HPE acquires zero-trust authentication startup Scytale, which was founded by the creators of open source projects SPIFFE and SPIRE and had raised $8M to date
Hewlett Packard Enterprise Co. today said that it has acquired Scytale Inc., a startup that develops so-called zero-trust security software …
Context & Ripple Effects
Scytale is a small tuck-in by HPE's standards — $8M raised against the $650M it paid for SimpliVity or the $374M for Zerto — but the asset is unusual: the founders created SPIFFE and SPIRE, the open-source projects that define workload identity for zero-trust architectures. HPE is buying the people who set the standard, not just a product.
The deal also reads as an early move in a line HPE kept extending: three years later it reportedly paid $500M for cloud security firm Axis Security through Aruba, while independent zero-trust players like SecureW2 were raising $80M on certificate-based authentication. Identity and access moved from niche startup territory to core infrastructure M&A.
First-order effects
- HPE gains in-house control of SPIFFE/SPIRE, letting it embed open-source-based workload identity directly into its infrastructure and security offerings rather than relying on third-party tooling.
- Scytale's founders and roadmap shift from independent vendor to HPE subsidiary, ending its run as a standalone startup after only $8M raised.
Second-order effects
- Rival infrastructure and networking vendors face pressure to match HPE's bundled zero-trust story, since customers evaluating HPE stacks now get native authentication rather than a separate purchase.
- Independent zero-trust identity vendors — the space SecureW2 later raised $80M in — compete against a hyperscale-adjacent player giving away standards-aligned identity as part of a platform deal.
Third-order effects
- If the pattern holds, security and identity layers keep consolidating into infrastructure vendors through acquisitions like Axis Security, shrinking the standalone zero-trust startup market to specialists with differentiated technology.
- Acquiring the creators of open-source standards becomes a repeatable playbook: enterprises buy provenance and influence over specifications, not just code, shaping how zero-trust interoperability evolves.
The trend: Infrastructure vendors are acquiring identity and zero-trust security startups to bundle authentication natively into their platforms, turning open-source standards teams into strategic M&A targets.