On February 20, 2026, CrowdStrike completed its acquisition of SGNL, the runtime authorization company. The deal was announced on January 8, 2026, at a press-reported value of about $740 million; CrowdStrike’s own filing later recorded $627.9 million in cash, net of cash acquired, plus $9.2 million in replacement equity awards. SGNL was founded by former Google identity engineers and had raised about $75 million before the deal. NHI Governance: SGNL (CrowdStrike) profile · AccuroAI: The NHI consolidation
SGNL’s technology sits between the identity provider and the resource, evaluating every access request against live context — user behavior, device posture, threat signals — and revoking privileges the moment conditions change. That is a different thing from the directory that says who you are. It is the layer that decides, continuously, whether you still should be.
CrowdStrike moved fast after the close. By June 15 it had shipped the first product from the deal: Continuous Identity for AI Agents, which validates every agent action in real time based on who owns it, who is calling it, and the device’s risk posture. Five months from close to shipped product is quick by any standard, and it tells you the integration was not a holding pattern.
Why it matters
Identity security has always had a timing problem. The login is a moment. The attack is a duration. Everything that matters — the session hijack, the token theft, the privilege escalation, the agent that starts behaving differently an hour into its run — happens after the login, in the long stretch where the old model assumes the authenticated user is still the legitimate one.
SGNL is the answer to that timing problem, and it is the reason CrowdStrike bought it instead of building it. Continuous authorization means the access decision is re-made on every request, with live context. When CrowdStrike’s Falcon platform detects a compromise on a device, the session can be cancelled while the attack is still in progress — not after the incident review, not at the next re-authentication, but now.
That capability is the most differentiated single thing in the 2026 identity wave, and it only works because of what sits upstream. Real-time authorization is powerful precisely because CrowdStrike already sees the endpoint. The device signal is the context. Without it, continuous authorization is a policy engine guessing at risk. With it, the revocation decision is grounded in something real.
This is also the deal that shows the shape of the consolidation most clearly. The NHI vendors — Oasis to Cyera, Astrix to Cisco, Entro to SailPoint, Permiso to Okta, SGNL to CrowdStrike — all went to platforms in the same window. But SGNL is the only one whose buyer already owned the sensor network. The others bought identity to add to a platform. CrowdStrike bought authorization to complete a loop it already had.
What I’m watching
The first thing is the boundary. SGNL is runtime authorization, not identity governance. It decides in the moment; it does not do the access reviews, the entitlement modeling, the certification campaigns. Buyers who need both will still need both, and the vendors who sell governance will be quick to point that out. The honest framing is that CrowdStrike bought the enforcement layer, and the governance layer is still a separate conversation.
The second thing is the agent story. Continuous Identity for AI Agents is the product that justifies the price, because agents are the population whose behavior changes fastest and whose sessions last longest. If that product holds up in real enterprise agent deployments — not demos, deployments — then the $740 million looks like a bargain. If it turns out to be a repackaged session control, the market will know within a year.
The third thing is the speed itself. Shipping in five months is impressive. It is also the kind of speed that skips the hard questions about what happens when the authorization layer and the endpoint layer disagree. The teams that deploy it should test that disagreement on purpose, before an attacker tests it for them.
Authentication tells you who knocked. Authorization, done continuously, tells you whether they should still be inside. CrowdStrike just bought the second half of that sentence — and the second half is where the breaches actually happen.
Leave a Reply