AI Agents Need Logins Too: Okta, SailPoint, and the Identity Buyout Wave

By Jake, founder of StockResearch.app

When an AI agent books a meeting, files a support ticket, or pulls a customer record, it logs in. It has a credential, a set of permissions, and a trail of what it touched, much like an employee. Unlike an employee, it can make thousands of requests an hour and won't notice when someone is tricking it. That is why identity security sits closer to the AI-agent wave than any other part of cybersecurity. As of October 5, 2026, the two public pure plays left, Okta and SailPoint, trade at the 89th and 88th percentile of their own five-year EV/Sales range.

If you only read one thing

The short version: AI agents are a new kind of user, and every one needs a login and permissions. Tools that manage those "non-human identities" are the most direct way to sell into the agent boom. Big security platforms spent the last year buying the specialists. The two public pure plays left, Okta and SailPoint, already trade near the top of their own five-year valuation range.

What "non-human identity" means

Identity security started with people: a username, a password, a second factor, and a list of what each employee can open. Non-human identities are the logins that software uses to talk to other software. They include:

• Service accounts that let one system read from another, like a billing system pulling from a database.
• API keys and tokens that apps use to call cloud services.
• Cloud roles that grant a server or script permission to touch storage or other servers.
• AI agents, the newest kind, which act on a person's behalf across many systems.

The first three are predictable: a script does the same thing every time. Agents are not. They decide what to do next, so a permission granted for one task can get used for another. Most of the incidents behind this autumn's cyber rally, covered in what David Friedberg argued about AI and cyber defense, came down to an AI system reaching something it was never meant to reach.

Identity tools do four jobs: find every identity (human or not), cut permissions down to what each one needs, watch for behavior that doesn't fit, and revoke access quickly when something goes wrong.

The takeaway: A non-human identity is a login used by software instead of a person. AI agents are the riskiest kind, because they make their own decisions about what to access. Identity security tools track those logins and limit what each one can do.

Why identity is the most direct exposure

A firewall protects the network and endpoint software protects the device. Identity security controls the actor. Every new agent a company deploys is one more identity to inventory, govern, and watch, so agent adoption maps onto identity demand more directly than onto any other security category. CrowdStrike made the same argument when it announced its SGNL deal, describing a need to grant and revoke access for human, non-human, and AI identities in real time (CrowdStrike's announcement of the SGNL acquisition).

The takeaway: More AI agents means more logins to manage. That makes identity the security category most directly tied to how many agents companies actually deploy.

The buyout wave

The large security and software platforms reached the same conclusion and bought their way in.

Buyer	Target	Status	What the target does
Palo Alto Networks	CyberArk	Closed Feb 11, 2026	Privileged access (the admin keys)
CrowdStrike	SGNL	Agreed Jan 8, 2026 (~$740M)	Real-time access decisions for human, non-human, and AI identities
ServiceNow	Veza	Closed Mar 2, 2026	Permission mapping across apps and data, including non-human identities
Cisco	Astrix Security	Closed Jun 29, 2026	Non-human identity
SailPoint	Entro Security	Closed Jun 29, 2026	Non-human identity and AI governance
Okta	Permiso Security	Closed Aug 26, 2026	Threat detection across identity types

Sources: map of the 2026 identity consolidation wave (CyberArk, Astrix, Entro, Permiso), CNBC on CrowdStrike's SGNL deal, and ServiceNow's Veza acquisition announcement.

Two patterns stand out. The platforms (Palo Alto, CrowdStrike, Cisco, ServiceNow) bought identity companies so they could sell agent controls inside a bundle. The identity specialists (Okta, SailPoint) bought non-human identity startups so they would not fall behind. CyberArk, long one of the biggest public identity companies, now sits inside Palo Alto.

The takeaway: Between January and August, the biggest security and software companies bought a string of agent and machine-identity specialists. The public companies left that focus mainly on identity are Okta and SailPoint.

Where Okta and SailPoint sit on valuation

We use EV/Sales (enterprise value divided by trailing revenue) because profits in this group are thin or negative, which makes P/E unreliable. Our guide on when to use P/E, P/S, EV/Sales, or EV/EBITDA explains the choice.

Ticker	EV/Sales	5y median	EV/S 5y %ile	Revenue growth (TTM)
OKTA	12.0	6.1	89	11%
SAIL	9.5	7.6	88†	20%
PANW (owns CyberArk)	26.7	13.1	98	~34% (latest quarter, incl. CyberArk)

As of October 5, 2026. † SailPoint has traded publicly in its current form for less than two years, so its percentile compares against a short window. Okta trades at nearly double its own five-year median EV/Sales on 11% revenue growth, and our data shows that growth slowing rather than speeding up. The five-year window still includes the tail of 2021, when Okta's EV/Sales peaked near 38. Today's 12 is far below that, but higher than about 89% of the weeks since. The market is paying for re-acceleration that hasn't shown up in reported revenue yet. Okta was also one of the names hit hardest when Anthropic announced Claude Code Security on February 20: it fell 9% that day. SailPoint grows faster, at 20%, and trades at 9.5 times sales, close to the top of its short trading range (its high is 9.8). With less than two years of history, its percentile says less than Okta's does.

Check both band charts yourself: Okta's EV/Sales history and SailPoint's EV/Sales history.

The takeaway: Okta costs about twice its own five-year median relative to sales while its growth is slowing, so the price assumes AI agents will speed it back up. SailPoint grows faster but has too little history for its percentile to say much.

What would change the picture

• Okta's growth rate. If agent-related products start lifting revenue growth above its current 11%, today's multiple starts to look earned. If growth keeps slowing, the 89th percentile has a long way to fall.
• Bundling. Palo Alto with CyberArk, CrowdStrike with SGNL, and Microsoft with its own identity products can all sell identity as part of a larger contract. That pressures standalone vendors on price.
• More deals. The specialists are mostly gone. The question for the remaining public names is whether they keep buying or become targets.

Identity is one layer of the broader basket on the AI cyber defense theme page, and our full ranking of AI cybersecurity stocks by valuation percentile puts Okta and SailPoint next to the platforms and the de-rated names. The cybersecurity valuation screen ranks the security vendors live.

---

Data: SEC EDGAR XBRL filings and market prices, computed by StockResearch as of October 5, 2026. Deal details come from the linked sources. Jake is the founder of StockResearch.app, where he writes data-first research on valuation dislocations. Nothing here is investment advice or a recommendation to buy or sell any security. Do your own research.