All analysis was generated autonomously, without human review. Scores are analytical opinions drawn from the cited public sources, without hands-on testing. They are not audits, certifications, investment reports, purchasing advice, or evaluations of quality.
Cyera sells enterprises a data security platform that finds and classifies sensitive data and controls what people and AI agents can access. Founded in 2021, it has raised more than $2.3 billion, most recently $600 million led by Evolution Equity Partners at a $12 billion valuation. Its named customers include AT&T, Paramount, Chipotle, Nordstrom and DocuSign. Cyera says it has more than 1,500 employees. In 2026 it completed a $1 billion acquisition of Oasis Security, adding software that manages the identities of machines and AI agents. Cyera's automated fixes can trigger workflow tools that teams already use, such as Tines and Torq. Microsoft offers similar data controls for AI apps in its Purview product, so some buyers could get that protection from Microsoft instead.
| Description | Cyera is a data and AI security platform that helps enterprises discover sensitive data, govern what people and AI agents can access, and stop AI-driven data risk in real time. | [f1] |
|---|---|---|
| Founded | 2021 | [f2] |
| HQ | New York, USA | [f3] |
| Funding | $2,300M total | [f4] |
| Subsidiaries | Oasis Security (Non-human identity and AI agent access company. Cyera completed its acquisition of Oasis Security in a deal valued at $1 billion, per SecurityBrief.) | |
| Latest funding | Series G, $600M at $12B valuation (2026) | [f2] |
| Deployment | SaaS | [f5] |
| Compliance | C5, GDPR, HIPAA, ISO 27001, PCI DSS, SOC 2 | [f5] |
| Product | What it does |
|---|---|
| Cyera | Data security platform that discovers and classifies sensitive data across the enterprise, surfaces shadow AI, controls what data AI can reach, and prevents sensitive-data leakage to AI in real time. |
AI Defense Matrix
| Govern | Identify | Protect | Detect | Respond | Recover | |
|---|---|---|---|---|---|---|
| AI-Workload Platforms Inference servers, training platforms, vector DB platforms, and the model-loading supply chain. | ||||||
| AI Coding and Orchestration Tools AI coding tools and agentic orchestration tools on user devices, plus their plugins, skills, hooks, system prompts, scaffolding, harnesses, configuration settings, and MCP clients. | ||||||
| AI-Generated Code Code produced by AI tools, AI-assisted reviews, AI-generated infrastructure-as-code and tests, and vibe-coded apps that bypass CI/CD. | ||||||
| AI Traffic Paths to external and self-hosted AI services, MCP tool channels, agent-to-agent calls, model-registry downloads, and egress to unapproved AI services. AI gateways, LLM routers, and MCP gateways steer traffic along those paths. The steering decisions and their inputs belong here too: routing policies, MCP server registries, and agent naming and discovery services. | ||||||
| AI Model Model weights, fine-tuning checkpoints, model cards, registries, an AI bill of materials (AIBOM), and the third-party LLMs your enterprise consumes. | ||||||
| Training Data Datasets used for training, fine-tuning, and continued learning. | ||||||
| Runtime AI Data User prompts, inference inputs, RAG content, vector DB content, persistent agent memory, and interaction history. | ||||||
| AI Agent Identities AI agents as non-human principals, plus credentials, keys, permission scopes, service accounts, and delegation chains across agents and tools. |
Cyera is a data security platform that discovers and classifies sensitive data across the enterprise, surfaces shadow AI, controls what data AI can reach, and prevents sensitive-data leakage to AI in real time. It is mapped to the AI Defense Matrix. [f6]
How well the company can compete in its security market, scored across eight dimensions against public evidence.
| Dimension | Score | Rationale |
|---|---|---|
| Problem Clarity How precisely the company defines its problem, with evidence the problem exists at the scale claimed. | 3/5 | Cyera names its buyer as the enterprise security and data team that must find sensitive data and control what people and AI agents can reach. KuppingerCole independently describes the gap, noting that authorizing an AI agent requires two kinds of knowledge that enterprises have historically bought as separate products. The quantified pain in the reviewed sources is Cyera's own. KuppingerCole says it would not build a business case on Cyera's identity growth figure. [s2, s21, s29] |
| Capability Depth How specific the technical capabilities are, with evidence beyond marketing claims such as docs and third-party validation. | 3/5 | Cyera documents its capabilities concretely on its own pages. They include agentless scanning across hundreds of petabytes, classification with 95% or better precision by Cyera's own figure, and Agent Guardian's inline blocking of dangerous agent tool calls. Cyera relays the Forrester evaluation that scored it on its own report page. The cited sources contain no independent technical evaluation, inspectable code or customer technical writeup on those capabilities. [s3, s10, s13] |
| Market Timing Whether the market is ready for this product, with evidence that buyers are actively seeking solutions. | 4/5 | Two kinds of buyer-side demand signal fall within the past year. One is purchasing. TechCrunch reported in June 2026, citing three people familiar with the matter, that Cyera surpassed $150 million in annual recurring revenue, a figure Cyera called inaccurate without disclosing its own. The other is analyst category notes, including KuppingerCole’s July 2026 note that Microsoft, Palo Alto Networks and CyberArk are converging on the same control point, and Forrester’s Q2 2026 evaluation relayed on Cyera’s report page. [s16, s21, s13] |
| Team Credibility Demonstrated domain expertise with public signals such as prior exits, publications, and industry recognition. | 3/5 | CTech reports that co-founders Yotam Segev and Tamar Bar-Ilan are graduates of Israel's Talpiot program and Unit 8200. Cyera's About page names a third co-founder, Yonatan Itai, and a board that includes Frank Slootman and Doug Leone. The reviewed sources document relevant experience and the founders’ work building Cyera. They document no prior founder exit or sustained publication record. [s15, s5] |
| GTM Proof Evidence of actual traction (customers, revenue signals, partnerships) beyond stated intentions. | 5/5 | TechCrunch reported in June 2026, citing three people familiar with the matter, that Cyera had passed $150 million in recurring revenue. CTech, reporting on the Oasis Security deal, wrote that Cyera is estimated to generate more than $200 million. Cyera called the TechCrunch figures significantly inaccurate without disclosing its own. Fortune and CTech independently name customers including AT&T, Peloton, Nordstrom, Chipotle, Paramount and DocuSign. AT&T's CISO endorses Cyera in its June 2026 release. [s16, s20, s17, s11] |
| Funding Efficiency Whether funding matches go-to-market ambition, with signs of capital-efficient growth. | 3/5 | SecurityWeek reports that Cyera has raised more than $2.3 billion. TechCrunch reported in June 2026 that Cyera surpassed $150 million in annual recurring revenue and CTech estimates more than $200 million, while Cyera disputes the TechCrunch figure. Cyera keeps shipping, launching Agent Guardian and Cyera Endpoint in August 2026. TechCrunch’s sources say it spends faster than it earns and no margin is disclosed, so its efficiency is unconfirmed. [s14, s16, s20, s10] |
| Category Clarity Whether the company creates or fits a recognizable category that buyers can quickly place in their stack. | 4/5 | KuppingerCole lists Cyera as a data security and DSPM company, and SecurityWeek calls it a data security firm. BigID publishes a page naming alternatives to Cyera, so an analyst, the press and a rival place it in the category without Cyera's coaching. Cyera relays its Leader placement in Forrester's discovery and classification evaluation on its own report page, which falls short of the independently confirmed category-defining position a 5 needs. [s21, s14, s25, s13, s3] |
| Incumbent Defensibility How vulnerable the core value proposition is to absorption as a feature by a platform vendor. | 3/5 | Cyera's remediation actions, its workflow integrations with automation tools such as Tines and Torq, and its combined data and identity context add friction to absorbing its function into another platform. Microsoft documents posture management and data-loss policies for AI apps in Purview, and BigID lists Purview among Cyera alternatives. KuppingerCole says Microsoft, Palo Alto Networks and CyberArk are converging on the same control point. The reviewed sources show no data flywheel or multi-year lock-in that bundling could not reproduce. [s1, s3, s26, s25, s21] |
Cyera sells to the enterprise security and data team that needs to know where sensitive data lives and who or what can reach it. Its platform page describes one system to discover sensitive and proprietary data, govern human and AI access, and stop AI-driven risk in real time. Fortune wrote in January 2026 that the AI boom turned data into the fuel companies need for their AI plans.
KuppingerCole frames the problem Cyera now targets in its own words. Authorizing an AI agent requires knowing how sensitive a data asset is and which identity holds the credential reaching for it. Enterprises have historically bought those two things as separate products through separate teams. Cyera says its completed Oasis Security acquisition creates a single platform that determines what every human, machine and AI agent can see and do.
The figure on the problem's size in the reviewed sources is Cyera's. Cyera says non-human identities inside Fortune 500 companies grew nearly 500% in six months, and KuppingerCole says it would not build a business case on that figure. [s2, s17, s21, s29]
Cyera's platform combines data security posture management, data-loss prevention, access tracking and AI agent controls. The DSPM product scans cloud, SaaS and on-premises stores without agents, and Cyera says its classifier adapts to each environment and reports 95% or better precision without manual rules. Teams can act on findings through more than 30 built-in remediation actions.
Agent Guardian, launched in August 2026, extends the platform to AI agents. Cyera says it inventories agents and AI apps, evaluates tool calls and data access against policy in real time, and red-teams agents against prompt injection and jailbreaks. Its launch release describes enforcement inline in the execution path, and Cyera Endpoint applies AI guardrails on employee devices.
Identity coverage grew with the Oasis Security acquisition, which Cyera completed in September 2026. Cyera says the Oasis platform will operate as Cyera Identity and connect directly to its data intelligence layer. Forrester's Q2 2026 evaluation, which Cyera relays on its report page, gave Cyera the highest strategy score among 10 vendors evaluated. [s3, s4, s10, s29, s13]
Cyera competes in data security posture management against specialists and platform vendors. BigID publishes a page on Cyera alternatives that names BigID, Sentra, Varonis, Wiz, Microsoft Purview and Satori as top Cyera competitors. The same page describes Cyera as known for fast, cloud-native deployment and strong data discovery.
Microsoft documents overlapping capability in Purview. Its Purview documentation describes a central place to secure data for AI apps, with ready-made policies to prevent data loss in AI prompts. KuppingerCole says Microsoft, Palo Alto Networks and CyberArk are converging on the same data and identity control point that Cyera targeted with Oasis.
Cyera positions one platform across data, identity and AI agents. KuppingerCole calls the architectural argument valid while questioning the Oasis price and whether identity teams will govern machine identity from a data security tool. [s25, s26, s21, s29]
Independent reporting names Cyera's customers and sizes its revenue. Fortune named AT&T, Peloton, Nordstrom and Chipotle as customers in January 2026, and CTech named Paramount, Chipotle, Valvoline, Hollister and DocuSign in its report on the Oasis Security deal. Cyera's trust center lists Paramount, DocuSign, AT&T, Chipotle and Peloton, and AT&T's CISO endorses the product in Cyera's June 2026 funding release.
Two outlets report revenue scale that Cyera does not disclose. TechCrunch reported in June 2026, citing three people familiar with the matter, that Cyera had passed $150 million in annual recurring revenue while remaining far from profitable. Cyera's spokesperson called those numbers factually and significantly inaccurate. CTech later wrote that Cyera is estimated to generate more than $200 million.
Cyera reports its own growth figures. The company says it tripled recurring revenue three years in a row and grew to more than 1,500 employees across 18 countries. Customer stories on its site include ChenMed and Cass Information Systems. [s17, s20, s6, s11, s16, s8]
Two of Cyera’s founders come from Israeli military technology programs. CTech reports that co-founders Yotam Segev, the CEO, and Tamar Bar-Ilan, the CTO, are graduates of the Talpiot program and Unit 8200. Cyera's About page names Yonatan Itai as a third co-founder.
The board adds experience scaling enterprise software. Directors include Frank Slootman, former CEO of Snowflake and ServiceNow, Doug Leone of Sequoia Capital, and former Paramount CISO Pete Chronis.
The reviewed sources document no prior founder exit or sustained publication record. The team's track record in these sources is building Cyera itself. [s15, s5]
Cyera's trust center lists its compliance programs. Under a compliance heading it names ISO/IEC 27001:2022, SOC 2, C5, PCI DSS, HIPAA and GDPR, and it names Paramount, DocuSign, AT&T, Chipotle and Peloton as organizations that review and trust Cyera. In April 2026 Cyera announced FedRAMP High "In Process" designation, a step toward federal authorization.
Cyera offers two deployment models. It says it can run entirely inside a customer's cloud or on-premises environment so sensitive data stays in place, or as a managed SaaS service.
Agent Guardian adds a newer review surface. Its release says it operates inline in the agent execution path and intercepts tool calls, so a buyer's security review would examine how Agent Guardian inspects live AI traffic. [s6, s30, s3, s10]
| Company | Relationship | Note | Compare |
|---|---|---|---|
| Sentra | competes with | BigID's page on Cyera alternatives names Sentra among top Cyera competitors for the same data security buyer. | |
| BigID | competes with | BigID publishes a page positioning itself as an alternative to Cyera for data security posture management buyers. | |
| Varonis | competes with | BigID's page on Cyera alternatives names Varonis among top Cyera competitors. | |
| Wiz | competes with | BigID's page on Cyera alternatives names Wiz among top Cyera competitors. | |
| Microsoft Purview | adjacent | Adjacent because Microsoft documents data security posture management for AI apps in Purview, and BigID's page on Cyera alternatives lists Purview among top Cyera competitors. | |
| Securiti | competes with | Competes for the same enterprise buyer of data discovery and AI data governance. |
Add analyzed competitors to compare them side by side with Cyera.
A closer look at the company's product strategy, measuring how defensible it is against market forces and examining the eight areas behind it.
reinforce or reposition
Cyera competes on its classification engineering, its large enterprise customers and the breadth of its platform. Classifying sensitive data across hundreds of petabytes and enforcing policy on AI agent actions in real time takes years of specialized engineering. Its customers include AT&T and Paramount. Its trust center lists ISO 27001, SOC 2 and PCI DSS under compliance, which rivals can also obtain. A customer that leaves Cyera would need to recreate the remediation rules and integrations it configured there. Watch whether its machine identity software and AI agent security controls become part of the same buying decision as data discovery.
| Dimension | Score | Rationale |
|---|---|---|
| Value Delivery Does the product sell software as the product, or judgment, trust, or accountability with software as the delivery mechanism. | 2/3 | Cyera sells a software platform that customers operate to discover, classify and remediate data risk. Its pricing page lists DataWatcher as an optional add-on, and its homepage describes end-to-end management of the Cyera platform and expert-led data breach response support, so Cyera also sells its own expertise alongside the code. |
| Switching Cost How expensive leaving is for a customer: data portability, integrations, learned workflows, network effects, regulatory data residency. | 2/3 | A customer leaving Cyera would need to rebuild the remediation actions, workflow integrations with tools such as Tines and Torq, and Agent Guardian policies enforced inline on agents. That is meaningful integration and workflow friction. The cited record does not size a migration or show that data, policies or classifications cannot be exported, so the friction stays at the level of integrations and workflows. |
| Compliance Moat Whether certifications, liability acceptance, or audit trails block an easy replacement. | 1/3 | Cyera's trust center lists ISO/IEC 27001:2022, SOC 2, C5, PCI DSS and HIPAA under compliance, which a funded rival can obtain through ordinary enterprise preparation. Its FedRAMP High status is "In Process", which Cyera describes as progress toward full authorization, so no compliance item in the record blocks replacement. |
| Problem Complexity Whether the product requires ML, optimization, real-time systems, or years of specialized expertise. | 3/3 | Cyera classifies sensitive data across hundreds of petabytes without agents and reports 95% or better precision. Agent Guardian evaluates agent tool calls and data access against policy in real time. That combines machine learning, large-scale data systems and real-time enforcement, which takes years of specialized expertise. |
| Buyer Profile Whether buyers are SMB operators, mid-market IT teams, or regulated enterprises and governments with procurement gates. | 3/3 | Independent reporting names large enterprises such as AT&T and Paramount as Cyera customers. Its trust center lists HIPAA and PCI DSS under compliance, and Cyera is pursuing FedRAMP High authorization for federal agencies. That is the regulated-enterprise and government buyer class. |
| Layer Whether the product is an end-user application, a platform with application features, or infrastructure other applications depend on. | 2/3 | Cyera is a platform whose classifications and policies drive remediation actions, access decisions and agent controls in other systems, with application features such as data-owner workflows. Agent Guardian enforces inline on agent actions, but the reviewed sources describe no applications that depend on Cyera to function. |
| Proprietary Data, Content, or IP Whether the product accumulates datasets, content licenses, or IP that a rival cannot recreate from scratch. | 1/3 | Cyera's pages describe a classifier that adapts to each customer's environment and a classification engine Segev calls Cyera's edge. Both describe a method. The reviewed sources name no retained cross-customer dataset, content licence or granted patent. |
Cyera targets large enterprises that need to find sensitive data and control what people and AI agents can reach. Independent reporting names customers including AT&T, Peloton, Nordstrom, Chipotle, Paramount and DocuSign. Cyera's customer stories add ChenMed and Cass Information Systems.
Cyera also pursues federal buyers. In April 2026 Cyera announced FedRAMP High "In Process" designation, which Cyera describes as progress toward full authorization with a federal agency sponsor.
The Oasis Security acquisition extends Cyera toward identity buyers. KuppingerCole notes that Oasis sells to identity and IAM teams while Cyera sells to data security, privacy and compliance functions, so the combined company now addresses two budget holders.
Cyera builds its platform around AI classification of sensitive data. Cyera says its classifier adapts to each customer environment and reports 95% or better precision without manual rules. Segev wrote, in a post SiliconANGLE quotes, that a classification engine reading for meaning is where Cyera built its edge. The DSPM product scans hundreds of petabytes without agents.
In 2026 Cyera expanded its agent and identity coverage. Agent Guardian, launched in August 2026, inventories agents, checks their tool calls and data access against policy in real time, and red-teams them against prompt injection and jailbreaks. Cyera says Oasis Security's platform for non-human identities will operate as Cyera Identity and connect directly to Cyera's data intelligence layer.
The reviewed sources describe learning inside each customer environment and name no retained dataset built across customers. Classification metadata gathered across many customer estates could one day improve sensitivity labeling beyond what one customer's data supports, and no reviewed source shows Cyera doing so.
Cyera sells to enterprises through custom quotes. Its pricing page offers a custom quote, and the company says it has two plans, one for DSPM and one for DLP, with add-ons such as DataWatcher.
Independent coverage names customers and reports revenue scale. Fortune and CTech name AT&T, Peloton, Nordstrom, Chipotle, Paramount, Valvoline, Hollister and DocuSign. TechCrunch reported recurring revenue above $150 million, a figure Cyera called significantly inaccurate, and CTech wrote that Cyera is estimated to generate more than $200 million.
Acquisitions have been part of the motion. CTech lists Trail Security, Otterize, Shape AI, Ryft and Genie Security, and Cyera completed the $1 billion Oasis Security acquisition in September 2026.
Cyera's pricing page offers a custom quote and says its pricing is tied to customer outcomes. The company offers two plans, one for DSPM and one for DLP, with optional add-ons such as data subject request automation and the DataWatcher service.
The pricing page states no price or unit of charge. A buyer gets a price through a custom quote.
Cyera offers two deployment models. It can run entirely inside the customer's cloud or on-premises environment so sensitive data stays in place, or as a managed SaaS service that Cyera says delivers rapid time to value.
Discovery runs without agents on the scanned systems. Cyera says the DSPM product continuously scans hundreds of petabytes and applies the same classification and remediation to on-premises stores as to cloud, SaaS and database services.
Agent controls add deployment points. Agent Guardian enforces policy through platform APIs, AI gateways, a browser extension, agent framework hooks and scans of employee devices, and Cyera Endpoint installs guardrails on those devices. Cyera offers end-to-end management of the platform for customers that want it.
Cyera's trust center lists its compliance programs and named organizations. Under a compliance heading it names ISO/IEC 27001:2022, SOC 2, C5, PCI DSS, HIPAA and GDPR, and it lists Paramount, DocuSign, AT&T, Chipotle and Peloton as organizations that review and trust Cyera. Cyera says the platform generates auditor-ready evidence mapped to regulatory controls.
Cyera is working toward federal authorization. It announced FedRAMP High "In Process" designation in April 2026, which describes progress toward authorization with an agency sponsor.
Cyera says it can run inside the customer's environment so sensitive data stays in place. Agent Guardian's inline enforcement on live agent traffic is a newer surface for a security review to examine.
Cyera positions one platform across data, identity and AI agents. Its completion release for Oasis Security describes a single platform that determines what every human, machine and AI agent can see and do, and says Oasis will operate as Cyera Identity.
The platform connects to tools customers already run. Cyera says remediation rules can trigger automation workflows in platforms such as Tines and Torq, and Agent Guardian works through platform APIs, AI gateways and agent framework hooks.
KuppingerCole flagged the integration work in its first take on the July 2026 letter of intent, written before the deal closed. It expected Oasis to run as a separate unit after close, which it said protects customer continuity but defers the unified control plane the deal is premised on. Cyera's September 2026 completion release describes Cyera Identity connecting directly to its data intelligence layer, and the reviewed sources do not show how far that integration has progressed.
Cyera's co-founders lead the company. CTech reports that CEO Yotam Segev and CTO Tamar Bar-Ilan are graduates of Israel's Talpiot program and Unit 8200. Cyera's About page names Yonatan Itai as a third co-founder and head of research and development.
The board adds experience scaling enterprise software. Directors include Frank Slootman, former CEO of Snowflake and ServiceNow, Doug Leone of Sequoia Capital, and former Paramount CISO Pete Chronis.
The reviewed sources document no prior founder exit or sustained publication record. The team's record in these sources is building Cyera.
| Id | Source | Tier | Accessed |
|---|---|---|---|
| f1 | Cyera: platform overview page | official | 2026-09-17 |
| f2 | Tech Startups: Cyera $600 million round | press | 2026-09-17 |
| f3 | Tracxn Cyera company profile | research | 2026-06-14 |
| f4 | SecurityWeek: Cyera funding article (Ionut Arghire) | press | 2026-09-17 |
| f5 | AI Defense Matrix Catalog entry | other | 2026-06-13 |
| f6 | AI Defense Matrix Catalog mapping | other | 2026-09-17 |
This site is an experimental research aid created by Zeltser Security Corp. All its data gathering and analysis was performed autonomously without human review, and it can contain errors of fact, interpretation, and judgment that a human reviewer might catch.
The analyses are statements of opinion, not statements of fact. Machine analysis produced the scores, summaries, and matrix placements by weighing the public sources each page cites, and reasonable people can weigh the same sources differently. Where a page states a fact, it cites the public source and the date it was checked, and the statement is only as accurate as that source. Unless a profile expressly says otherwise, the analysis involves no hands-on testing and no independent validation of any company's products or services.
Nothing here is professional, security, legal, financial, investment, or purchasing advice, and nothing here is a recommendation to invest in, do business with, or avoid any company. Inclusion of a company is not an endorsement, and absence of a company is not a judgment about it. Reading this site creates no advisory or client relationship. Verify any detail you plan to act on against the vendor's current materials.
The content is provided "as is" and "as available," with all warranties disclaimed, express or implied, including merchantability, fitness for a particular purpose, accuracy, and non-infringement. No entry is warranted to be complete, current, or correct. Companies change, vendors update their claims, sources can be wrong, and automated analysis can misread them.
To the fullest extent permitted by law, the operator, Zeltser Security Corp, is not liable for any damages that arise from using this site or relying on its content, including direct, indirect, incidental, special, and consequential damages and lost profits, even if advised that such damages were possible. If you are dissatisfied with the site or disagree with these terms, your remedy is to stop using it.
Entries link to vendor pages, press coverage, and other external sites that Zeltser Security Corp does not control and is not responsible for. A link is not an affiliation with the destination or an endorsement of it. Product and company names and trademarks are the property of their owners, used here nominatively to identify the companies described. Short quotations from cited sources appear for identification and commentary.
Use, quotation, automated retrieval, and redistribution of the content are governed by the Terms of Use at cybercompanyprofiles.com/terms, which permit personal and internal business use with attribution and prohibit republication and resale.