Exposure management and identity security vendor Outpost24 has acquired Infinipoint, an Israeli startup focused on device identity and posture validation, marking its formal entry into the fast-growing zero-trust workforce access market. The deal extends Outpost24’s Specops identity security division beyond user-centric controls and into device-aware access decisions, reflecting a broader industry shift toward enforcing zero-trust principles at the point where employees log in to SaaS and internal applications.
Infinipoint positions itself as a device identity as a service provider, assigning strong identities to endpoints and continuously assessing device posture before granting access. Its platform can check whether a device is corporate owned, enrolled in mobile device management, up to date on patches and security controls, and free of known compromise indicators. Those signals are then fed into conditional access policies that integrate with mainstream identity providers and security stacks. Outpost24 says this closes long-standing blind spots where identity platforms could verify a user’s credentials or MFA token but had little visibility into whether the device itself was trustworthy.
According to the companies’ announcement, the acquisition will be folded into Outpost24’s Specops portfolio and used to create a unified access stack that evaluates both user and device. Outpost24 frames this as a way to strengthen its position in identity security by combining password security and MFA protection with continuous device risk assessment. Public statements from Outpost24 leadership describe the move as a response to customer demand for controls that can reduce risk across every stage of the access journey, particularly in remote and hybrid environments where unmanaged or lightly managed devices frequently touch sensitive systems.
The deal underlines how rapidly the zero-trust workforce access space is consolidating around integrated user-and-device offerings. Outpost24 will now compete more directly with established zero-trust access players that already tie endpoint posture to identity, from identity-centric vendors that have added device checks to network-centric secure access service edge platforms. As organizations roll out AI agents, non-human identities and high-risk SaaS integrations, the ability to express policies that say only this user from this compliant device can perform this action is becoming a baseline requirement rather than a nice-to-have. How Outpost24 integrates Infinipoint’s technology into its broader exposure management and identity portfolios will be worth watching, particularly around depth of device integrations, support for BYOD and privacy-sensitive telemetry collection.
Sources: Outpost24 blog, Specops, Business Wire, Channel E2E
—
By the ID Tech Editorial Team
