Data security company Cyera, which recently raised $600 million at a $12 billion valuation, announced Tuesday that it signed a letter of intent to acquire Oasis Security for approximately $1 billion in a deal expected to be paid mostly in cash, with the remainder in Cyera shares. The acquisition marks one of the largest transactions in the rapidly expanding market for AI security, underscoring the urgency with which enterprises are moving to protect a new class of digital assets: AI agents and their associated non-human identities.
The $1 Billion Bet on AI Agent Security
Oasis Security, founded in 2022, focuses exclusively on non-human identities — a category that includes AI agents, service accounts, bots, and automated workflows. As organizations deploy increasing numbers of AI agents to handle tasks ranging from customer support to code generation, the need to manage and secure these entities has become critical. Unlike human users, AI agents can act autonomously, access multiple systems, and potentially escalate privileges in ways that are difficult to monitor with traditional cybersecurity tools.
The deal highlights a surging market for cybersecurity providers defending enterprises against AI-weaponized threats, but also reflects a more fundamental shift: the recognition that identity security must extend beyond humans to encompass the growing machine workforce. Oasis has raised about $195 million from Accel, Craft Ventures, Cyberstarts, and other investors since its founding.
What Are Non-Human Identities and Why Do They Matter?
Non-human identities (NHIs) refer to digital credentials, tokens, and service accounts that represent software programs, AI agents, and automated processes rather than human users. As the number of AI agents proliferates, companies must deploy cybersecurity software that monitors these agents’ behavior and grants them permission to access other software. Without proper controls, a compromised AI agent can become a vector for lateral movement, data exfiltration, or privilege escalation. Oasis’s technology provides visibility into the lifecycle of these identities, detects anomalous behavior, and enforces least-privilege access policies automatically.
Cyera’s Acquisition Spree – Building a Unified Platform
Cyera, which shares investors Accel and Cyberstarts with Oasis, has been on an acquisition spree, recently purchasing Index Ventures-backed Ryft and the less-than-one-year-old Genie Security. These deals form a pattern: Cyera is assembling a comprehensive identity and data security platform that can address the full spectrum of modern threats — from traditional data exposure to the emerging risks posed by AI agents.
Ryft, a data security startup, brought capabilities in data classification and risk assessment. Genie Security, founded only months before its acquisition, added expertise in cloud identity governance. The addition of Oasis completes a critical piece: the ability to manage non-human identities at scale, which is increasingly seen as the next frontier in identity and access management.
Post-acquisition, Cyera plans to integrate Oasis’s technology into a unified identity and data security platform. This integration will allow customers to manage both human and non-human identities from a single console, enforcing consistent policies across users, machines, and AI agents. For a company that started as a data security posture management (DSPM) provider, this move signals a significant expansion into the identity security space.
Financial Realities – High Growth, Heavy Losses
Although Cyera recently surpassed $150 million in annual recurring revenue (ARR), the company is far from profitable, as reported last month. The five-year-old company has raised about $2.3 billion in total funding, including the $600 million round at a $12 billion valuation earlier this year. The $1 billion acquisition price for Oasis, which will be paid mostly in cash, represents a significant cash outlay for a company that is still burning through capital.
The financial structure of the deal — mostly cash with a minority in shares — suggests that Cyera’s investors are confident in the company’s ability to fund the acquisition from its existing war chest. However, it also raises questions about the sustainability of Cyera’s growth trajectory. The company is operating at a high multiple of ARR to valuation, and the acquisition of Oasis, while strategically sound, will add to the cash burn in the near term. The challenge for Cyera’s leadership will be to demonstrate that the combined platform can accelerate revenue growth and improve margins before investor patience runs out.
The Strategic Logic – Why Oasis?
Several factors make Oasis an attractive acquisition target for Cyera. First, the technology is highly complementary: Cyera’s existing data security platform provides visibility into where sensitive data resides, but Oasis adds the ability to control which entities — human or machine — can access that data. Second, the investor overlap (Accel and Cyberstarts are backers of both companies) likely facilitated deal negotiations and alignment of interests. Third, the timing is critical: the market for non-human identity security is still nascent, and acquiring a leader in this space gives Cyera a first-mover advantage in a category that analysts expect to grow rapidly.
From a product perspective, Oasis’s focus on AI agents is particularly prescient. As enterprises deploy large language models and autonomous agents, the complexity of managing credentials and permissions multiplies. Traditional identity and access management (IAM) tools are designed for human users, who have fixed roles and predictable behavior. AI agents, by contrast, can create and revoke their own credentials, operate across cloud environments, and work in real time. Oasis’s machine learning-based approach is built to handle this dynamic environment, flagging anomalous behavior such as an agent suddenly requesting access to a database it has never touched before.
Market Implications – The Surge in AI Cybersecurity
The Cyera-Oasis deal is part of a broader wave of consolidation in the cybersecurity industry, driven by the rapid adoption of AI. In the past year, several major security vendors have made acquisitions focused on AI security, including CrowdStrike’s purchase of a machine learning platform and Palo Alto Networks’ acquisition of a cloud security startup. The difference here is the specific focus on identity — a domain that is often overlooked in the rush to protect AI models and data pipelines.
Enterprises are beginning to realize that the security of AI systems depends not only on the integrity of the models themselves but also on the identities that govern their access to internal resources. A compromised AI agent can be just as dangerous as a compromised human account, especially if it has been granted broad permissions to perform tasks like data analysis or system administration. The market for non-human identity security is expected to grow from under $1 billion today to several billion within the next five years, according to industry estimates. Cyera’s bet on Oasis positions it to capture a significant share of this emerging market.
Competitors are likely to respond. Microsoft, Okta, and CyberArk already offer identity security solutions, but none have made a dedicated acquisition focused on AI agents. The Cyera-Oasis deal may trigger a wave of similar transactions as other vendors scramble to fill the gap. For startups in the non-human identity space, the acquisition price of $1 billion for a company that raised $195 million and was founded only three years ago will serve as a benchmark for future valuations.
Integrating the Pieces – Challenges and Opportunities
Post-acquisition, Cyera faces the challenge of integrating Oasis’s technology into its existing platform without disrupting existing customers. The two companies have overlapping but distinct customer bases: Cyera’s strength lies in large enterprises with complex data environments, while Oasis has focused on cloud-native companies and AI-first startups. Combining these go-to-market motions will require careful coordination of sales teams, product roadmaps, and support infrastructure.
From a technical standpoint, integration involves mapping Oasis’s identity graph to Cyera’s data classification engine, creating a unified policy engine that can apply rules across both human and non-human identities. For example, a policy that blocks a human user from accessing sensitive financial data could be extended to automatically block AI agents that attempt to access the same data, unless specific approvals are granted. Achieving this level of integration will take months, but the payoff could be substantial: a single platform that covers the entire identity and data security landscape.
The acquisition also brings talent. Oasis’s founding team, which includes veterans from cyber intelligence and cloud security, is expected to lead Cyera’s new non-human identity business unit. This injection of expertise could help Cyera accelerate its product roadmap and stay ahead of competitors who are still building their own NHI capabilities from scratch.
For customers, the immediate benefit is the promise of a single vendor for data security, identity governance, and AI agent protection. This consolidation reduces the number of security tools that need to be managed, simplifies compliance reporting, and lowers the risk of misconfigurations that arise from using multiple disconnected products. Over time, Cyera plans to offer automated workflows that detect and respond to identity threats in real time, potentially reducing the mean time to containment for incidents involving compromised AI agents.
Looking forward, the success of the acquisition will depend on Cyera’s ability to execute on integration and to convince enterprise buyers that non-human identity security is a must-have, not a nice-to-have. The company’s $150 million in ARR provides a solid foundation, but the path to profitability remains uncertain. With $2.3 billion in total funding and a valuation of $12 billion, Cyera is under pressure to show that its platform approach can generate the kind of recurring revenue growth that justifies the high multiples. The Oasis acquisition, if executed well, could be the catalyst that transforms Cyera from a promising data security startup into a dominant player in the next generation of enterprise cybersecurity.
