Palo Alto Wants to Buy the Keys to Your AI Agents — and the Price Tag Tells You Why

dev.to DevOps2026-11-08 17:570 views

Palo Alto Wants to Buy the Keys to Your AI Agents — and the Price Tag Tells You Why

$500 million. For a three-year-old startup pulling in roughly $10 million a year. That's 50x revenue, nearly six times Clutch Security's last valuation — and Palo Alto Networks is reportedly happy to pay it.

That's not a valuation. That's a confession. The security industry has figured out that the perimeter isn't the network anymore. It's the credentials your AI agents carry inside it.

The front line moved — inside your own systems

Your agents outnumber your people 100 to 1. Non-human identities — API keys, service accounts, tokens — now dwarf human accounts in the enterprise, and less than 5% of them sit under any identity-governance oversight. That's not a gap, it's an open door.
96% of enterprise permissions go unused. Cyera's research: a dormant attack surface, sitting there waiting for something — or some agent — to exploit it. Clutch's whole pitch is mapping those identities, flagging excessive permissions, and catching suspicious use.
Almost nobody can actually control their agents. Cisco's AI Readiness Index found only 24% of organizations can control AI agent actions with proper guardrails and monitoring. Just 31% feel fully equipped to secure their agent AI systems. The industry is deploying agents it cannot govern.
Everyone is buying the same thing. Cyera paid ~$1 billion for Oasis. Cisco paid ~$400 million for Astrix. CrowdStrike paid $740 million for SGNL. And Palo Alto already spent $25 billion on CyberArk in February. CyberArk guards human access; Clutch guards machine and agent credentials. Palo Alto is buying the other half of the identity problem.

The honest question

Is 50x revenue a going rate or a peak? Maybe the buyers are right and the perimeter really has moved to agent permissions. Maybe it's a hot market, a scarce category, and acquirers paying up before a rival does. Or maybe a serial acquirer buying another security company is just... a serial acquirer doing what it does.

But here's the part that isn't debatable: the agents are already inside your systems, holding keys nobody is tracking. Whoever controls those keys controls the next decade of enterprise security — and the bidding war says every major vendor knows it.