Cyera Buys Oasis Security for $1B: The Case for an Independent AI Control Plane

On 28 July 2026, Cyera agreed to acquire Oasis Security for roughly $1 billion, about $700 million of it in cash and the remainder in shares, as reported by SecurityWeek and TechCrunch. Cyera closed a $600 million round at a $12 billion valuation weeks earlier. Oasis had raised a $120 million Series B in March 2026. It is the second-largest cybersecurity deal of 2026, behind Accenture's roughly $3.2 billion majority stake in Dragos.

Cyera's stated reason is worth reading closely, because it is an architecture argument rather than a market one. Its CEO put it as knowing your data being insufficient if you cannot govern who or what touches it, and knowing your identities being insufficient if you do not know what they can see. Strip the deal terms away and the claim is that authorization over what a non-human identity may reach has become a buying center on its own.

What Oasis actually sells, and where the boundary sits

Oasis built a non-human identity and agentic access governance platform: discovery and inventory of service accounts, OAuth tokens, secrets and their rotation, cloud IAM cleanup, and policy over what those identities can reach. Most of that work happens in the cloud control planes and secret stores, well away from any AI request path.

I want to be precise about the boundary, because the temptation with a deal like this is to claim the whole surface. DeepInspect does not rotate secrets, does not manage cloud IAM, and does not discover non-human identities across an estate. Two controls in that picture sit inside the AI request boundary: identity-bound authorization on outbound calls from an agent to an LLM or AI endpoint, and the per-decision audit record of those calls. Everything else in the Oasis footprint belongs to a different tool.

Six acquisitions in twelve months

The pattern around this deal matters more than the price. Palo Alto Networks took Portkey, Cisco took Astrix, and Databricks took Panther, while Proofpoint absorbed Acuvity and CrowdStrike absorbed SGNL. Cyera taking Oasis makes six platforms that have swallowed an AI-gateway, non-human-identity, or agent-security startup inside twelve months, and the direction is consistent: the suite vendors want the AI-agent control surface inside their own product.

I covered the category framing when Cisco acquired Astrix, and the detection-versus-enforcement split when Databricks acquired Panther. The Cyera deal adds a third thing: the convergence of data security posture with identity governance, which is the first time a platform has argued that the two have to be one product to govern AI agents.

Inventory tells you what exists, enforcement decides what happens

A non-human identity platform answers the question of which agents, service accounts, and tokens exist and what they are entitled to reach. That inventory is genuinely useful, and it is the reason Cyera paid $1 billion for it.

Inventory operates on a schedule. A discovery scan that runs hourly describes the estate as it stood at the top of the hour, and an agent making an unauthorized model call at 14:07 is described by a scan that finishes at 15:00. Mandiant's M-Trends 2026 report, built on more than 500,000 hours of incident response, found the median handoff from initial access to a secondary threat group collapsed to 22 seconds. Against that tempo, a posture view is a forensic artifact.

The enforcement question is separate: at the moment an agent identity sends a prompt to a model endpoint, is this call permitted, and is there a record of the decision. That evaluation has to happen in the request path, before the request reaches the model, or it is a report about something that already occurred.

The suite argument and its cost

Consolidation makes sense for buyers who have standardized on one platform. Fewer contracts, one console, one support relationship. The cost shows up in a specific place: the enforcement point ends up bound to the vendor whose platform absorbed it.

A typical enterprise AI deployment runs Anthropic and OpenAI endpoints, a Bedrock deployment for one business unit, an Azure OpenAI instance for another, a self-hosted Llama behind the firewall for the regulated workloads, and a dozen agent frameworks calling all of them. The data sits across Snowflake, Databricks, S3, and three SaaS applications. A control plane that ships inside a data-security platform sees the AI calls that platform can instrument, and the remaining traffic keeps flowing with no policy attached to it.

That is the RFP question worth writing down before the next renewal: does identity-bound authorization over AI calls apply to every model, cloud, and data platform in the estate, or only to the ones the acquiring vendor covers? It is a question about coverage rather than about product quality, and the honest answer from a suite vendor is usually a roadmap.

What the record has to contain

The second in-boundary control is the audit record, and the deal makes its shape clearer. When a regulator or an incident responder asks what an agent did, the answer needs the agent identity that made the call, the model endpoint it reached, the classification of what was in the prompt, the policy that permitted or refused it, and the timestamp, written by something other than the agent's own application.

An application that makes the AI call and writes its own record is attesting to itself. That record fails three ways: selective logging of the successes, suppression by the same system that failed, and loss when the process crashes after the model responds but before the commit. The audit trail requirements by regulation piece walks how the EU AI Act, the CCPA ADMT rules, and the sectoral regimes each land on this same artifact.

My honest read on the consolidation wave: the platforms are buying inventory and calling it control, because inventory is what was for sale. The enforcement layer is harder to acquire, since it has to be vendor-neutral to be worth anything, and a vendor-neutral control plane is an awkward thing to own inside a suite.

DeepInspect

This is the problem DeepInspect was built to solve. It is a stateless proxy that sits between your authenticated users or agents and any HTTP-based LLM endpoint, evaluating identity, data classification, and policy on every request and making a pass or block decision before the traffic reaches the model. Enforcement overhead measures under 50 ms in internal testing, against inference times of 500 ms to five seconds.

Because it operates at the AI request boundary rather than inside a data platform or a cloud control plane, the same policy applies to OpenAI, Anthropic, Bedrock, Azure OpenAI, Vertex, and self-hosted models in one deployment. Every decision produces a signed, tamper-evident record bound to the calling identity, written outside the application's custody. The AI control plane explainer covers the architecture in full. Book a demo today.