Cyera's $1B Oasis Security Acquisition: Why AI-Agent Identity Matters

Updated October 31, 2026. On September 3, 2026, Cyera confirmed that it had completed its acquisition of Oasis Security in a transaction valued at $1 billion. It was an acquisition, not a new $1B fundraising round** for either company. Oasis brought non-human identity (NHI) governance and AI-agent access control to a Cyera product portfolio originally built around sensitive-data discovery and protection.

This deal offers more substantive evidence of Cyera's direction than its subsequently reported $20B valuation talks. However, the open question is whether the two platforms operate as one product for customers, not whether a parent company can own both codebases.

Oasis acquisition facts and timeline: price, funding and integration

Cyera's official closing announcement establishes the $1B acquisition value. Craft Ventures confirmed that it led the $120M Series B, while Oasis's own newsroom lists $195M total financing. The $1B exit value and Oasis's $195M prior funding are different metrics. Dividing one by the other does not calculate investor returns: ownership dilution, security type, liquidity preferences, fees and participation all matter.

Oasis was founded in 2022 by Danny Brickman and Amit Zimerman. The company had previously raised its initial $40M and a $35M extension; the announced financing milestones sum to $195M. Its Series B valuation was not disclosed by the company, so reports of a roughly $700M prior valuation should be labelled external estimates.

What did Cyera actually buy?

Most businesses already manage a directory of people. But their systems also contain identities that are not people: Kubernetes workloads, CI/CD service accounts, cloud managed identities, SaaS integrations, database roles, API tokens and autonomous AI agents.

Oasis's value is the ability to inventory and govern those machine/agent identities. Cyera's value is discovering and classifying the data they can reach. Together they aspire to answer a two-sided question: Which identity or AI agent can perform which operation on which sensitive record?

A concrete example helps:

1. An AI agent has a service identity allowing it to call a customer-support tool.
2. That tool has broad read access to customer records, including personal and financial information.
3. Cyera's classification may identify the records as sensitive, while Oasis identifies the agent and credential chain.
4. A combined policy could restrict or require approval for specific actions before data leaves the approved workflow.

That workflow is an illustration of the combined product ambition, not proof that every step was already unified in production. In its September 30 product update, Cyera explicitly said existing Oasis customers would stay on the Oasis platform during integration.

Why non-human identity matters for the AI-agent economy

AI agents are identities with tool access, not only prompts sent to a model. A compromised secret is one failure mode. Another is a valid credential used for an action beyond the business's intended purpose. Long-lived service accounts and orphaned permissions worsen the risk.

NHI governance addresses the who and with what permissions. Data security posture management (DSPM) addresses which data, where and how sensitive. DLP addresses where data moves. Agent monitoring adds what action happened in a tool call. Bringing these together could reduce detection and remediation time, but it also creates integration and pricing complexity.

For engineering and security teams, the practical questions are whether the product can discover actual cloud workload credentials, resolve their owners and secrets, correlate sensitivity, enforce revocation or just-in-time access, and produce audit evidence without excessive false positives.

What the deal says about Cyera's six acquisitions

By June 2026 Cyera said it had completed five acquisitions, including Trail Security, Shape AI, Otterize, Ryft and Genie Security. Oasis was number six. Those deals broaden Cyera's offerings into DLP, AI data governance and machine identity.

For venture investors, acquired product breadth and integrated platform adoption are not the same KPI. Cyera has not publicly disclosed Oasis's acquired revenue, margin contribution, retention, proportion of cash/stock consideration or a pro forma post-acquisition ARR figure. Do not infer those from the $1B price.

Will Cyera replace identity vendors and cloud security platforms?

Not necessarily. Existing environments may rely on Microsoft Entra, CyberArk or dedicated NHI specialists for identity, while Microsoft Purview, Varonis or BigID govern data. Wiz/Google Cloud covers overlapping cloud exposure and attack-path risks.

Cyera's opportunity is cross-domain correlation, not the elimination of all those controls. Customers should test overlap before buying another suite. See our Cyera-versus-competitors guide for a workload-based evaluation.

How to evaluate Cyera and Oasis: five due-diligence steps

1. Inventory: Does it identify orphaned service accounts and sensitive databases across the buyer's actual cloud/SaaS estate?
2. Identity-to-data graph: Can it show which agent, tool, token and human owner are responsible for access?
3. Enforcement: Can it revoke, scope or time-limit permissions in the live workflow, with reliable rollback?
4. Operations: What fraction of tasks still require separate Cyera and Oasis consoles, integrations or licenses?
5. Economics: Does using both products reduce risk-management labor and incremental software spend enough to support renewal?

The sale could be a landmark outcome for an NHI startup, but the verdict on a unified data-and-identity platform will come from deployments, not from a press release.

Frequently asked questions

How much did Cyera pay for Oasis Security?

Cyera announced a $1B transaction value when it completed the acquisition on September 3, 2026. Full economic terms were not publicly itemized.

How much funding did Oasis Security raise?

Oasis publicly described $195M in total equity financing after its March 2026 $120M Series B. The purchase price was not new startup funding.

What is non-human identity security?

It is discovering, assigning ownership to and governing accounts or credentials used by workloads, bots, services and AI agents rather than people.

Are Oasis and Cyera already one application?

Cyera said September 30 that Oasis customers would continue using the Oasis platform with unchanged deployment/support while integration continued; a completely unified production rollout was not confirmed.

Is Oasis Security still independent?

No. It is an acquired Cyera business. See the Oasis Security profile for its historical funding and investors.