Identity consolidation in 2026: who bought whom, and what it means for reach

This post covers ownership changes we could confirm on public pages, vendor facts read in September 2026, updated 2026-10-13. Where a date or term was not on the page, we say so.

ServiceNow and Veza

Veza's blog announced on 2 March 2026 that ServiceNow had officially completed its acquisition of Veza, with Veza's Access Graph to be integrated across the ServiceNow platform. The post frames the combination as an enterprise agent identity control plane. For buyers, Veza's access graph now sits next to the ticketing and workflow system many identity teams already use for manual provisioning. Veza is scored on this site; its profile shows where it ranks.

SailPoint and Entro Security

SailPoint announced on 29 June 2026 that it had completed its acquisition of Tel Aviv-based Entro Security, which secures non-human identities, secrets and tokens. Financial terms were not disclosed. Five weeks later SailPoint made Agentic Fabric for AI and machine identities generally available. Together they are the basis of SailPoint's score on this site's machine, service and agent accounts criterion.

Cisco and Astrix

Astrix Security's site says Astrix is now part of Cisco and that it ended standalone sales of new licenses effective 30 June 2026, while existing customers keep their service. Astrix was a non-human identity security vendor. It is not scored here, and a buyer evaluating it would now be evaluating a Cisco offering.

Cyera and Oasis

Oasis Security's site describes its non-human identity platform and states it has been acquired by Cyera. The acquisition date is not stated on the page we read, so we give none.

Palo Alto Networks: CyberArk becomes Idira

Palo Alto Networks unveiled Idira on 12 May 2026 as its next-generation identity security platform and the upgrade path for existing CyberArk customers, covering privileged access with zero standing privilege and just-in-time access, workforce access, and machine and AI identity security. Orchid Security's blog calls Idira the new name of the CyberArk brand. No prices are stated. Separately, the former zillasecurity.com domain redirects to Palo Alto Networks' Idira Identity Governance page, which describes robotic process automation for applications that lack APIs; we could not confirm the terms of that transaction, and we list Idira under tools reviewed but not scored.

1Password and Apono

Apono's homepage says Apono is now part of 1Password. The page gives no date, so we give none.

Growth rather than sale

Not every headline was an acquisition. Saviynt launched Zuma, an AI identity security platform, on 28 July 2026 and stated it had surpassed $300 million in annual recurring revenue, a vendor figure.

What does consolidation mean for reach?

Two patterns stand out. Governance and workflow platforms are buying coverage of identity types they did not reach before, especially non-human and agent identities. And specialist discovery and posture tools are becoming parts of larger suites. Neither pattern by itself extends coverage to applications nobody has connected; that still depends on how each product reaches an application.

What should buyers check?

1. Whether the product you are evaluating is still sold standalone, and under which contract.
2. Whether its roadmap now depends on the acquirer's platform.
3. Whether integrations with tools outside the acquirer's suite are still supported and documented.
4. Whether pricing and packaging changed, and whether existing terms carry over.

Sources