Industry
The 2026 access-management consolidation
In twelve months, five of the products a small team would shortlist for privileged or just-in-time access changed owners. Here is what happened, and what to ask before you sign with any of them — or with us.
What happened
| Completed | Buyer | Bought | What it was |
|---|---|---|---|
| September 2025 | Okta | Axiom Security | Just-in-time access to databases, Kubernetes and cloud, folded into Okta Privileged Access |
| February 2026 | Palo Alto Networks | CyberArk | The best-known privileged access suite. Rebranded Idira from the end of May 2026 |
| February 2026 | CrowdStrike | SGNL | Continuous, risk-based authorization for people, services and AI agents |
| March 2026 | ServiceNow | Veza | Visibility into who and what can access which data and systems |
| March 2026 | Delinea | StrongDM | Just-in-time access to databases, servers and Kubernetes through a proxy |
Separately, ConductorOne — one of the most-named access-request products when we
asked AI assistants about this category — now answers at c1.ai as C1.
That is a rename, not an acquisition, but it is the same kind of change for a buyer: the
name in last year's comparison article is not the name on this year's quote.
What the deals have in common
Read the announcements side by side and two phrases recur in almost all of them: just-in-time and AI agents. The buyers are platforms — a firewall vendor, an endpoint vendor, a service-management vendor, an identity provider, a vault vendor — and each bought a way to grant access at the moment it is needed and take it away afterwards, for people and for the software acting on their behalf.
That is worth saying plainly because it settles an argument. For years, zero standing privilege was a principle people agreed with and did not implement. In 2026 every large security platform paid to own an implementation of it. The idea is no longer the question; which implementation, at what price, inside whose platform, is.
What it means if you are buying now
Nothing here is a prediction about any of these companies. Acquired products are often kept, improved and well supported. But an acquisition changes who decides the product's price, packaging and roadmap, and a buyer should know the answers before the contract rather than at the first renewal. Five questions, for any vendor that changed hands — and, honestly, for any vendor at all:
- "What will this cost at renewal?" Ask for a renewal cap in writing. A price quoted by a startup and renewed by a platform is set by two different companies.
- "Is this still sold on its own?" Or will it become a module of a larger platform license, priced as part of a bundle you may not want.
- "What stops revocation?" If the license lapses, a quota is hit, or the integration breaks, does live access still expire on time? Ask it of every vendor; the just-in-time guide explains why it is the question that decides whether any of this worked.
- "How do we get our data out?" Grant history is audit evidence. It has to be exportable in a format you can read without the product.
- "Which platforms will you still connect to?" A product owned by one platform vendor has less reason to integrate deeply with a rival's. If you run Entra and Okta, or Google and GitHub, ask about the roadmap for both.
Where we stand
We are small and independent, and we would rather say what that means than imply it means more. Our price is on the pricing page, and why it costs this little carries a commitment in writing: we will not charge existing customers more for what they already have. No plan limit, quota or billing state can stop access from expiring. Grant history exports to CSV. And we connect to Entra ID, Okta, Google Workspace, GitHub, AWS IAM and Active Directory because not being any of those platforms is the point.
If you are shortlisting, just-in-time access tools compared sorts the independent and acquired products alike by the job they do, and who TemprBac is for will tell you in two minutes whether we belong on the list at all.