Cyera's $1B Oasis deal: agent identity tools consolidate

Cyera signed a letter of intent on July 28 to acquire Oasis Security for roughly $1 billion — about $700 million in cash with the rest in Cyera shares. Oasis governs non-human identity: the service accounts, tokens, keys, and AI agents that now outnumber your employees in every system you run. Read the sentence carefully, though. This is a letter of intent, not a closed deal, and the category you're being sold on is consolidating fast enough that whoever you pick this quarter may be somebody else's product line by Christmas.

What actually happened

Per TechCrunch, Oasis was founded in 2022, raised about $195 million from Accel, Craft Ventures, and Cyberstarts, and monitors agent behavior while granting permission for software access. Cyera itself just raised $600 million at a $12 billion valuation, runs north of $150 million ARR, is not profitable, and has now made three acquisitions this year — Ryft, Genie Security, and Oasis. Accel and Cyberstarts sat on both cap tables.

SecurityWeek called it the second-largest cybersecurity M&A deal of 2026, and quoted Cyera's rationale plainly: knowing your data isn't enough if you can't govern what touches it. That's a real observation. It's also a platform vendor explaining why it needs to own the layer above the one it already sells you.

Why AI agent identity consolidation matters for your business

The technical problem is legitimate and we've written about it twice this month — dormant permissions your agents inherit, and grants you can't revoke. Three billion-dollar-adjacent moves in one category in one year tells you the market agrees.

Here's the trap for a ten-person company. You buy the point tool that solves agent identity today. Eighteen months later it's a module inside a $12 billion data-security platform with a floor price built for the Fortune 500, your renewal quote triples, and the migration path out runs through a config format nobody documented.

So put the durable controls where a vendor change can't reach them. Scoped credentials issued per agent by your cloud provider's IAM. Secrets in a manager you control — Vault, AWS Secrets Manager, whatever — never in the agent's prompt or repo. Every agent action logged to your own sink, not just the vendor console. Then a governance product becomes something you layer on for reporting, and swapping it is a Tuesday, not a quarter.

Sources: TechCrunch, SecurityWeek.