NewCore vs Okta: a security-first IdP for agents or the incumbent workforce identity cloud

Okta is the identity provider most workforces already sign in through. NewCore, out of stealth in June 2026 with USD 66M from Cyberstarts, Index Ventures, and Evolution Equity Partners, argues that the IdP itself should be rebuilt for a workforce where AI agents outnumber people. Its founders include Zohar Alon, who previously founded Dome9.

Both handle sign-in, phishing-resistant MFA, and governance, and both now give AI agents an identity. Okta does it with published suites and an Okta for AI Agents add-on. NewCore treats every agent as a first-class identity with its own lifecycle, trust score, and revocation, protects token signing with a split-key architecture, and says customers can migrate without downtime by keeping existing federations and policies. NewCore’s capabilities are launch claims, stated rather than independently demonstrated.

Buy NewCore when you are willing to replace the IdP to get split-key token signing, hardware-bound credentials, and agents governed under the same policy grammar as people. Buy Okta when you want a mature workforce IdP with published per-user pricing, a large app integration catalog, and agent identity added as a module.

Overview

	NewCore	Okta
Primary use case	Replacement IdP built security-first for human, machine, and AI agent identities	Workforce identity cloud for SSO, MFA, lifecycle, and governance, with AI agent management as an add-on
Day-to-day workflow	Discover identities and access paths in one graph, then enforce and audit one policy set across people and agents	Manage apps, users, and policies in Okta, automate joiner-mover-leaver flows, and review access
Main buying consideration	No public pricing. Sold by demo to enterprise customers	Starter USD 6 and Essentials USD 17 per user per month. Professional and Enterprise are quoted

We reviewed NewCore’s homepage and ynet’s June 2026 launch report, plus Okta’s Workforce Identity pricing page, its key rotation and migration developer guides, and the Okta Device Access documentation, on 14 Oct 2026. We did not run either product.

NewCore

Okta

Editions and pricing

Okta publishes suite pricing with a footnote on terms. NewCore publishes no packaging.

	NewCore	Okta
Entry	Not confirmed in public documentation	Starter, USD 6 per user per month: SSO, MFA, Universal Directory, 5 Workflows
Mid tier	Not confirmed in public documentation	Essentials, USD 17 per user per month, adds Adaptive MFA, Privileged Access, Lifecycle Management, Access Governance. Core Essentials is USD 14 per user per month
Top tiers	Not confirmed in public documentation	Professional and Enterprise are quoted and add Device Access, ISPM, Identity Threat Protection, API Access Management, Access Gateway, and Machine-to-Machine Tokens

Protecting the trust layer

Both offer phishing-resistant sign-in. NewCore’s pitch is that signing authority itself is an attack path.

	NewCore	Okta
Token signing	Split-key signing architecture intended to remove single points of failure	Okta automatically rotates the keys used to sign tokens and publishes them to the jwks_uri; custom authorization servers can switch rotation mode
Authenticators	Phishing-resistant MFA and hardware-bound credentials tied to TPM and Secure Enclave	Adaptive MFA described as phishing-resistant. Okta Device Access adds Desktop MFA for Windows and macOS and Platform SSO for macOS with a Secure Enclave-backed key, in Professional and above
Threat response	Protects sessions and policy decisions as part of Identity Security	Identity Threat Protection in Professional and above

AI agents and migration

Both now name agents. The difference is whether agents share the core or arrive through an add-on.

	NewCore	Okta
Agent identity	Agents are first-class identities with their own lifecycle, trust score, and revocation, under one policy grammar	Okta for AI Agents add-on to manage AI agents from a single control plane
Discovery	One live graph of humans, agents, accounts, apps, and access paths, including shadow and orphaned accounts	ISPM in Professional and Enterprise
Migration	Says customers can migrate without downtime by keeping existing federations and policies	Okta’s migration guide covers hashed password import (BCRYPT, SHA-1, SHA-256) and password import inline hooks that verify against the legacy system at first sign-in

Choose NewCore when the IdP itself is the risk you want to fix, and you can take on a new vendor to get split-key signing, hardware-bound credentials, and agents under the same policies as people. Choose Okta when you want published pricing, a proven workforce IdP, and agent management added to the stack you already run.