Cyera Agrees to Acquire Oasis Security for $1B to Safeguard Proliferating AI Agents

Data security firm Cyera announced on July 28, 2026 that it has signed a letter of intent to acquire Israeli cybersecurity startup Oasis Security for $1 billion, in what multiple reports confirm is the largest acquisition yet in the emerging "non-human identity" security category. The deal — Cyera's third this year alone — signals that enterprise security teams are no longer treating AI agent governance as a future problem.

Background You Need

For most of the last decade, enterprise identity security meant managing human user accounts: who can log in, what systems they can reach, when their access should be revoked. That model assumed people were doing the clicking. It no longer holds. Modern enterprise infrastructure now runs thousands of automated processes — service accounts, API integrations, CI/CD pipelines, and increasingly, AI agents that browse the web, write code, query databases, and send messages autonomously. These are what the industry has started calling "non-human identities," and until recently, they operated largely outside the access-governance frameworks that govern their human counterparts.

Oasis Security was founded in 2022 to address exactly that gap. Its co-founders, CEO Danny Brickman and CPO Amit Zimerman, both veterans of IDF intelligence Unit 81, built a platform specifically designed to inventory non-human identities across an organization's infrastructure, scope what they're allowed to access, monitor for behavioral anomalies, and revoke credentials when something looks wrong. The company raised $195 million across its funding rounds, and Globes — which first broke the story of acquisition talks earlier this month — notes that the two companies are both Israeli firms, making this an all-Israeli deal in an industry where cross-border M&A is the more common headline.

Cyera, for its part, has spent the past several years building out a data security platform now valued at $12 billion, with total funding of $2.3 billion. Its existing capabilities sit on the data side: knowing where sensitive information lives and who has touched it. The Oasis acquisition is intended to close a conspicuous gap — Cyera could tell you what data existed, but not necessarily what an AI agent was doing with it in real time.

What's New

The announcement confirms an LOI has been signed, with a binding agreement and regulatory conditions still to follow. Under the terms described so far, Oasis will not be absorbed wholesale into Cyera's product line — multiple reports indicate it will continue operating as an independent unit within Cyera, maintaining its focus on non-human identity security. The split between cash and equity in the $1 billion price has not been disclosed.

The strategic logic Cyera is articulating goes beyond a simple feature add. The company says the combination is meant to give organizations a unified picture of the relationship between sensitive data and everything trying to access it — human or not. That framing matters: the traditional enterprise security stack treats data security and identity security as adjacent but separate disciplines, handled by different vendors and different teams. Cyera is betting that AI agents make that separation untenable. An agent that has read access to financial records is both an identity problem and a data problem simultaneously, and a platform that treats them as one is harder to evade.

TickrWire notes this is Cyera's third acquisition in 2026, which puts the pace of consolidation in context. This isn't a company making a single calculated bet on a new category — it's an aggressive platform-building strategy, executed fast, while the NHI market is still being defined. Ctech's reporting emphasizes the framing of Cyera as an "AI-powered cybersecurity platform" in the making, not just a data security point solution that picked up a side acquisition.

Our read is that the $1 billion price on a four-year-old startup is the more significant signal in this deal than the product integration. Oasis went from founding in 2022 to a ten-figure exit in the same year that AI agents moved from demo novelty to production infrastructure. That compressed timeline reflects how fast enterprise security teams are realizing they're exposed — not in some theoretical future state, but right now, in systems already running.

The Pushback

There are legitimate reasons to approach the NHI category with some skepticism, even as the deal validates it. The core challenge is instrumentation: you cannot govern what you cannot see, and many organizations deploying AI agents today have limited visibility into what those agents are actually doing at the API call level. Bolting an identity governance layer onto infrastructure that wasn't built with agent observability in mind is harder than buying a platform that promises to do it. The integration work required to make Oasis's inventory and monitoring capabilities meaningful in a given enterprise will depend heavily on how well that enterprise has already structured its agent deployments — which, for most organizations, is not very well at all.

There's also the question of whether the independent-unit structure survives real product integration pressure. Acquisitions that preserve the acquired company as a standalone unit often do so to retain talent and customers while the acquirer figures out what to do next. Whether Oasis's technology becomes genuinely native to Cyera's platform, or remains a bolted-on module, will determine whether the $1 billion price looks prescient or premature in two years. The binding agreement isn't even signed yet, so both the timeline and the structure remain in flux.

Sources