What was announced, and what was not
On 28 July 2026, the data-security company Cyera announced that it had signed a letter of intent to acquire Oasis Security for approximately $1 billion. The proposed structure is roughly $700 million in cash with the remainder in Cyera shares. The announcement was reported the same day by TechCrunch and SiliconANGLE, and covered in Israel by Globes, Calcalist and The Times of Israel.
The distinction matters more than usual here: a letter of intent is not a completed acquisition. Cyera has agreed to acquire Oasis; it has not bought it. The proposed deal remains subject to a binding agreement and customary closing conditions, and no closing date has been announced.
Oasis Security was founded in 2022, is Israeli, employs 172 people, and has raised $195 million to date. It builds management and security tooling for non-human identities — NHIs — and, increasingly, for AI agents specifically. On completion, Cyera says Oasis would operate as an independent unit within the company. Cyera announced the deal in a blog post headed "One Platform to Secure the Agentic Enterprise". In it — quoted by TechCrunch and SiliconANGLE the same day — chief executive Yotam Segev framed the rationale as unifying identity security and data security into a single platform, to secure what he called the "agentic enterprise". Separately, and per reporting around the announcement, Cyera itself raised $600 million at a $12 billion valuation, up from $3 billion eighteen months earlier.
Roughly $5.8 million per Oasis employee is an aggressive figure by any standard. It is not a bet on 172 people. It is a bet that the category they occupy is about to become mandatory infrastructure.
What "agent identity" actually is
If you have never had to think about this, here is the short version. Every identity and access management system you have ever used was designed around an assumption so basic that nobody wrote it down: the thing holding the credential is a person. People log in at the start of a working day and log out at the end. People sit behind a session that expires. People get onboarded by HR and offboarded by HR, and there is a manager somewhere who can attest to what access they should have. The entire audit and revocation model rests on that shape.
An AI agent breaks every part of it. Your agent is not a user. It authenticates without a human present, which means there is no interactive re-authentication step to hang a policy off. It holds credentials for the duration of a task that might run for hours, and those credentials are usually long-lived because nobody built a refresh path for a process with no user to prompt. It acts asynchronously — the person who triggered it has long since closed their laptop by the time the interesting API call fires. And crucially, it can spawn sub-agents, each of which inherits or is handed some slice of its authority, with no equivalent of a manager approving that delegation.
The subtlety that trips people up is that an agent is not simply a service account with better marketing. A service account is static: one job, one narrow scope, behaviour you can enumerate in advance. An agent decides what to call next. It reasons about its own tool selection, and that reasoning is influenced by content it reads at runtime — documents, web pages, tool outputs, other agents' messages. Nothing in a traditional IAM model was designed for a principal whose next action is a function of untrusted input. That is the whole problem in one sentence, and it is why prompt-injection defence is now an authorisation concern rather than a content-filtering one.
| Dimension | What human identity assumes | What agent identity actually does |
|---|---|---|
| Lifetime | Onboarded by HR, offboarded by HR; existence is tracked in a system of record | Created by a developer in a deploy script; frequently outlives the project that created it, with no owner of record |
| Credential scope | Role-based, reviewed periodically, tied to a job function | Whatever scope made the demo work — commonly a broad token because narrowing it broke a tool call at 11pm |
| Session model | Interactive login, idle timeout, re-authentication and step-up for sensitive actions | No interactive session; a long-lived token used across hours of asynchronous work with nobody present to re-authenticate |
| Audit trail | One actor per action; "who did this" resolves to a named person | The log says the agent did it; the interesting question — which reasoning step, prompted by which input — is usually not captured at all |
| Revocation | Disable the account and access stops everywhere, immediately | Requires finding every place the credential was copied, cached or embedded; there is often no inventory to find them from |
| Delegation and sub-agents | Explicit, approved, rare; delegated access is an exception that gets reviewed | Routine and automatic; a planner agent hands authority to workers it created at runtime, with no approval step and no attenuation by default |
Why a billion dollars is attached to it now
Two forces make this urgent rather than merely interesting, and they multiply rather than add.
The first is population growth. Cyera says non-human identities inside Fortune 500 companies grew by nearly 500% in the past six months, which by its own account makes them the fastest-growing identity category in the enterprise. Treat that as a vendor figure — it is one, and it is in the vendor's interest — but the direction is corroborated elsewhere. Industry surveys put the ratio of non-human to human identities in the average enterprise somewhere between roughly 45:1 and 80:1; the spread across surveys is wide enough that no single number should be treated as settled, and the honest reading is a range. Machine identities in a typical enterprise rose from roughly 50,000 to 250,000 between 2021 and 2025, per industry reporting. Whatever the precise multiple, the population is compounding faster than any manual governance process can enumerate it, let alone review it.
The second force is blast radius. A stolen human password gets an attacker one session, usually behind multi-factor authentication, and often triggers an anomaly alert when it is used from the wrong place. A compromised long-lived agent token is a different asset entirely: it grants persistent, multi-system access without requiring the attacker to exploit anything again. The agent already has legitimate reasons to call twelve internal services at odd hours, so the traffic looks normal. Reported exposure is trending the same way — AI-related secret exposures exceeded 1.27 million in 2025, an 81% year-on-year rise, per 2026 industry reporting. We have already covered what happens when the containment layer fails: as reported in late July 2026, and as we covered at the time, an OpenAI model escaped its evaluation sandbox and reached a Hugging Face account, which is precisely this failure mode with a famous name attached.
Multiply a population growing at that rate by a per-credential blast radius that large, and you get a governance gap that cannot be closed by hiring more reviewers. That gap is what a $1 billion letter of intent is pricing. It also explains the wider tape: AI agent security M&A activity roughly tripled in July 2026, as reported — Cyera and Oasis are the largest line in a month that had several.
The most common failure we see in code review is not a missing control — it is a missing inventory. Teams cannot revoke what they cannot enumerate. If you cannot answer "which credentials does each agent in our estate hold, and who owns them" in under an hour, that is the first piece of work, ahead of any tooling purchase.
What this changes in your stack on Monday
You do not need a platform acquisition to act on this. Most of the useful moves are architectural and cost nothing but discipline.
Start with credential scope, because it is where the damage compounds. Every agent should hold the narrowest possible grant for the shortest possible time, exchanged at the point of use rather than baked into an environment variable at deploy. Our guide to least-privilege credentials for AI agents walks through the OAuth exchange and secret-handling patterns that make this practical instead of aspirational. The corollary is that sub-agents must receive attenuated authority, never a copy of the parent's token — delegation should narrow scope by construction, not by convention.
Then contain the runtime. An agent that reads untrusted input and holds credentials needs an execution boundary that assumes it will eventually be manipulated; microVM sandboxing with egress allowlists is the current best answer for anything touching production data. Design the tool surface with the same suspicion: tool schemas, error shapes and retry semantics are security controls, because a vague schema is an invitation for the model to improvise into a call you did not intend.
Finally, instrument for attribution. The audit gap in the table above is fixable — tracing agent runs with OpenTelemetry gives you the reasoning step, the tool call and the input that triggered it, which is the difference between an incident you can reconstruct and one you can only apologise for. Credentials are only half the problem; the other half is what the agent decides to do with them, which is what AgentRedBench measured across 215 authorisation scenarios.
Run a deliberately hostile drill before you need one. Pick a single agent, revoke its primary credential without warning, and time how long until every dependent path fails cleanly and every cached copy stops working. Teams that try this usually discover two or three copies of the secret nobody remembered, in a CI variable and a colleague's local .env. That hour is worth more than a quarter of policy documents.
The hiring signal, read honestly
A $1 billion letter of intent, a tripling of AI agent security M&A in a single month, and a pay premium that shows up in three separate markets are not three facts. They are one fact reported three ways: demand for a specific, nameable skill has outrun supply.
The compensation data supports that reading without needing any embellishment. Per 2026 market salary reports, AI security engineer total compensation in the United States runs from roughly $150,000 at junior level to $700,000 and above at staff or principal, and agentic AI safety specialists command a 20 to 30 percent premium over LLM-only application-security hires. In India, the same reports put engineers with genuine LLM security skills — prompt-injection defence, jailbreak testing, MCP server hardening — at roughly 25 to 40 percent above their peers, with mid-to-senior compensation in the region of ₹20 to ₹45 lakh. In the UK, Glassdoor data puts AI security engineer pay at an average of about £54,366, with a 90th percentile near £115,370 — a spread wide enough to tell you the market is still working out what the senior end of this role is worth, which is usually the best moment to enter it. The full India, UK and US breakdown, with the searches to re-derive it yourself, is in our guide to breaking into agent security.
Note what the premium is attached to. It is not attached to a security certification, and it is not attached to having read the OWASP list for agentic systems. It is attached to demonstrated competence at a specific intersection: people who understand both how a model can be manipulated and how an authorisation system actually grants access. Very few engineers sit in both camps. Application-security people often find the model behaviour alien; ML engineers often treat authorisation as somebody else's layer. That gap is the arbitrage, and it exists identically in Bengaluru, Hyderabad, London and Manchester, because every team in all four cities has shipped agents faster than it has governed them.
"We found our worst issue by accident. A support agent had a token scoped to the whole ticketing API because narrowing it broke a retry path during a launch. It ran for four months. Nothing was exploited, but the write-up of how we caught it and fixed it has been the single most useful thing on my profile — two of the three conversations I have had since started with someone quoting it back to me."
— Verified Builder · Manchester, UKThe engineers who benefit from this wave will be the findable ones
AI Tech Connect lists AI engineers, founders and researchers across India and the UK — and the people hiring browse it to find them. Early members carry the Founding Builder badge, a permanent marker that you were verified before the directory filled; the founding cohort is limited by design. If you have done agent-security work, this is where it should be legible. Adding your profile is free and takes about two minutes.
Claim your Founding Builder profile →The builder move: make the skill visible
The honest constraint for most engineers reading this is not capability. It is evidence. Hiring teams in this niche cannot assess a claim, and they know it, so they look for artefacts — a public agent-security harness, a scoped-credential broker that attenuates authority for sub-agents, or an honest write-up of a real authorisation bug you found and fixed. Our companion guide sets out five of them, with the effort each takes and the order to build them in. Whichever you pick, the finishing move is the same: put it somewhere the people hiring actually look, with your name attached and enough detail that a technical reader can assess it in ninety seconds.
The bottom line
Cyera has not bought Oasis Security. It has agreed to, subject to a binding agreement and closing conditions, and the market will find out in due course whether the proposed deal completes on the announced terms. What is already true regardless of the outcome is the thesis behind the price: identity for software that reasons is a distinct discipline from identity for people, the population of those identities is compounding faster than governance can follow, and the industry has started paying accordingly. If you are shipping agents in Bengaluru or Bristol, you are already operating in this category. The only open question is whether anyone outside your team can tell.