Okta to Purchase Axiom Security to Bolster Privileged Access

Okta plans to purchase a privileged access management startup led by an Israeli Air Force veteran to better protect databases, Kubernetes and just-in-time access.

See Also: Identity and Access Management (IAM) Market Guide 2025

The San Francisco-based identity security behemoth said New York-based Axiom Security’s expertise in database and Kubernetes connectivity, AI-driven connectors and just-in-time access provisioning will complement Okta’s existing privileged access capabilities, said CPO Arnab Bose. Okta chose Axiom to maintain alignment with its SaaS-first strategy and deliver quicker time to value.

“What piqued our interest in Axiom was the ways in which they supported connecting to databases, Kubernetes, containers, their AI-based connector philosophy, so we could connect to more resources and bring them all into the fabric,” Bose told Information Security Media Group. “Based on our analysis, it would be a good augmentation to what we already had, versus a totally different philosophy.”

Axiom, founded in 2021, employs roughly 20 people and emerged from stealth in December 2022 with $7 million in seed funding led by S Capital. The company has been led since establishment by Itay Mesika, who spent more than three years leading network and security for a unit of the Israeli Air Force. This is Okta’s first deal since buying identity security provider Spera for $58 million in February 2024 (see: Vendors Align IAM, IGA and PAM for Identity Convergence).

How Axiom Complements Okta’s Existing PAM Investment

Bose said Okta intentionally avoided buying a legacy PAM product that would be difficult to integrate or that operated with a different architectural philosophy such as on-premises or a bastion-host-based model. Axiom matched Okta’s SaaS-first vision and offered a modular, scalable approach that could be smoothly absorbed into the existing Okta Privileged Access platform, Bose said.

While Okta’s existing privileged access product does well with passwordless server access and secrets management, Bose said it lacked robust coverage for databases, containers and other dynamic cloud-native environments. Okta’s objective is to deliver real security by protecting all types of sensitive infrastructure – not just servers or secrets – and Axiom will fill the gap and deliver comprehensive PAM.

“We look at Axiom as a complimentary additive component that we will integrate in and then live side by side with our server access and secrets management tools under the umbrella of Okta Privileged Access,” Bose said. “And then Okta Privileged Access will fit into the identity security fabric and be something that you can orchestrate and automate from other parts of Okta.”

Traditional privileged access systems were designed for on-prem environments and often rely on static credentials, creating risk exposure since threats often emerge not from missing permissions, but from over-permissioned users, Bose said. Axiom, in contrast, was designed with cloud-based control planes and a just-in-time access model that eliminates standing privileges, Bose said.

“Axiom provides this capability in a way that supports just-in-time access, and also does so in a way where there’s a cloud-based control plane,” Bose said. “All of this is aligned with the ways in which we’ve built the Okta Identity Governance product and Okta Privileged Access. These are all cloud-based offerings with the ability to connect into both cloud-based services as well as on-prem via agents.”

How Axiom Will Help Okta Dynamically Adjust Real-Time Access

Okta plans to use session risk analytics to dynamically adjust access in real time. For example, if a developer is compromised, Okta can detect that through integrations with EDR tools and instantly revoke the session and credentials before damage is done. With Axiom’s infrastructure support and just-in-time design, Okta will be able to enforce this zero trust model across more sensitive resources.

“Just-in-time is a design concept that is fundamental to the principle of zero trust,” Bose said. “You want to minimize standing privileges as much as possible, you don’t want users with standing privileges to access these Kubernetes containers or databases. We want the policy to be evaluated just-in-time. We want access to be granted and then taken away once the work is done.”

Buying Axiom will support Okta’s move toward dynamic, intelligent and automated identity security. He said Okta can continuously gather real-time telemetry from user sessions, device posture and third-party security tools to calculate risk scores. In a scenario where a developer’s device is compromised, Okta’s system will detect the change in risk, revoke access, destroy the session and rotate credentials.

“Okta already continuously reassesses the health of an end user’s session,” Bose said. “We can leverage all of that to recall an end user’s session risk, and if that changes, you can propagate that directly back to the PAM product and terminate that session, destroy that credential and reset it so it’s not usable.”

While building an in-house solution would have offered full control and native integration, Bose said it would also require significant engineering time, resource onboarding and risk due to unknowns in the development process. Axiom already solved many of the technical problems Okta needed to address with deep connectors, modular components and a product philosophy that matched Okta’s, Bose said.

“When we did the build-versus-buy analysis, we were very impressed with the work that Axiom had already done and the level of depth that they already supported for these connectors and how modular their components already were,” Bose said. “And so this allows us to bring a more comprehensive privileged access product to market way faster.”