Identity Consolidation Report 2026: Who Buys Identity

SWI's Identity Consolidation Report 2026 reads 63 identity acquisitions against the ownership of 297 tracked vendors. Identity companies make most of the deals; security, IT and data platforms pay almost all of the money. Five AI-agent identity vendors were bought in 87 days, and 67% of the market is still independent.

Identity companies make most identity acquisitions, but companies from outside identity pay for almost all of them. Of the 33 identity acquisitions announced in 2025 and 2026, identity vendors made 18, yet they account for only about $0.79 billion of the $62.96 billion in priced deal value, according to SWI's Identity Consolidation Report 2026. The report reads the 63 deals in SWI's acquisitions record against the ownership line of all 297 vendor profiles, in a snapshot dated October 31, 2026.

The deal count jumped after 2024

SWI's record holds 63 identity-market acquisitions, and 33 of the 54 announced since January 2023 came in 2025 and 2026 alone: 19 in 2025 and 14 in 2026 to October 31. 2026 has no dominant buyer. All 14 identity acquisitions announced in 2026 had different buyers, and 9 of those 14 were not identity vendors. The most recent, Infotech's purchase of Zluri on October 14, came from an IT research and advisory firm.

For a buyer of identity software, that spread matters more than the count. In 2026 the acquirer was more often from outside identity than inside it, which means the vendor you depend on can end up inside a data, HR, network or research company with its own plans for the product.

The buyer inversion

The report calls the split between deal count and deal value the buyer inversion. Identity vendors such as Okta, SailPoint and Delinea mostly buy features through tuck-ins. Security, IT and data platforms paid almost all of the rest of the priced value, led by Palo Alto Networks' roughly $25 billion purchase of CyberArk and Google's $32 billion agreement for Wiz, which SWI profiles as a CIEM vendor.

That concentration is the honest caveat: Wiz and CyberArk alone account for $57 billion of the $62.96 billion. Take Wiz out, and IT, data and workflow buyers still paid about $1.54 billion in 2025 and 2026 for Veza and Natoma, roughly twice what every identity vendor combined paid for priced deals. Platforms are buying the access control for systems they already run.

AI-agent identity went from category to target in 87 days

SWI profiles 14 AI-agent and non-human identity vendors. Five of them were bought in an 87-day window, from Cisco's Astrix Security announcement on May 4, 2026 to Okta's Permiso Security agreement on July 30, 2026. In between, Snowflake bought Natoma, SailPoint bought Entro Security and Cyera agreed to buy Oasis Security. All five have closed.

The five buyers were a network vendor, a data platform, a governance incumbent, a data security company and an IAM incumbent. If you bought a non-human identity tool in 2025, check who owns it now. The non-human identity platforms ranking tracks the current field.

67% of identity vendors are still independent

Consolidation is concentrated, not universal. 67% of the 297 identity vendors SWI tracks are still independent, meaning not acquired, not pending acquisition, not a product line of a larger company and not controlled by private equity or another financial sponsor. PKI (22%), IAM (40%) and PAM (42%) are the least independent categories. In PKI, four of nine vendors are PE-owned, including DigiCert, Keyfactor and Sectigo. Decentralized identity, at 88%, is the most independent. IGA is the category moving now: with Zluri closed and C1 pending with Workday, its independence rate is 55%.

Reported prices run high, and most deals have none

Deal prices often reach the public twice: as a headline at announcement, and later in the buyer's SEC filing. In all four identity deals where a press-reported price could be checked against a filing, the filing was lower: CrowdStrike's purchase of SGNL by 14%, Axiom Security by 28%, Entro Security by 39% and Spera Security by at least 42%. Part of the gap is accounting, since filings book retention packages separately, and four deals is a small sample. The report's rule still holds: treat a reported price as a ceiling, not a valuation benchmark.

Most deals carry no price at all. Only 17 of the 54 identity acquisitions announced since 2023 came with a disclosed dollar price, and 30 had no dollar figure at all, disclosed or reported.

What to do with the closing window

Deals that were signed and then closed took a median of 56 days; deals of $1 billion or more took a median of 134 days, against 29 days for smaller priced deals. That window is when contract terms are still yours to protect. The report's checklist covers change-of-control clauses, renewal caps, end-of-sale notice and the questions to put to an acquirer in writing. For the reverse case, merging two identity estates, see IAM for mergers and acquisitions.

How we did it

Deals come from SWI's acquisitions record, which a build check cross-references against the ownership line of every vendor profile in both directions, and every price is labelled disclosed (stated by a party to the deal), reported (by a named outlet citing sources) or undisclosed. Figures are nominal dollars of different kinds (equity value, enterprise value, purchase consideration), and the report adds them anyway and says so. Limits: the tracked universe is SWI's profile set plus a targeted search for deals since January 2023, so counts are a floor rather than a census, and ownership classes are editorial judgements listed in the generator script so they can be challenged.

Use the data: download the deal table as CSV or JSON, and the independence rates as CSV or JSON with per-vendor classes. All are free to reuse under CC BY 4.0 with attribution to Start with Identity and a link to the report.

Update, November 5, 2026: The record now includes Omada's purchase of EmpowerID, announced as completed on September 24, 2026 with terms undisclosed. That makes 64 deals in the record and 55 announced since 2023. Identity vendors made 19 of the 34 identity acquisitions announced in 2025 and 2026; the $0.79 billion of $62.96 billion in priced value is unchanged. All 15 deals announced in 2026 had different buyers, 9 of them not identity vendors, and 31 deals since 2023 have no dollar figure. IGA independence falls from 55% to 50%; the market overall is still 67% independent. We have since also added Rubrik's purchase of Strata Identity, an identity orchestration vendor, which Rubrik's release announced as acquired on June 9, 2026 with terms undisclosed. That makes 65 deals, 56 since 2023, and 35 in 2025 and 2026, of which identity vendors made 19 and security platforms 5; priced value is unchanged. 2026 now has 16 deals, all by different buyers, 10 of them not identity vendors, and 32 deals since 2023 have no dollar figure. Current figures are in the report, which keeps its finding numbers stable. With Cyera's Oasis Security completion now dated (3 September 2026), the signed-then-closed median is 52.5 days (was 56) and 132 days for deals of $1 billion or more (was 134).