Cyera Acquires Oasis Security for $1B to Secure AI Agents
Data security company Cyera has agreed to acquire non-human identity and AI agent security startup Oasis Security for $1 billion, marking Cyera's third acquisition in 2026. The deal reflects growing enterprise anxiety around the security risks posed by autonomous AI agents proliferating across organizations.
Original sourceCyera, the data security platform backed by significant venture funding, has signed a deal to acquire Oasis Security for approximately $1 billion. Oasis specializes in securing non-human identities — service accounts, API keys, OAuth tokens, and increasingly, AI agents — which have emerged as a major attack surface as enterprises deploy autonomous systems at scale. This is Cyera's third acquisition this year, signaling an aggressive consolidation strategy in the data and identity security space.
The timing is deliberate. As organizations race to deploy AI agents that can read files, call APIs, access databases, and execute multi-step workflows with minimal human oversight, the security perimeter has expanded dramatically. Traditional identity and access management tools were not designed for the velocity or behavioral patterns of machine identities. Oasis has built tooling specifically targeting this gap — monitoring, governing, and remediating risks from credentials and identities that belong to software rather than people.
For Cyera, the acquisition extends its platform from data-centric security into the identity layer that governs how AI agents interact with that data. The combined offering would theoretically let security teams answer both questions simultaneously: what sensitive data exists, and which automated systems can touch it. Whether this integration delivers coherent product coverage or becomes a feature-acquisition footnote depends heavily on how well the two codebases and go-to-market motions can be unified.
The $1 billion price tag underscores how seriously the market is pricing AI agent security as a standalone problem. Oasis had raised around $35 million before this exit, making this a strong return for its investors and a signal to other founders building in the non-human identity space that enterprise buyers — and acquirers — are willing to pay up for credible solutions.
Panel Takes
The Founder
Business & Market
“Oasis raised $35M and exited at $1B — that's a 28x return on invested capital, and it tells you exactly how hot the non-human identity category is right now. Cyera's play here is smart: they're buying a defined buyer relationship with the CISO who already owns AI agent governance, rather than trying to cross-sell from data security into identity, which is a different budget and a different champion. The risk is integration — three acquisitions in one year means three different engineering cultures, three different data models, and a product org that's stitching rather than building. If Cyera can ship a unified platform before CrowdStrike or Wiz rolls up the same capabilities, the moat is real. If not, they've bought a collection of features without a coherent product.”
The Futurist
Big Picture
“The thesis here is specific and falsifiable: within 24 months, non-human identities will outnumber human identities in enterprise environments by a factor that breaks existing IAM tooling, and the blast radius of a compromised AI agent credential will exceed that of a compromised employee credential. If that's true, Oasis's capability set becomes load-bearing infrastructure for every enterprise running agents — and Cyera just bought that position for $1B before the market fully priced it. The second-order effect nobody is talking about: this acquisition accelerates the consolidation of the security stack around whoever can answer 'what data can your agents access and what are they doing with it' as a single query. The companies that lose power here are the point-solution IAM vendors who built for human login flows and never updated their threat model for autonomous systems.”
The Skeptic
Reality Check
“Three acquisitions in one year from a company that still needs to prove its core platform has durable retention is a yellow flag, not a growth signal. The 'AI agents need special security' narrative is real, but Wiz, CrowdStrike, and SentinelOne are all moving into non-human identity — Cyera is buying market position against competitors with 10x the GTM budget. What kills this in 12 months: Microsoft ships native AI agent governance inside Entra ID, the one identity platform that enterprises already have deployed, and the market for a standalone non-human identity tool shrinks to a rounding error. For this to work, Cyera needs to integrate Oasis fast enough that the combined product is defensibly better than the platform players' 80% solution before Ignite 2026.”
The PM
Product Strategy
“The job-to-be-done here is sharp: 'tell me what AI agents are doing with sensitive data, and stop the ones that shouldn't be.' That's a single coherent problem, and the combination of Cyera's data visibility with Oasis's non-human identity coverage is a credible answer to it — in theory. The product risk is that 'combined platform' announcements almost always mean a shared login screen and separate product experiences for 18 months post-acquisition. If Cyera can't get to a unified policy engine where a security team writes one rule that covers both data classification and agent identity, they've shipped a dashboard that requires dual-wielding, and security teams will wait for a native solution instead.”