Okta Acquires Axiom Security to Enhance Privileged Access Solutions

Governance & Risk Management,
Identity & Access Management,
Multi-factor & Risk-based Authentication

Just-in-Time, Database, Kubernetes Access Fuel Privileged Access Startup M&A

Michael Novinson
(MichaelNovinson)
• August 26, 2025

Okta to Purchase Axiom Security to Bolster Privileged Access
Arnab Bose, Chief Product Officer, Okta (Image: Okta)

Okta has announced its intention to acquire Axiom Security, a startup specializing in privileged access management. This strategic move aims to enhance the company’s protection over databases, Kubernetes, and just-in-time access, further reinforcing Okta’s existing capabilities in identity security.

Based in San Francisco, Okta has identified Axiom’s expertise in database and Kubernetes connectivity, AI-driven connectors, and agile access provisioning as key assets that will align with its SaaS-first approach. Arnab Bose, Okta’s CPO, emphasized that the acquisition is designed to deliver quicker value and improve their current privileged access offerings.

Founded in 2021 and emerging from stealth mode in December 2022 with $7 million in seed funding, Axiom has roughly 20 employees. Its leader, Itay Mesika, previously oversaw network and security for a unit of the Israeli Air Force. This acquisition marks Okta’s first since its purchase of identity security firm Spera for $58 million in early 2024.

Enhancing Existing Privileged Access Management

Bose confirmed that Okta purposely avoided acquiring a legacy PAM solution that could pose integration challenges, opting instead for Axiom, which offers modular and scalable services. This alignment with Okta’s SaaS-first vision will help to seamlessly integrate Axiom’s capabilities into the existing privileged access framework.

While Okta excels in passwordless server access and secrets management, the integration of Axiom will address gaps related to dynamic environments like databases and containers. By enriching its offerings, Okta aims to secure all sensitive infrastructure, moving beyond merely managing server access and secrets.

Bose described the synergy between Axiom and Okta’s services, stating that Axiom will act as a complementary component within the Okta Privileged Access ecosystem. Traditional PAM systems often depend on static credentials, introducing risks through over-permissioned users, whereas Axiom’s design favors cloud control and a just-in-time access model.

Dynamic Access Control Through Axiom

Okta plans to leverage session risk analytics for real-time access adjustments. In cases where a developer’s account is compromised, integrations with EDR tools will enable immediate session and credential revocation before any potential harm can occur. Axiom’s infrastructure will facilitate the implementation of a robust zero trust model.

This just-in-time principle minimizes standing privileges, ensuring that access to critical services like Kubernetes containers and databases is tightly controlled and evaluated only as needed. The acquisition will fortify Okta’s move toward a more dynamic, intelligent, and automated identity security framework, enabling continuous monitoring of user sessions and risk conditions.

Bose noted that while an in-house solution could have brought integration benefits, it would require substantial resources and expose Okta to various development risks. Axiom already meets many of Okta’s technical prerequisites, displaying an advanced level of connectivity and robust modularity that supports rapid deployment of a comprehensive privileged access product.

Source link

Related Posts

New BPFDoor Controller Facilitates Covert Lateral Movement in Linux Server Attacks

Apr 16, 2025
Cyber Espionage / Network Security

Cybersecurity researchers have discovered a new component linked to the BPFDoor backdoor, employed in cyber attacks targeting the telecommunications, finance, and retail sectors across South Korea, Hong Kong, Myanmar, Malaysia, and Egypt in 2024. “The controller can establish a reverse shell,” explained Trend Micro researcher Fernando Mercês in a technical report released earlier this week. “This capability permits lateral movement, enabling attackers to penetrate deeper into compromised networks and gain control over more systems or access sensitive data.” The campaign has been tentatively attributed to a threat group known as Earth Bluecrow, also referred to as DecisiveArchitect, Red Dev 18, and Red Menshen. The medium confidence level stems from the BPFDoor malware source code being leaked in 2022, suggesting it could have been adopted by other hacking entities. BPFDoor is a Linux backdoor that first emerged in…

Navigating New Cyber Threats: The Shift from Third-Party Vendors to U.S. Tariffs in Supply Chain Security

Apr 16, 2025
Artificial Intelligence / Software Security

Introduction
Cyber threats aimed at supply chains are becoming increasingly concerning for businesses across various sectors. As companies deepen their reliance on third-party vendors, cloud services, and global logistics, cybercriminals are seizing opportunities to exploit vulnerabilities in these interconnected systems. By first targeting a third-party vendor with unnoticed security flaws, attackers can establish a foothold, using these weaknesses to penetrate the networks of primary business partners. This allows them to move laterally through vital systems, ultimately accessing sensitive data, financial assets, intellectual property, or even operational controls. Recent high-profile incidents, such as the 2024 ransomware attack on Change Healthcare—one of the largest health payment processing firms—illustrate how attackers can disrupt supply chain operations and compromise millions of patients’ protected health information (PHI), stealing up to 6TB of data.