Okta Launches AI-Agent Identity Gateway as Palo Alto Acquires CyberArk

Okta adds agent authentication and emergency revocation to identity platform

Okta announced AI-agent identity controls at its September 23 Oktane event, positioning authentication, authorization, and activity monitoring for non-human identities as a new control plane within its existing governance and privileged-access products. The commercial offering includes a runtime gateway and an agent kill switch—capabilities that force enterprise buyers to decide whether AI-agent oversight belongs in IAM, cloud security, or SIEM budgets.

Okta formed the Blueprint Alliance with AWS and CrowdStrike to standardize agent authentication, authorization, and activity visibility. Microsoft Entra ID was not listed as a member, despite being one of the largest enterprise identity platforms and a direct Okta competitor. CEO Todd McKinnon said Okta for AI Agents would support third-party identity providers for human users, suggesting the product aims to govern agents regardless of the underlying workforce identity system.

The argument for consolidation is clear: if an organization already routes workforce authentication through Okta, extending that control plane to agents keeps governance, emergency revocation, and audit logging in one system. The risk is equally clear: Okta has not published pricing, packaging details, customer counts, or independent benchmarks. This is a product-direction announcement, not yet a mature purchasing decision. Buyers evaluating agent controls should treat Okta's launch as a vendor roadmap signal until commercial terms and reference customers become available.

Palo Alto Networks acquires CyberArk, consolidating privileged access with platform security

Palo Alto Networks' acquisition of CyberArk—a leading privileged access management vendor—intensifies competition across identity security and changes the vendor argument for buyers. CyberArk's privileged-identity controls will now sit alongside Palo Alto's network, cloud, endpoint, and security operations products. The deal puts Palo Alto in direct competition with Okta in identity threat detection, with Microsoft Entra ID in workforce and cloud identity, and with BeyondTrust and Delinea in privileged access.

Existing CyberArk customers face a product-roadmap and contract review. Palo Alto customers gain a potential reason to consolidate privileged access, identity telemetry, and broader security operations with one vendor. The challenge is that no acquisition price, published synergies, or product-integration timetable has been disclosed. The strategic relevance is high; the near-term budget impact is unquantified. Buyers should not assume immediate cost savings or rapid product unification.

The broader pattern is consolidation pressure. Standalone IAM and PAM vendors must now justify their products against platform vendors that combine identity, network, cloud, and endpoint security. The counterargument is depth: specialized identity vendors often deliver richer governance, finer-grained policy, and better integration with non-platform identity systems. But that argument becomes harder to make when buyers are under pressure to reduce vendor count and security-stack complexity.

Integrity360 builds 90-person identity practice after CyberIAM acquisition

Integrity360 launched a dedicated identity services practice with more than 90 specialists following its acquisition of CyberIAM. The practice covers access management, privileged access, identity governance and administration, and customer identity. This is a services-market development, not a software-product shift. It expands competition among systems integrators and managed-security providers rather than among core IAM vendors.

The enterprise-buyer implication is capacity. Organizations lacking internal IAM engineering resources may use Integrity360 to implement or operate multi-domain identity programs rather than buy additional software. The practice could support programs that combine workforce IAM, PAM, IGA, and CIAM, but no revenue, customer count, or contract-value figures were disclosed beyond the headcount. This is most relevant to buyers budgeting for implementation and managed services, not evidence of a change in underlying IAM software market share.

Market data shows diverging trajectories for Okta and Microsoft Entra ID

PeerSpot's September access-management data reported Okta Platform at 11.3% mindshare, up from 9.7% a year earlier, while Microsoft Entra ID stood at 10.7%, down from 23.9% in the comparable measure. A separate AI-recommendation index gave Microsoft Entra ID a 36% share in workforce identity and SSO recommendations, compared with 17% for Okta. The measures are not directly comparable—PeerSpot reports user mindshare, while the AI index reflects recommendation frequency—but the divergence suggests Okta is gaining ground in user preference while Microsoft retains a larger share of AI-driven recommendations.

Buyers evaluating workforce identity should focus on their specific requirements rather than market-share trends. Microsoft Entra ID typically wins when an organization is already committed to Microsoft 365 and Azure. Okta typically wins when an organization prioritizes multi-cloud support, third-party application integration, or independence from a single platform vendor. The market-share data does not resolve that trade-off; it confirms that both vendors remain competitive.

What to watch

Watch for Okta's pricing and packaging details for AI-agent controls. Until those details are public, the agent-governance announcement is a roadmap signal, not a purchasing decision. Watch for Palo Alto's CyberArk integration timeline and product-bundling announcements. Existing CyberArk customers should review contract terms and roadmap commitments. Watch for competitive responses from Microsoft, BeyondTrust, and Delinea as platform vendors push consolidation and specialized vendors push depth. The identity market is entering a phase where platform breadth and specialized depth are both credible arguments—but buyers will need to decide which matters more for their specific architecture and risk profile.