Cisco announced its intent to acquire Astrix Security Ltd. on May 4, 2026, in a deal valued at between $250 million and $400 million, marking one of the most significant moves yet in the emerging non-human identity (NHI) security market. Astrix's platform discovers, governs, and continuously monitors NHIs (Non-Human Identities — the API keys, OAuth tokens, service accounts, SSH keys, and IAM roles that software systems and AI agents use to authenticate and interact with one another) across enterprise environments. The acquisition will integrate Astrix's capabilities into Cisco's existing identity portfolio, including Cisco Identity Intelligence and the Duo Identity and Access Management platform.
What Is Non-Human Identity Security and Why Does It Matter Now
When most security professionals hear "identity," they think of human user accounts — passwords, MFA tokens, Active Directory entries. But modern enterprise environments contain far more non-human identities than human ones. Every microservice that calls an API, every CI/CD pipeline that pushes code, every SaaS integration that syncs data, and every AI agent that takes autonomous action on behalf of a user relies on a credential of some kind — typically an API key, OAuth token, service account, or IAM role.
These machine identities share a common security problem: they are created prolifically, managed inconsistently, and almost never rotated or retired systematically. An organization might have thousands of OAuth app integrations that no employee actively monitors, hundreds of long-lived API keys embedded in production code, and dozens of service accounts with administrative privileges that have not been audited in years.
When AI agents enter the picture, the problem scales dramatically. An AI agent (an autonomous software system that takes actions — browsing the web, calling APIs, reading and writing files — on behalf of a user or organization) is by definition a non-human identity operating at machine speed. Each agent needs credentials to function. In organizations deploying multiple AI agents across different workflows, the number of NHIs associated with agentic systems alone can outpace the entire legacy NHI inventory in months.
This is the market Astrix Security was founded to address — and the market Cisco is now betting will be central to enterprise security for years to come.
About Astrix Security
Astrix was founded in 2021 by Alon Jackson (CEO) and Idan Gour (CTO), both veterans of Israel's Unit 8200 (the Israeli military intelligence signals unit that has produced an outsized number of the world's leading cybersecurity companies, including Check Point, CyberArk, and SentinelOne). The company raised $85 million in outside funding and employed 121 people before the acquisition announcement.
The Astrix platform operates without acting as a proxy — it uses a non-proxy, API-based architecture that reads metadata rather than intercepting traffic, making it easier to deploy across large, heterogeneous environments without introducing latency or single points of failure. Its core capabilities include:
- Continuous NHI discovery and inventory: Maintains a live inventory of every service account, OAuth application, API key, IAM role, and SSH key across connected systems, mapped in an Identity Graph that shows access paths, permissions, and creation context.
- Remediation of stale and overprivileged NHIs: Automatically identifies and remediates unused or excessively permissioned NHIs — rotating or removing them without breaking dependent services.
- Just-in-time provisioning for AI agents: Issues short-lived, precisely scoped credentials to AI agents at task time rather than granting long-lived access upfront, significantly reducing the blast radius of a compromised agent.
- Threat detection and response: Monitors NHI behavior for anomalies — unusual IP addresses, abnormal API call patterns, out-of-scope agent actions — and triggers automated response workflows.
The Deal: Terms and Strategic Fit
Cisco's blog confirmed the intent to acquire. Ctech reporting places the deal value at $400 million, representing at least a 25% premium to Astrix's last known valuation of approximately $200 million. The deal is pending regulatory review.
Cisco plans to integrate Astrix into two existing products:
- Cisco Identity Intelligence — Cisco's identity threat detection and response (ITDR) platform, which currently focuses primarily on human identity threats. Adding Astrix extends ITDR coverage to non-human identities, closing a gap that has been a persistent blind spot in most enterprise security programs.
- Cisco Secure Access and Duo IAM — Cisco's zero trust access products will gain the ability to apply Astrix's NHI governance policies at access decision time, enabling context-aware controls for machine-to-machine connections alongside human ones.
Menlo Ventures, an Astrix investor, characterized the acquisition as confirmation of the thesis that "identity is becoming the control layer for AI security."
Why This Acquisition Matters to Security Teams
The Cisco-Astrix deal is the clearest signal yet that NHI security is moving from a niche category to a core requirement. Several converging pressures explain the timing:
AI agent proliferation is accelerating the NHI problem. Every enterprise AI agent deployment adds non-human identities to the environment. Unlike human user accounts, which go through HR onboarding and offboarding processes, NHIs associated with AI agents are often created by developers outside any formal identity governance workflow. The result is an expanding shadow identity estate — credentials that IT and security teams did not create and do not monitor.
Supply chain attacks increasingly target NHIs. High-profile breaches over the past two years have demonstrated that attackers specifically hunt for exposed OAuth tokens, API keys, and service account credentials as initial access vectors. The SolarWinds attack used stolen OAuth tokens to pivot through Microsoft 365 environments. The GitHub Copilot credential exposure in 2024 involved a misconfigured service account. The PyTorch Lightning supply chain attack disclosed just hours before this announcement drops a credential stealer explicitly targeting cloud service tokens.
Regulatory pressure is increasing. CISA's recently updated guidance on identity security explicitly calls out non-human identities as an underprotected attack surface requiring formal governance.
Human identity tools do not cover the problem. Leading PAM (Privileged Access Management) and IGA (Identity Governance and Administration) vendors have built their platforms around the assumption that an identity belongs to a person. The session lifecycle, approval workflows, and monitoring logic do not translate well to API keys that authenticate thousands of times per second or OAuth tokens with scopes that span dozens of connected services.
Competitive Landscape
Cisco is not the first major vendor to move in this direction. CyberArk — long the dominant player in PAM — has been extending its platform to cover machine identities through its Conjur secrets management product. Saviynt and SailPoint offer limited NHI coverage through their IGA platforms. Several point solutions, including Clutch Security and Entro Security, have raised funding specifically to address the NHI gap.
What Cisco brings that standalone players cannot is distribution. Cisco's sales relationships with the Fortune 500, its existing Duo and SecureX installed base, and its ability to bundle Astrix into existing enterprise agreements means NHI governance will rapidly move from an optional add-on to a line item in every security architecture review.
What Security and Identity Teams Should Do Now
Regardless of vendor strategy, the underlying problem Astrix addresses is real and addressable today. Security teams do not need to wait for the Cisco integration to take action:
- Build an NHI inventory. Start with a manual audit of OAuth app integrations across your SaaS estate (Google Workspace, Microsoft 365, Salesforce, GitHub). Tools like Google's OAuth app management console and Microsoft's Entra ID enterprise application list provide a starting point.
- Review and revoke stale OAuth tokens. Any OAuth app that has not been accessed in 90 days and has no documented business owner should be considered for revocation. Stale tokens are a free initial access vector for attackers.
- Audit IAM service account permissions. Apply least-privilege principles — a service account that only needs read access to a specific S3 bucket should not have account-wide administrative rights. Review all service accounts with administrator-equivalent permissions immediately.
- Establish a secrets management strategy. If your teams are embedding API keys in source code or environment files, migrate to a secrets manager (HashiCorp Vault, AWS Secrets Manager, or Azure Key Vault) with automated rotation policies.
- Define a governance policy for AI agent credentials. If your organization has deployed AI agents (Copilot, custom agents, automation workflows), document what credentials each agent holds, who is accountable for its access, and how its credentials will be rotated and revoked.
- Monitor for NHI anomalies. Enable logging for all service account and API key activity in your cloud providers. Alert on any service account authenticating from an IP address outside its normal range or performing API calls inconsistent with its documented function.
Background: The Rise of the Machine Identity Attack Surface
The identity security industry spent the past decade building programs around human users — zero trust network access, MFA everywhere, privileged access management, just-in-time access. These investments were necessary and remain important. But they implicitly assumed that an identity corresponds to a person who can be phished, socially engineered, or coerced.
Machine identities have a different threat model. They cannot be phished or socially engineered — but they can be stolen from code repositories, extracted from improperly secured configuration files, or hijacked through supply chain compromises. Once an attacker has a valid API key or OAuth token, they operate with the full permissions of whatever service account it belongs to, often with no session timeout and no MFA challenge.
As AI agents become first-class participants in business workflows — reading email, scheduling meetings, executing code, placing orders, managing cloud infrastructure — the credentials those agents hold will represent some of the most powerful access rights in an enterprise environment. Securing those identities is not a future problem. It is an immediate one, and the Cisco acquisition of Astrix signals that the industry recognizes it.
Conclusion
Cisco's acquisition of Astrix Security for up to $400 million reflects the urgency of the non-human identity problem in an era of AI agent proliferation. Security teams that wait for vendor integration to address NHI hygiene will be exposed in the interim — the steps above can be implemented with existing cloud-provider tools today. The broader message from the deal is clear: every identity in your environment, whether it belongs to a human or a machine, now needs to be discovered, governed, and monitored.
For any query contact us at contact@cipherssecurity.com
