July 30, 2026
TechCrunch reported that Okta is acquiring Permiso, an AI security startup, for roughly $200 million, giving Okta identity threat detection built for a world where the things logging into your systems increasingly aren't people. That's the real story here. Identity management used to mean employees, contractors, and the occasional service account. Now every company running AI agents has dozens or hundreds of non-human identities making API calls, touching customer data, and triggering workflows -- often with permissions nobody fully audited when the agent was spun up in a demo three months ago.
Okta buying its way into this problem rather than building it in-house tells you how urgent the gap is. Enterprises are deploying agents faster than their security teams can classify what those agents can touch, and that's exactly the kind of blind spot attackers look for. If you're evaluating any platform that touches customer or operational data, the question isn't just 'does it have a security page' anymore -- it's whether the vendor treats security as something baked into the architecture rather than bolted on after an agent gets loose. Businesses that skip this question now are the ones writing the incident report later.
TechCrunch's reporting on the OpenAI-linked hack of Hugging Face made a point worth repeating: the hacker was noisy and fast, but the lesson experts drew had nothing to do with exotic AI-specific defenses. It came down to ordinary cybersecurity discipline -- the kind of monitoring and response hygiene that predates the AI boom entirely. That's a useful corrective to the panic that every new AI headline seems to invite. Yes, agents and non-human identities create new attack surface, which is exactly why Okta is spending $200 million on it. But the breach itself was caught and contained through fundamentals, not some AI-native silver bullet. For business leaders, that's oddly reassuring: your existing security posture, if it's actually good, still does most of the work. Our own Trust Center and incident response documentation exist for exactly this reason -- not because AI changes the rulebook, but because it raises the stakes of ignoring it.
The most striking number in today's news isn't a dollar figure -- it's a headcount. TechCrunch cited a new study estimating only about 2,000 U.S. engineers have the expertise to deliver meaningful ROI from enterprise AI deployments, which is why 'forward-deployed engineer' has become the industry's hottest job title. Think about what that scarcity actually means: thousands of companies are trying to hire from a pool the size of a mid-sized conference. Most of them will lose that race, not because they lack budget, but because the talent simply doesn't exist to go around.
This is the strongest argument I've seen yet for why so many companies are better off buying a platform that's already been built and hardened rather than trying to hire their way to a custom AI implementation. If you can't land one of the 2,000, you're not stuck -- you're just choosing a different path, one where the AI App Builder and integration work is done for you instead of dependent on a hire you may never make. The forward-deployed engineer shortage isn't a reason to panic; it's a reason to be honest about whether your team should be building custom AI infrastructure at all, a question our build vs. buy framework was written to help answer.
Zoom out and a pattern emerges across today's headlines: Okta buying Permiso for security, Nscale buying Anyscale to own more of the compute stack, Meta leaning on internal AI to ship more consumer apps faster. Everyone is racing to control more of the stack themselves rather than stitch together partners, because the seams between tools are where risk and slowdown live. That's a lesson that applies just as much to a 20-person company choosing software as it does to a cloud provider buying a compute startup -- fragmented tools create fragmented accountability, and nobody wants to own that gap when something breaks.
If your company had to choose today between hiring a forward-deployed engineer you probably can't find, or buying a platform that already treats agent security as core infrastructure, which way would you go -- and why?
Sources