompt injection and phishing surfaces in AI email assistants. Permiso positions itself against SIEM, CNAPP, and cloud workload protection tools, arguing those are siloed to IaaS, event-driven and noisy, and lack identity attribution context.

Founding story

Permiso was co-founded by Jason Martin and Paul Nguyen, both former FireEye executives; Martin was EVP of Products and Engineering at FireEye/Mandiant and Nguyen was SVP of Product Strategy and Product Management, with earlier roles at @stake, Neohapsis, and Invotas. Phani Modali is also listed as a co-founder and SVP of Engineering.

Business model

Permiso sells its identity security platform to enterprises; at the time of its Series A the company reported closing multiple six- and seven-figure license deals with Fortune 500 customers.

Software licensing for the platform, sold to enterprise customers; the company cited significant revenue growth since its seed round and six- and seven-figure license deals.

Traction

Permiso reported closing multiple six- and seven-figure license deals with Fortune 500 customers and increasing revenue significantly after its seed round. Following the 2023 LUCR-3 (Scattered Spider) attacks on MGM and Caesars, multiple casino groups adopted its platform, and it was engaged by other victim organizations to correlate activity that incumbent systems could not. Autodesk was among the first enterprises to deploy its AI agent security capabilities.

Latest developments

In May 2026 Permiso announced Identity Runtime Attribution for AI agents across its Discover, Protect, and Defend products, with Autodesk among the first enterprises to deploy the capabilities; the launch was covered by Security Boulevard. In April 2026 it introduced SandyClaw for sandboxed analysis of AI agent skills. On 30 July 2026, Okta agreed to acquire Permiso, a deal TechCrunch reported at just under $200 million in an almost all-cash structure, expected to close in the third quarter of Okta's fiscal 2027. Okta chief product officer Ely Kahn said Permiso would extend Okta's identity security fabric with identity threat detection and response capabilities and its threat research team.