Before Permiso had a product, Jason Martin and Paul Nguyen had a calendar full of uncomfortable questions. They spoke with roughly 100 enterprise security, engineering, and technology leaders before hiring a CTO or a developer. The founders were veterans of FireEye/Mandiant. They had managed a vast portfolio of network, endpoint, email, and SIEM/XDR products, and had watched identity compromise turn up again and again inside modern breaches. Experience had given them a thesis. The interviews were designed to see whether anyone outside their old office felt the same pain.
The answer arrived as a pattern. Cloud adoption had scattered identity across federated providers, infrastructure platforms, SaaS applications, and local accounts. A security team might collect the logs and still struggle to answer the elementary detective questions: Who is this? What did they do? Was it normal? What should we stop?
That gap became Permiso Security. Martin, Nguyen, Stephen Demjanenko, and Phanikrishna Modali founded the company in 2020. They spent two years out of public view, working with design partners, then emerged in 2022 with a $10 million seed round. The choice to inhabit white space had a lovely inconvenience: there was less competition because buyers did not yet have a tidy category for what the company was selling.
A founder trained by the scene of the crime
Martin did not arrive at cloud identity by following a fashionable acronym. His route ran through more than 25 years of security work on offense and defense, including service as a CISO. In Hawaii, he founded Secure DNA in 2006 and built a company serving enterprises and public organizations across the islands, the Asia-Pacific region, and the continental United States.
In 2011, he gave Hawaii lawmakers a lesson more memorable than a policy deck. Martin prepared a normal-looking website, loaded it with an exploit, and sent a fake iTunes receipt. The recipient saw a disputed $99 purchase and clicked. The demonstration turned spearphishing from an abstract menace into a small piece of theatre with a poisoned prop. Secure DNA said it had recorded 4.4 million attacks against about 100 Hawaii businesses over six months. The numbers were alarming; the fake receipt was personal.
Secure DNA was acquired by FireEye in 2014. Martin moved from founder to corporate operator, eventually becoming EVP of Products and Engineering at FireEye/Mandiant and running those functions globally. His official biography now calls him a “recovering public security company executive,” which is both a résumé line and a useful diagnosis. He had seen what large security portfolios could accomplish. He had also seen the seams between them.
His Hawaii chapter also established a habit of turning private expertise into public infrastructure. Martin helped create Shakacon in Honolulu as a place for security practitioners to trade hard-won knowledge. He served with InfraGard Hawaii, joined conference and company boards, and returned to the University of Hawaii community as a professional-in-residence. The pattern is less about collecting titles than keeping a working circuit between operators, founders, students, and researchers. Security advances through tools, but it also advances when practitioners compare notes before the next incident compares them on harsher terms.
“We wanted to go into white space.”Jason Martin, on choosing Permiso’s market
The seams mattered because attackers do not respect product boundaries. A compromised employee can authenticate through one provider, assume a role in another environment, touch a SaaS application, and leave behind four separate stories. Permiso’s central bet was to correlate those fragments around the actor. The company called the broader model Universal Identity: recognize that several accounts may belong to one human or one machine, then observe the behavior that follows.
The machine at the employee entrance
Artificial intelligence enlarged this thesis without changing its grammar. An AI agent has credentials. It authenticates. It receives permissions and calls tools. It acts for a human, a machine, or another agent. Martin’s shorthand is wonderfully plain: AI is another identity.
The scale, however, is impolite. Human access tends to grow in a fairly legible line: someone joins, accumulates privileges, changes jobs, and perhaps keeps more access than necessary. Non-human identities multiply faster. AI agents can create related workers, perform a task in seconds, and vanish before a security tool’s next four-hour scan. A static inventory can miss an entire working life.
Then there is the matter of appetite. A human with broad privileges may never test their limits. An agent is built to pursue an outcome and can explore every permitted edge at machine speed. In Martin’s formulation, that makes least privilege less like corporate hygiene and more like a load-bearing wall.
“Things blink into existence, do something, and disappear forever.”Martin on ephemeral AI identities
Permiso responded by moving beyond posture, the periodic snapshot of where an agent sits and what access it holds. In May 2026, it launched runtime attribution for AI agents across its platform. The distinction is the difference between a guest list and the evening itself. Configuration tells you who was invited. Runtime tells you who climbed through the kitchen window, borrowed the host’s keys, and called three more guests.
When a new technology changes the speed and number of actors, preserve the clearest old question. For Martin, it is: which identity did what, where, and with whose authority?
Urgency, panic, and the wolf’s bad breath
Martin’s public writing has increasingly turned from product architecture toward founder psychology. He describes founders waking with the wolf’s breath on their necks: competitors raise money, platforms move into adjacent markets, and customers decline to wait politely. Pressure can produce useful urgency. It can also dress panic in a founder-branded hoodie.
He has been candid about crossing that line himself. Panic can appear as a rushed decision, a sharp reply to a colleague, an overreaction to a setback, or micromanagement disguised as care. The admission gives his leadership advice some abrasion. He is not offering a serenity achieved on a distant mountaintop. He is describing the knife edge while balancing on it.
That self-scrutiny fits another paradox he has explored: founders must sell a future before it exists. Martin’s prescription is radical transparency about today paired with severe ambition about tomorrow. Too much polish becomes overpromising. Too much modesty leaves a team without a destination. The leader’s task is to hold both truths without dropping either on someone’s foot.
Permiso’s co-CEO structure added another person to that balancing act. Martin and Nguyen had worked together at FireEye/Mandiant and built the company around complementary authority rather than ceremonial equality. Their partnership also returned customer behavior to the center. Compliments are pleasant. Usage, budgets, and repeated pain are evidence.
The listening did not end after those first 100 calls. By late 2024, Martin described more than 300 interviews with enterprise leaders. That is customer discovery as a permanent operating rhythm, not a workshop performed once and filed away. It helped Permiso explain a market that was still choosing its vocabulary: cloud detection and response, identity threat detection and response, runtime security. Acronyms can make a young category sound settled long before the buyer’s problem is. Martin’s approach was to return to the scene, ask how teams actually investigated, and let repeated friction outrank a fashionable label.
The exit, and the work after it
By 2024, the market had moved closer to Permiso’s language. The company raised an $18.5 million Series A led by Altimeter Capital, with Point72 Ventures participating. Martin wrote that the team had spent three years in stealth building a unified way to track human and non-human identities across the modern enterprise stack.
On July 30, 2026, Okta announced an agreement to acquire Permiso. The logic was unusually direct: authentication answers whether an identity may enter; Permiso watches what happens after entry across cloud and AI environments. Okta disclosed in a regulatory filing that the transaction closed on August 26.
Martin framed the combination as a matter of reach. Permiso’s stated goal had been to help customers stay ahead of identity-based threats. Inside a larger identity platform, its runtime detections and P0 Labs research could reach more organizations. The founding thesis did not disappear in the deal. It acquired distribution.
There are other continuities. Martin co-founded Honolulu’s Shakacon security conference and has advised founders, served on boards, and invested in early-stage companies including Resourcely, Cove, and Fixify. He co-authored two practical books, one on risk assessment and another on security analytics. The work circles the same instinct: collect evidence, make it intelligible, and give someone enough context to act.
And then there is dessert. Permiso’s team page asks executives to name a favorite. Martin chooses every combination of coffee and chocolate: coffee in chocolate, chocolate in coffee. It is a tiny piece of whimsy on a page full of breach experience. It also feels suspiciously on theme. His career has been spent joining things that tools keep apart, until the mixture tells a better story than either ingredient alone.