IAM acquisitions in 2026: what changed hands and what it means for your stack

This post covers announcements from March to September 2026, using pages read on 27 and 29 September 2026.

What changed hands?

• 2 March 2026: Veza's CEO wrote that ServiceNow has completed its acquisition of Veza, with Veza's Access Graph to be integrated across the ServiceNow platform.
• 29 June 2026: SailPoint completed its acquisition of Tel Aviv-based Entro Security, which secures non-human identities, secrets and tokens. Financial terms were not disclosed.
• 30 June 2026: Astrix says it is now part of Cisco and ended standalone sales of new licenses from that date; existing customers keep their service.
• No date given: Oasis says on its home page that it has been acquired by Cyera.
• No date given: Apono says on its home page that it is now part of 1Password.
• One redirect: zillasecurity.com now leads to Palo Alto Networks' Idira Identity Governance page. We did not find the terms or date of any deal, so we do not state one.

Which IAM jobs do these deals touch?

Veza works in lifecycle and governance, and covers part of application coverage by revealing accounts outside identity platforms. Entro, Astrix and Oasis all describe security for non-human identities: service accounts, secrets, tokens and, increasingly, AI agents. That work sits mostly in the privileged access job, with a share in governance. Idira describes robotic process automation for applications that lack APIs, which is application coverage work. Apono works in privileged access. Separately, Palo Alto Networks introduced Idira on 12 May 2026 as its identity security platform and an upgrade path for CyberArk customers.

What pattern shows up?

Three of the companies, Entro, Astrix and Oasis, describe non-human identity security, and in each case the specialist moved inside a larger company. A buyer looking for a standalone machine identity tool in 2026 has fewer choices than a year earlier, and more of the capability arrives as part of a governance or data security platform. Apono, a just-in-time privileged access vendor, followed the same path into 1Password.

What should a buyer ask after an acquisition?

• Is the product still sold on its own, or only as part of the acquirer's platform? Astrix's answer is explicit: no new standalone licenses.
• Will pricing and contracts move to the acquirer's terms, and when?
• Do integrations with the acquirer's competitors continue? Veza lists 325+ integrations; check whether that list changes as the Access Graph moves into ServiceNow.
• Who supports existing deployments, and for how long?

How does this site handle these changes?

Veza stays profiled, and its profile notes the ServiceNow ownership. Entro is not profiled on its own; the deal appears in SailPoint's profile. Astrix, Oasis and Idira are listed as mentioned but not profiled on the stack map, with the reason for each. If a deal changes what a product does or how it is sold, the profile changes when the vendor's pages do.