The short answer
Cyera, an Israeli-founded data-security company valued at roughly $12 billion, signed a letter of intent on 28 July 2026 to acquire Oasis Security for about $1 billion — reported as around $700 million in cash plus Cyera stock. Oasis, founded in 2022, secures non-human identities: the service accounts, tokens, digital keys and, increasingly, AI agents that authenticate to enterprise systems without a person behind them. Oasis will run as a dedicated unit inside Cyera, folding identity governance into Cyera's data-security platform.
The deal is a market tell. The moment you ship an autonomous agent, you have created an identity that can log in, carry credentials and reach real systems — and most organisations cannot yet see, govern or audit those identities. That gap is exactly why securing agent identity is a first-order concern for anyone building AI agents, not a problem to bolt on after launch.
What Cyera is buying
Cyera made its name on data security posture management — discovering where sensitive data lives across an organisation's cloud estate and classifying it. In June 2026 it raised about $600 million at a roughly $12 billion valuation, has raised around $2.3 billion in total, and reports more than $150 million in annual recurring revenue, though it remains far from profitable. Oasis is its third acquisition of the year, after Ryft and Genie Security, and by far the largest.
Oasis Security was founded in 2022 by chief executive Danny Brickman and chief product officer Amit Zimerman, and had raised roughly $190 million from investors including Accel, Craft Ventures and Cyberstarts. Its platform inventories and polices the credentials that machines use to sign in: it maps which service accounts, APIs, bots and workloads exist and what they can reach, flags dormant accounts and over-broad permissions, and can rotate or retire those credentials without a human in the loop. In other words, it does for machine identities what identity-governance tools have long done for employees.
Cyera chief executive Yotam Segev framed the logic bluntly: "Knowing your data isn't enough if you can't govern who — or what — touches it." The plan is to merge Oasis's identity governance with Cyera's data-discovery engine so a single platform can answer both "where is my sensitive data?" and "which humans and machines can reach it?" Segev pointed to a nearly 500% jump in non-human identities inside Fortune 500 companies over the past six months as the reason the two problems can no longer be solved separately.
Why is agent identity suddenly worth $1B?
Start with a definition, because the term does a lot of work. A non-human identity (NHI) is any credential that authenticates to a system without a person behind it — a service account, an API key, an OAuth token, a workload identity in a Kubernetes cluster. These have always existed, but they were a manageable background population. AI agents change the math. An agent that plans a change, runs tests and opens a pull request needs to authenticate to your repository, your cloud APIs and possibly your production database, and each of those touchpoints is an identity with a secret attached.
The scale is what turned a quiet problem loud. Non-human identities already outnumber human ones in most enterprises, often by an order of magnitude, and the agent boom is accelerating that curve — hence Cyera's claim of a near-500% surge inside large companies in half a year. Yet governance has not kept pace: industry surveys through 2026 have repeatedly found that most organisations apply weaker controls to machine and agent identities than to employees, and that only a small minority have a real strategy for managing them. A credential that never expires, is scoped far too broadly, and is watched by no one is precisely the kind of foothold attackers prize.
That is why the money is moving. An over-permissioned agent is not a hypothetical: it is a live token that can read data it should never see, or take an action no one reviewed. Securing it means treating secrets as first-class infrastructure — issuing short-lived, tightly scoped credentials from a managed store such as HashiCorp Vault rather than baking long-lived keys into code, and monitoring what each identity actually does. Cyera is betting that this discipline becomes standard operating procedure, and that owning the tooling for it is worth a billion dollars.
A consolidation wave, not a one-off
The Oasis purchase does not stand alone. Non-human-identity security has become one of the fastest-growing corners of the industry, and 2026 has seen a steady run of deals and product launches aimed squarely at it, as identity vendors, data-security firms and cloud providers all move to cover machine and agent access. When incumbents start paying billion-dollar prices to acquire capability rather than build it, that is usually the sign a category has crossed from emerging to essential.
For teams building software, consolidation cuts two ways. The upside is that governing agent identity will increasingly come as part of a platform you may already run, rather than a separate tool to evaluate and integrate. The caution is that platform coverage is not the same as good design: a dashboard that inventories your machine identities does nothing if your agents were architected to request broad, permanent access in the first place. The controls still have to be built into how the agent authenticates and what it is allowed to do — and that is an engineering decision made long before any security platform sees it.
What it means for US & EU AI builders
For US teams racing to put agents in front of customers, the practical message is to fold identity into the agent design itself. An agent should authenticate as its own scoped identity, hold no more privilege than the single task in front of it requires, and draw its secrets from a managed store at runtime rather than from a config file or environment variable committed months ago. Build that way and a future security review — or a future acquisition of the tooling that runs it — is a formality; skip it and you are accumulating a debt that a security audit will eventually call due.
In the EU the same engineering is also a compliance requirement. The EU AI Act pushes providers and deployers of higher-risk AI systems toward documented human oversight, logging and access control, and GDPR has always demanded that you be able to say who — or what — accessed personal data. An agent whose identity you cannot scope, log or revoke is hard to reconcile with either. Designing agent identity properly is not a parallel workstream to EU AI Act readiness; it is a large part of how you demonstrate it.
None of this is a reason to slow down on agents. The organisations getting real value from AI are the ones moving agents into production, not the ones stuck in pilots. The point is that the teams who win are the ones who treat an agent's identity as seriously as its capability — because a capable agent with ungoverned access is not an asset, it is an incident waiting for a date.
How to give your agents an identity layer
A practical sequence you can apply to any agent already in your codebase or on your roadmap:
- Inventory your non-human identities. List every service account, API key, token and agent, what it can reach, and when it was last used. You cannot govern what you have never counted.
- Give each agent its own identity. Do not let agents share a human's credentials or a single shared service account; a distinct identity per agent is what makes logging and revocation possible.
- Scope to least privilege, keep it short-lived. Grant only the access the task needs, issue short-lived credentials, and prefer per-request scoping over standing permissions.
- Centralise secrets. Pull credentials from a managed secrets store at runtime; never commit long-lived keys to code, config or environment files.
- Log and be able to revoke instantly. Record what each agent accesses, alert on anomalies, and make sure you can rotate or kill a compromised agent's access without waiting on a human in the loop.
Cyera's billion-dollar bet is really a bet on a behaviour change: that securing what machines can touch will become as routine as securing what people can touch. The teams building agents today get to decide whether they are ahead of that curve or scrambling to catch up to it.
Frequently asked questions
What did Cyera announce about Oasis Security?
On 28 July 2026 Cyera, an Israeli-founded data-security company recently valued at about $12 billion, said it had signed a letter of intent to acquire Oasis Security for roughly $1 billion — reported as around $700 million in cash with the rest in Cyera shares. Oasis, founded in 2022, secures non-human identities such as service accounts, tokens, keys and AI agents, and would continue as a dedicated unit inside Cyera.
What is a non-human identity, and why does it matter for AI agents?
A non-human identity (NHI) is any machine credential that authenticates without a person behind it: a service account, API key, OAuth token, workload identity or an autonomous AI agent. Every AI agent you deploy becomes one or more NHIs that can log in, hold secrets and act. Cyera says non-human identities in Fortune 500 companies grew nearly 500% over six months and are now the fastest-growing identity type, which is why governing them has become urgent.
Why is identity security consolidating around AI agents in 2026?
As enterprises move AI agents into production, agents authenticate to code repositories, cloud APIs and databases just like employees do, but usually with weaker oversight. Vendors are folding non-human-identity governance into broader data and security platforms so one control plane can see and police both humans and machines. The Cyera-Oasis deal, Cyera's third acquisition of 2026, signals that agent identity is becoming a first-class security category.
What should teams building AI agents do now?
Treat every agent as an identity from day one. Inventory the machine identities and secrets your agents use, issue short-lived least-privilege credentials scoped to a single task, store them in a managed secrets service rather than in code, log what each agent accesses, and be able to revoke or rotate a compromised agent's access without a human in the loop. These controls also map to SOC 2, GDPR and EU AI Act governance expectations.
Does the acquisition change anything for current customers?
The transaction is a signed letter of intent, so it still has to close, and Cyera has said Oasis will keep operating as a dedicated non-human-identity unit. Near term, expect continuity, with tighter integration between Oasis's identity governance and Cyera's data platform over time. The strategic takeaway matters more: securing what machines can touch is now inseparable from securing the data itself.
Sources
TechCrunch — Cyera agrees to acquire Oasis Security for $1B to safeguard proliferating AI agents, 28 July 2026
SiliconANGLE — Cyera to buy nonhuman identity startup Oasis Security for a reported $1B, 28 July 2026
BankInfoSecurity — Cyera Bets $1B on Non-Human Identity Security With Oasis Buy, July 2026
Globes — Cyera acquires Oasis Security for $1b, 28 July 2026