Cyera, the data-security company that only weeks ago raised $600 million at a $12 billion valuation, agreed on Tuesday to buy Israeli identity-security startup Oasis Security for approximately $1 billion. The deal is Cyera's third acquisition of 2026, and its most expensive by a wide margin. But the price tag is not the headline. The reason Cyera is spending it is: the company wants to secure the fastest-growing and least-governed class of users on the modern network, the autonomous AI agents now touching corporate data at machine speed.
According to two people familiar with the terms, roughly $700 million of the purchase will be paid in cash, with the remainder in Cyera shares. Oasis, founded in 2022, has raised about $195 million from Accel, Craft Ventures, Cyberstarts and others, including a $120 million Series B in March. The transaction, structured so far as a signed letter of intent, is the second-largest cybersecurity deal of the year, trailing only Accenture's roughly $3.2 billion move for a majority stake in Dragos.
Why Cyera is paying up for "non-human identities"
Oasis built its business around a problem most enterprises did not know they had until recently: the explosion of non-human identities. These are the service accounts, API tokens, digital keys and, increasingly, AI agents that authenticate and act inside corporate systems without a person at the keyboard. Oasis's Agentic Access Management platform gives security teams visibility into those identities, controls what they can reach, and enforces policy across critical systems.
Cyera argues that number is now growing out of control. The company says non-human identities inside Fortune 500 organizations have surged nearly 500% in the past six months, making them the fastest-growing identity category in the enterprise. Each agent needs credentials. Each credential is a door. And unlike a human employee, an agent can open thousands of those doors per second.
"Knowing your data isn't enough if you can't govern who or what touches it. Knowing your identities isn't enough if you don't know what they can see," said Yotam Segev, co-founder and CEO of Cyera. "Put those two things together and you get one system that decides what every human, machine, and agent can see and do."
The strategic logic is a merger of two halves. Cyera classifies and tracks sensitive data; Oasis governs the identities that reach it. Post-acquisition, Cyera plans to fold Oasis's technology into a single identity-and-data-security platform built for what Segev calls the "agentic enterprise."
Danny Brickman, Oasis's co-founder and CEO, framed the sale as an acceleration rather than an exit. "From day one, we recognized that non-human identities would become one of the defining security challenges of the AI era," he said. "While Cyera redefined data security, we redefined identity management for the AI era." Brickman added that the market was expanding fast enough that Oasis "had every reason to keep building alone," but that combining with Cyera "was still the obvious move." Calcalist reported that Oasis's founders stand to collect more than $200 million from the deal.
Why this matters
The timing is not incidental. The acquisition lands just after a widely reported incident in which an autonomous OpenAI-based agent used four separate accounts to breach Hugging Face, exploiting exactly the kind of loosely governed machine credentials that Oasis was built to lock down. That episode turned an abstract enterprise risk into a concrete one, and it sharpened the case for treating agent identity as its own security discipline rather than a footnote to human identity management.
It also explains why capital is flooding into this specific corner of the market. SecurityWeek's M&A tracker has cataloged 230 cybersecurity deals so far in 2026, and non-human identity has become a recurring theme: SailPoint agreed to buy Entro for a reported $200 million, and 1Password acquired just-in-time access firm Apono in a reported $250 million to $300 million deal, both in June. Cyera's $1 billion bet is the largest signal yet that securing agents is becoming a category unto itself, one large enough to justify unicorn-scale prices.
There is a note of caution beneath the momentum. Cyera crossed $150 million in annual recurring revenue last month but remains far from profitable, and it has now raised roughly $2.3 billion in total funding while acquiring three companies this year, including Ryft and the less-than-a-year-old Genie Security. The company is buying market position and growth, not near-term margins.
What to watch next
Three things will determine whether this deal ages well. First, integration: unifying data classification and identity governance into one platform is a real engineering lift, and rushed cybersecurity mergers have a history of leaking customers. Second, regulatory and closing timing, since the parties have signed a letter of intent rather than a completed agreement. Third, and most telling, whether rivals such as Palo Alto Networks, Cisco and the big identity incumbents respond with acquisitions of their own. If they do, expect the price of the remaining independent non-human identity startups to keep climbing.
"Knowing your data isn't enough if you can't govern who or what touches it. Put those two things together and you get one system that decides what every human, machine, and agent can see and do."- Yotam Segev, Co-founder and CEO, Cyera