AI agents are spreading inside companies faster than security teams can track them.
During a SailPoint proof of concept, one Fortune 500 company found more than 10,000 AI agents it didn’t know about, SailPoint said on its Q2 FY2027 earnings call. On its own Q2 call, CrowdStrike reported that Claude usage across a sample of its customers grew more than 400% in recent months, while custom agent usage on company devices more than doubled.
Each of those agents logs in to company systems with its own keys, tokens, or service accounts. Security vendors need to solve two related problems: finding these agent identities, and controlling what they can touch.
Security vendors are buying their way in
Since January, security vendors have acquired nine startups that secure agent and machine identities, with five deals disclosing prices. The buyers in those five deals — CrowdStrike, Cisco, 1Password, SailPoint, and Cyera — span endpoint security, networking, password management, identity governance, and data security.
The acquisitions split along the same two problems. Astrix and Entro help companies find agent and machine identities and track who owns them. SGNL and Apono help decide what those identities can access and when. Oasis covers both.
For buyers, acquiring is faster than building. SailPoint said buying Entro “accelerated our roadmap.”
Buyers are paying hundreds of millions for these businesses, often with little revenue behind them. SailPoint paid $200M for Entro, adding less than $3M in ARR, according to its CFO. Cyera paid up to $1B for Oasis, which CB Insights estimates will bring in $5M+ in revenue this year.
Most of the remaining targets don’t disclose revenue. In lieu of that, we can use total funding as a proxy to estimate rough prices. Across the five priced deals, buyers paid between 3.6x and 14.2x each startup’s total funding, with a median of about 5x.
Four potential targets
We identified four independent startups that secure agent identities, have raised at least $25M, and are in their window to raise again, according to CB Insights funding window data:
Only Token focuses on agent discovery. The other three tackle access: Defakto and Aembit issue identities and credentials for software workloads, and Keycard issues short-lived, task-scoped access for agents. With Astrix, Entro, and Oasis already acquired, Token is one of the few independent discovery startups of its size left.
At about 5x total funding, these startups would cost roughly $135M to $230M each. (The exception is Defakto, whose last valuation of $263M would likely set a price floor.)
Those prices, however, may not hold for long. Oasis shows how quickly a new round can change the calculation: it raised $120M at a $700M valuation in March, and Cyera bought it six months later, at the lowest price-to-funding multiple of the five deals. Aembit is the furthest into its window. It’s been 27 months since its Series A, and its window closes in February.
Who will buy them?
Some of the likeliest buyers are already investors.
CrowdStrike’s Falcon Fund and Okta’s venture arm have both backed Aembit. Token’s Series A included executives from CrowdStrike, Palo Alto Networks, and Check Point, and Token went through the AWS & CrowdStrike Cybersecurity Accelerator. With SGNL handling real-time access, CrowdStrike could add Token’s discovery product, though it already offers some agent discovery through Falcon Shield.
CrowdStrike remains an active buyer in adjacent areas, as well: This week it agreed to buy Fiddler and Dreadnode, which monitor and test AI agents rather than manage their identities, for a reported $495M combined.
Others have already bought in this space this year. Check Point acquired Cyata in February. SailPoint, after buying Entro, said it is building toward real-time, just-in-time authorization and is still watching early-stage companies that could speed that up. Access-focused startups like Keycard and Aembit fit that description.
Larger identity companies are also worth watching. Silverfort and Saviynt both already sell security for human and non-human identities. Silverfort acquired Fabrix Security in April, and Saviynt has raised $955M since December 2025, giving it capital to do the same.
Customers can track private companies across AI agent access, authentication, and security markets on CB Insights.
For information on reprint rights or other inquiries, please contact reprints@cbinsights.com.
If you aren’t already a client, sign up for a free trial to learn more about our platform.