Astrix Security: The AI-Agent Identity Startup Cisco Just Bought for $400M

Cisco's acquisition of Tel Aviv-based Astrix Security is more than a deal; it is a declaration that the era of unmanaged machine identities inside enterprise software is over.

By Carry and Conquer Publications

When Alon Jackson and Idan Gour founded Astrix Security in 2021, they were solving a problem most of corporate America had not yet named. Both had spent the better part of a decade inside Unit 8200, Israel's elite signals intelligence corps, where the invisible architecture of digital access: service accounts, API tokens, machine credentials, was not just an abstraction but a battlefield. Jackson had gone on to lead research and development at Argus, hacking into connected vehicles from the offensive side. Gour had led software development at Deep Instinct, the deep-learning AI cybersecurity firm. When the two reunited to found Astrix, they took a few months off to do what serious builders do: look for the gap that everyone was walking past. They found it in the permissions layer.

The Blind Spot No IAM Vendor Was Solving

Every enterprise by 2021 was connected to hundreds of SaaS applications, cloud services, and third-party platforms. Each of those connections ran on a credential: an API key, an OAuth token, a service account with a name nobody remembered creating. Okta and CyberArk and Microsoft Entra were built for human identity, for the moment a person logs in and must prove who they are. Nobody had built a serious enterprise product for the question that came after: what is this non-human thing, what can it access, what permissions did we give it three years ago and never review, and is it doing what it was supposed to be doing?

That structural gap in corporate security was manageable, barely, when the non-human identities in question were mostly static integrations between known software systems. It stopped being manageable when AI agents arrived. By 2024, every Copilot deployment, every LangChain workflow, every Salesforce automation, every Claude agent running inside a Fortune 500 company was generating a new identity with its own credentials and its own access scope. These agents moved fast, accessed sensitive systems, and operated autonomously. Traditional IAM tools had no vocabulary for them. Astrix's platform was designed for exactly this gap. It discovers non-human identities across an organization's SaaS and cloud estate, maps their permissions and behavior, flags the over-privileged and the dormant, and gives security teams governance over the entire machine identity lifecycle. By the time its $45 million Series B closed in December 2024, led by Menlo Ventures through its Anthology Fund and joined by Bessemer Venture Partners, CRV, Workday Ventures, and F2 Venture Capital, Astrix had built one of the most complete NHI platforms in the market, with $85 million in total funding and a Fortune 500 customer base that understood the problem viscerally.

What Cisco Is Actually Buying

On May 4, 2026, Cisco announced its intent to acquire Astrix for approximately $400 million. The announcement came days after Cisco had moved to acquire Galileo Technologies, an AI observability firm. Peter Bailey, Cisco's SVP and GM for Security, was direct about the strategic rationale. Cisco wanted to understand not just what an AI agent is, but how it behaves, and feed that behavioral intelligence into Splunk for detection and response at machine speed.

The integration map is specific. Astrix's discovery and governance capabilities slot into Cisco Identity Intelligence, Cisco's platform for correlating human and non-human identity data across an organization's environment. Astrix-powered agentic identity management flows into Duo, Cisco's secure access platform, and into Cisco Secure Access for zero trust enforcement. The behavioral signals from Astrix-monitored agents feed into Splunk, giving security operations teams a unified view of agent activity alongside human activity. The combined system can discover AI agents across an organization, authenticate and authorize them, detect when their behavior deviates from policy, and respond in real time. For Cisco, the deal plugs what Bailey and others have described as the most visible remaining gap in the post-Splunk security platform thesis. After the $28 billion Splunk acquisition closed in 2024, Cisco had a credible SIEM and observability play. After Isovalent gave it deep kernel-level network visibility via eBPF, it had infrastructure-level coverage. Astrix closes the identity gap for the machine workforce, the one that by every measure is growing faster than the human workforce it supports.

The NHI Category Goes From Interesting to Mandatory

Astrix was not operating in isolation. Non-human identity had become one of the most actively funded categories in cybersecurity by the time the Cisco deal was announced. Oasis Security, founded by Danny Brickman and Amit Zimerman, also veterans of Israeli intelligence, had raised $120 million in a March 2026 Series B led by Craft Ventures, bringing its total to $195 million. CrowdStrike had paid $740 million for SGNL in January 2026, acquiring the runtime access enforcement layer that sits between identity providers and cloud resources. GitGuardian had taken in $50 million from Insight Partners in February to address credential and secrets exposure. In June 2025, Cyera acquired Otterize to add non-human identity governance to its data security stack.

The aggregate math is stark. According to figures cited by Palo Alto Networks and analysts at Gartner, machine identities now outnumber human identities inside enterprise environments by a ratio of 82 to 1 in some deployments. The identity security market overall is expected to roughly double, from approximately $29 billion in 2025 to $56 billion by 2029, according to IDC projections. The NHI segment within that market, a rounding error a few years ago, has in a single funding cycle become a category that every major security platform either owns or is urgently trying to own. Cisco's acquisition of Astrix is significant not just because of the price but because of its timing relative to enterprise buying behavior. Most Fortune 500 CISOs are still catching up: only 24% of businesses, according to figures cited in Cisco's own announcement, have proper guardrails and monitoring in place for their AI agents. The category is being defined in real time by acquisitions and venture rounds, and Cisco just bought the category leader before most enterprise buyers have a dedicated budget line for the problem.

From Unit 8200 to the Enterprise Control Plane

The founding story of Astrix is one that keeps recurring across this category. Jackson and Gour are among dozens of Unit 8200 alumni who have built the companies defining Israeli and increasingly global cybersecurity. The unit's combination of offensive capability, intelligence tradecraft, and systems thinking at scale has produced a disproportionate share of the serious security infrastructure companies of the past decade. Astrix, like Oasis and several others in the NHI space, traces directly to that lineage.

"We founded Astrix with a clear conviction," Jackson said at the time of the acquisition announcement. "The identities and credentials powering modern enterprise systems: API keys, service accounts, OAuth tokens, were dangerously under-secured." The gap between that conviction in 2021 and a $400 million acquisition in 2026 is a measure of how quickly the underlying risk became undeniable. As agentic AI moved from pilot to production inside large organizations, the machine identity problem Jackson and Gour had been solving quietly became the most urgent unsolved problem in enterprise security. "The gap between agentic capability and organizational readiness is widening," Jackson said at the announcement. "Closing it requires the kind of platform, reach, and expertise that this combination brings."

What Comes Next for the Category

The Cisco acquisition consolidates one pole of the NHI market under a Tier-1 platform. The remaining independents, Oasis with its $195 million and intent-based access model, Aembit focused on workload identity, Entro Security on secrets management, now face a new competitive reality. Against Cisco's enterprise channel and Splunk's installed base, standalone NHI platforms need to prove that best-of-breed governance is worth a separate purchase decision. For enterprise buyers, the message is the opposite of complicated: non-human identity is no longer an edge case or a future concern. It is the access layer through which AI agents, and the risks they carry, enter every system an organization runs. Cisco just told the market that this layer is worth $400 million as a standalone acquisition. The implied message, that leaving it unaddressed is worth far more, is the one every CISO with an active AI deployment should be running through the numbers on. Astrix employs 120 people across Tel Aviv and New York and raised $85 million before the exit, one of the more capital-efficient outcomes in Israeli cybersecurity in recent memory, and a five-year proof of concept that the fastest way to build a category is to find the problem that everyone is walking past.