Cisco today announced plans to acquire Oort, an identity threat detection and response (ITDR) technology provider, in a move to boost its identity security portfolio. The deal is expected to close in the first quarter of Cisco's 2024 fiscal year.

Founded in 2019, the Boston-based startup has raised $15 million in funding, including a $3.5 million Seed round and an $11.5 million Series A round co-led by .406 Ventures and Energy Impact Partners (EIP). Cisco Investments notably participated in the Series A round and the vendor has been a strategic investor in Oort since 2022. The two companies did not disclose the financial terms of the acquisition.

Oort offers an API-driven, cloud-native and agentless platform that is designed to help eliminate identity visibility gaps across diverse data sources, uncovers misconfigurations, identifies security vulnerabilities and leverages predictive identity analytics to proactively stop attacks, according to Raj Chopra, SVP and chief product officer at Cisco Security. He added Oort offers the ability to reduce remediation time by giving enterprises a clear understanding of the "blast radius" of an identity-based incident.

The startup integrates with third-party identity providers and human resource systems for identity threat detection, including Cisco Duo, Google Workspace, Microsoft Azure AD (now Microsoft Entra ID) and Sentinel, Auth0 by Okta, Salesforce and ServiceNow. Chopra noted in a blog post this third-party support is in line with Cisco’s commitment to increase interoperability and deliver consistent outcomes regardless of vendor or technology.

The Oort team will join Cisco's Security Business Group, with the networking and security giant planning to integrate Oort’s technology into its Security Cloud portfolio.

“Leveraging Oort’s identity-centric technology, we will enhance Cisco’s Security Cloud’s user context telemetry and incorporate their capabilities across our portfolio, including our Duo identity access management (IAM) technology and extended detection and response (XDR) portfolios,” Chopra wrote.

Verizon’s 2023 data breach report showed 86% of breaches involved the use of stolen credentials and 60% involved the abuse of valid identity credentials.

Identity offers “the ability to establish policies at an individual level for humans, machines and services of what they can access and then continuously monitor behaviors to codify what’s ‘normal’ or ‘abnormal’ in near real-time,” Chopra noted.

That’s why identity security is becoming increasingly important, “largely driven by the rise of remote access, bring-your-own-device (BYOD) policies, and ubiquitous cloud and SaaS [software-as-a-service] adoption that has changed the world forever,” he added.

The Oort buy is Cisco’s fourth security-startup acquisition this year. The vendor bought Valtix in February for multi-cloud security, Lightspin in March for cloud security posture management (CSPM), and announced the intent to acquire Armorblox in May for the use of generative artificial intelligence (AI) and large language models (LLMs) in security.

The vendor is also acquiring Accedian and SamKnows to enhance its observability capabilities, which are converging with security.