AUSTIN, Texas — CrowdStrike says it will buy identity security startup SGNL for $740 million, aiming to tighten how enterprises grant and revoke access as AI agents and machine identities multiply, Jan. 8, 2026.
The cash-heavy deal is expected to close in CrowdStrike’s first quarter of fiscal 2027, and the company says it is keeping SGNL’s team intact as the technology is folded into the Falcon platform.
What CrowdStrike gets from SGNL
SGNL’s pitch is “continuous identity” — constantly evaluating risk and context so access can be granted, narrowed or cut off in real time, instead of relying on standing permissions that linger long after they’re needed. CrowdStrike said the goal is to extend that dynamic authorization across SaaS apps and hyperscaler cloud access layers, protecting human users as well as non-human and AI identities. Read CrowdStrike’s announcement of the SGNL acquisition.
The timing reflects a shift defenders have been warning about for years: attackers increasingly “log in” with stolen or abused credentials rather than smash through perimeter controls. In comments to Reuters, CEO George Kurtz framed SGNL as an “identity fabric” that helps CrowdStrike respond to that reality.
Why CrowdStrike is betting bigger on identity
CrowdStrike entered the identity space in 2020 and has grown it into a meaningful line of business. Reuters reported the company’s identity business generated more than $435 million in annual recurring revenue as of the second quarter of fiscal 2026.
Industry watchers say SGNL is also a wager on “agentic” workflows, where automated systems request access, pivot between tools and touch sensitive data at machine speed. CSO framed the acquisition as a move to bring risk-aware authorization into the heart of identity security, especially as machine identities and AI agents reshape access control. See CSO’s coverage: CrowdStrike to acquire SGNL for $740M.
SecurityWeek likewise noted the deal is meant to bolster Falcon with “continuous identity” protection that can respond to real-time conditions rather than static rules. More: SecurityWeek: CrowdStrike to buy identity security firm SGNL for $740 million.
CrowdStrike’s roadmap, in context
SGNL fits a pattern: CrowdStrike has repeatedly used acquisitions to widen Falcon beyond endpoint protection. The company bought Preempt Security in 2020 to add conditional access signals (Dark Reading’s report on the Preempt deal), acquired log management firm Humio in 2021 to expand data and detection (TechCrunch on the Humio acquisition), and confirmed its Bionic acquisition in 2023 to push deeper into cloud and application risk (TechCrunch on CrowdStrike and Bionic).
For customers, the immediate question is whether CrowdStrike can make SGNL’s continuous authorization feel native inside Falcon — and do it fast enough to matter as AI-driven access requests become routine. BankInfoSecurity reported CrowdStrike is positioning the move as real-time identity control for both humans and AI agents: CrowdStrike adds real-time identity control with SGNL deal.
