Security firms buy AI agent identity startups as rogue agents surface
Cyera and SailPoint found unmanaged AI agents inside customer systems, as acquirers move on non-human identity startups.
Identity and security companies are buying up startups that manage AI agent identities, as new findings show unmanaged agents operating inside corporate systems, according to The Information. Cyera, Okta, SailPoint, Workday, Palo Alto Networks and CrowdStrike have all made acquisitions in the field.
Cyera discovered AI agents that had been sitting in a large financial company's most sensitive data for more than six months, with no one at the company aware of them. Danny Brickman, Cyera's chief business officer, was cited in the report on the finding.
SailPoint found more than 10,000 unknown agents at one Fortune 500 company, 70% of which had no identifiable owner, according to SailPoint president Matt Mills. In both cases the agents were created by the customers' own AI systems and had moved outside management scope; neither caused actual damage.
Deal activity in non-human identity
In September, Cyera acquired non-human identity management startup Oasis Security for $1 billion. Last month Workday acquired C1.ai, Okta acquired Permiso Security in August, and SailPoint acquired Entro in June. Palo Alto Networks and CrowdStrike have also recently acquired companies in the AI agent security field.
Quick answers
Which companies have acquired AI agent security startups?
Cyera bought Oasis Security for $1 billion in September, Okta bought Permiso Security in August, SailPoint bought Entro in June and Workday bought C1.ai last month. Palo Alto Networks and CrowdStrike have also made recent acquisitions in the field.
What did the security companies find inside customer systems?
Cyera found AI agents sitting in a large financial company's most sensitive data for more than six months without the company's knowledge, and SailPoint found more than 10,000 unknown agents at one Fortune 500 company, 70% of which had no identifiable owner.
Did the unmanaged AI agents cause any damage?
No. In both cases the agents were created by the customers' own AI systems and had moved outside management scope, but they did not cause actual damage.