Cyera’s proposed acquisition of Oasis Security underlines how quickly non-human identity has moved from an emerging niche to a strategic security category. AI agents require access to applications, data and infrastructure, and that access must be discovered, governed and monitored like any other identity. The transaction reflects demand for capabilities that can bring those controls into a broader data and security platform.
The underlying problem is identity sprawl. Enterprises are creating service accounts, API keys, workload identities and agent credentials faster than they can document them. Many of these identities are owned by teams rather than individuals, have excessive permissions or persist after their original purpose disappears. An AI agent increases the challenge by creating dynamic connections and acting across multiple systems in response to changing instructions.
Bringing NHI capabilities into a data security platform can improve risk context. An identity inventory becomes more useful when it shows which sensitive data an agent can reach, what it actually accessed and whether the access matches its stated purpose. That connection allows security teams to prioritise an identity that combines broad privilege with access to critical data, rather than treating every credential as equally urgent.
Integration will be the key test. Buyers will expect discovery across cloud and SaaS environments, ownership mapping, secret and certificate lifecycle management, least-privilege recommendations and runtime controls. They will also need policy enforcement that can work with existing identity providers and privileged access systems. A separate inventory that cannot trigger remediation will have limited operational value.
AI agents make runtime governance particularly important. A static review can approve an agent for a defined workflow, but it cannot guarantee that a new prompt, tool integration or model update will preserve the original risk profile. Continuous evaluation should examine the agent’s context, requested action, target resource and recent behaviour before allowing sensitive operations.
For CISOs, consolidation may reduce tool sprawl, but it should not replace architectural scrutiny. The essential questions are whether identities remain attributable, whether access can be revoked quickly and whether controls generate evidence that security operations and auditors can use.
The acquisition also signals that NHI security is becoming part of mainstream platform strategy. Organisations adopting AI agents should plan for machine identity governance at the same time as they plan data protection. The two concerns are now inseparable: an agent’s ability to act is ultimately defined by the identity and permissions behind it.