On September 3, 2026, Cyera completed its acquisition of Oasis Security in a deal Cyera valued at $1 billion. The letter of intent was signed on July 28 — thirty-seven days from handshake to close. The Oasis platform now operates as Cyera Identity. NHI Governance: Cyera completes Oasis Security acquisition · Security Boulevard: Every identity giant just bought an AI agent company
Oasis was the largest independent pure-play vendor in non-human identity management — the company that governed the identities of service accounts, API keys, and AI agents. Four months before the deal, it had raised a $120 million Series B led by Craft Ventures, taking its total funding to about $195 million. Cyera paid roughly five times that funding total, mostly in cash with the remainder in Cyera shares.
Cyera itself is the other half of the story. A data security company, valued at $12 billion, with more than $2.3 billion raised — and in September it added a further $400 million from Goldman Sachs. It bought Oasis not to add a feature, but to add the second half of a sentence: it already knew where the sensitive data was. Now it also governs who — and what — can touch it.
Why it matters
This deal did not happen alone. Within weeks of it, Cisco closed its acquisition of Astrix Security, SailPoint closed Entro Security, and Okta closed Permiso — all non-human identity vendors, all absorbed by platforms. The entire NHI category effectively consolidated in a single summer. That is not a coincidence. It is the market deciding, all at once, that AI agents are a workforce now, and a workforce needs identity governance.
Here is the shift as I see it from the chair. For twenty years, identity security meant people: who logs in, what they can reach, when their access gets reviewed. The machine identities were an afterthought — service accounts created by a developer three jobs ago, API keys pasted into a config file, credentials that never expire because nobody owns them. Now the agents are arriving, and every agent is a machine identity that acts at machine speed, with tool access and database access and the ability to make decisions without a human in the loop.
The old answer — discover the identities, then govern them — is still the right answer. The new problem is the ratio. Cyera’s own release claims non-human identities grew nearly 500% in six months. Whether that exact number holds or not, the direction is unmistakable: the population you have to govern is growing faster than any team can review it manually. That is why the platforms are buying NHI vendors instead of building the capability. There is no time to build.
What I’m watching
The first question is integration speed. How quickly does Oasis, now Cyera Identity, actually connect to Cyera’s data classification engine? The pitch is continuous, policy-driven control: an agent’s access follows the sensitivity of the data it touches. That only works if the two systems are genuinely one system. A dashboard that shows both is not the same thing as a control plane that enforces both.
The second question is the failure mode. Mapping machine identities directly to vast data lakes introduces real API chaining risk. And if the continuous controls fail to stay in sync with the data classification engine, an agent can end up with broader access than anyone intended — not through malice, but through drift. The runaway agent is not a science-fiction scenario. It is a permissions bug with a fast actor attached.
The deepest question is the one nobody can answer yet: who owns the agent’s identity when the agent works across companies, across clouds, across vendors? Cyera Identity answers it inside one enterprise. The industry has not answered it anywhere else.
We spent a decade learning to govern human access. We have about a year to learn to govern the access of things that never sleep. The companies that bought the NHI vendors understood the clock.
Leave a Reply