Oasis Security

• Okta, Microsoft Entra, or another identity incumbent could ship native non-human identity discovery and agent-access governance, turning the standalone NHI budget line into a platform feature before the category consolidates.
• Zscaler could extend its Zero Trust Exchange from enforcing Oasis policies to generating them, absorbing the joint use case the June 2026 integration created.
• Every traction figure is company-stated and no customer is named, so a growth stall would stay publicly invisible until it surfaced in hiring data or the terms of the next raise.
• GitGuardian already flags Oasis's exposure detection as shallower than secret-scanning specialists, and RFPs weighted toward leaked-credential detection could route the budget to those rivals.
• Agentic Access Management bets on per-session agent identities at the access layer, and if enterprises standardize agent authorization on protocol-level controls governed by their existing identity providers, the agent-access layer becomes optional middleware.

Oasis Security targets the machine side of enterprise identity, meaning the service accounts, API keys, tokens, and certificates that applications use to reach critical systems, and now the AI agents joining them. The company argues that these identities outnumber human users by 20 to 50 times and grow about 20 percent a year, while classic MFA and conditional access never applied to them, so the controls human accounts get do not reach the machine side.

Corroboration for the problem exists outside the company's marketing. CTech describes attackers exploiting non-human identities with increasing efficacy, CB Insights tracks a machine identity management market that ranks named vendors, and GitGuardian's 2026 roundup treats non-human identity security as an established tool category.

The buyer is the security and identity team in a large enterprise. Oasis says a majority of its customers come from the Fortune 500, and its homepage presents anonymized outcomes for a Fortune-50 healthcare provider and a Fortune-500 logistics firm, the moment those organizations wire AI agents into production faster than their identity programs can govern them. [s1, s4, s9, s13, s15]

The Oasis platform is an agentless system that connects to cloud and on-premises identity systems, discovers non-human identities, ties each one to an owner, scores posture and risk, and orchestrates lifecycle actions such as provisioning, vaulting, rotation, and decommissioning. SiliconANGLE describes the automated discovery of machine identities, classification by role and usage, and policy-driven governance for credential rotation and access control.

Agentic Access Management, which Oasis shipped in November 2025, extends the platform to AI agents. The documented mechanism is identity-centric. The product issues ephemeral per-session identities instead of standing credentials to shrink blast radius, and links every agent action to a prompt, intent, policy, session, and action trail for accountability, on a control plane the company describes as policy-based and infrastructure-agnostic.

Verification beyond vendor descriptions is thin. Documentation requires a customer login, no self-service tier or published pricing appears on the company site, and the strongest external description is GitGuardian's roundup, which credits the multi-environment discovery while noting that exposure detection runs shallower than dedicated secret-scanning tools. [s2, s3, s4, s8, s15]

Oasis occupies the discovery-and-governance wing of the non-human identity category, where it competes most directly with Astrix Security, Entro Security, and Clutch Security, while Aembit approaches the same budget line from runtime credential brokering. GitGuardian's 2026 roundup lists those rivals and ranks Oasis fourth, and CB Insights places Oasis as a Challenger in machine identity management alongside SailPoint, Saviynt, and HashiCorp.

Against identity incumbents, Oasis positions itself as the layer legacy IAM does not cover, and its strongest ecosystem proof is the June 2026 Zscaler integration, which pairs Oasis identity governance with inline enforcement in Zscaler's Zero Trust Exchange to give joint customers one control plane from discovery to decommissioning.

The agentic repositioning opens a second competitive front. With Agentic Access Management the company claims the access-management layer for AI agents before that category has settled, and its trademark on the term signals an ambition to name it. If buyers come to treat agent access as an extension of their existing IAM and zero-trust platforms, Oasis will compete with those incumbents rather than fellow startups. [s6, s13, s15]

Oasis runs a sales-led enterprise motion aimed at large organizations, with demo-gated evaluation and no self-service tier. The company reports that new annual recurring revenue grew fivefold year over year and that most new revenue comes through multi-year agreements, figures no third party has confirmed.

Channel and ecosystem motion is the verifiable part. Oasis launched a channel program with GuidePoint Security as a reseller, shipped the Zscaler integration in June 2026, and in April 2026 hired Michael DeCesare, a veteran of McAfee, Forescout, Exabeam, and Abnormal, as president running global go-to-market.

Customer evidence stays anonymous. The homepage presents anonymized outcomes for a Fortune-50 healthcare provider and a Fortune-500 logistics firm, and a Cyberstarts partner described a rapidly expanding Fortune 500 customer base in 2024, but no named reference customer appears in any page reviewed. A June 2026 SEC Form D filed by a vehicle named Inflection Ventures Oasis Security Fund I LLC is a regulatory marker of continued investor activity around Oasis, not a customer. [s1, s6, s9, s10, s14]

Co-founders Danny Brickman, CEO, and Amit Zimerman, CPO, met during service in Unit 81, an Israeli intelligence technology unit, and founded the company in 2022 with offices in New York and Tel Aviv. The public record documents no prior exit for either founder, so public verification depends on the unit's reputation and on who backed and joined the founders.

Those secondary signals are strong. Cyberstarts, Sequoia, Accel, and Craft Ventures funded the company across four rounds, and the executive bench now includes president Michael DeCesare, who previously ran Forescout and Exabeam and served as McAfee's president, alongside chief architect Barak Shelef and VP of product Yonit Glozshtein.

The Oasis research team adds a public technical signal. It disclosed a Microsoft MFA weakness it named AuthQuake in December 2024 that Dark Reading covered, coordinating with Microsoft on the fix. One disclosure is a single data point, but it shows the team invests in public research. [s5, s8, s10, s12]

The homepage footer serves the company's own SOC 2 and ISO 27001 attestation badges, the AICPA SOC seal and the ISO 27001 seal, both delivered from the Oasis content domain. Those are the table-stakes signals enterprise buyers expect, and they place Oasis level with the category on baseline assurance rather than behind it.

What is missing is the inspectable layer above the badges. In the June 29, 2026 probe, trust.oasis.security and security.oasis.security did not resolve. The security, trust, and compliance paths on www.oasis.security returned HTTP 404. The documentation portal requires a customer login, and no SOC 2 report or ISO certificate appears at any probed URL. For a platform that holds an inventory of every credential and agent identity in a customer's environment, the underlying reports must still be requested privately under a non-disclosure agreement.

Two observable practices reinforce the security posture. SecurityWeek describes the agentless connection model, which limits the footprint customers must deploy, and Oasis handled its AuthQuake disclosure through coordinated reporting, publishing after Microsoft shipped a permanent fix. The remaining gap is one of openness rather than certification, since rivals that publish reports and pricing let a buyer see more before signing. [s11, s12, s16, s17]

Add analyzed competitors to compare them side by side with Oasis Security.

Oasis targets the security and identity team in a large enterprise that has lost track of its machine accounts. The company argues that non-human identities outnumber human ones by 20 to 50 times and grow about 20 percent a year, while classic MFA and conditional access never applied to them, so the buyer is the team already accountable for human identity and now inheriting the machine side.

The agentic line sharpens that same buyer rather than opening a new one. Oasis frames AI agents as the next wave of non-human identities and sells Agentic Access Management to the organization wiring agents into production faster than its identity program can govern them. SiliconANGLE reports the platform discovers, classifies, and governs machine identities across enterprise environments to reduce exposure from unmanaged credentials.

The named demand stays anonymous. The product page quotes a Fortune 1000 head of identity who found more than 17,000 unmanaged non-human identities, the agentic page quotes a Fortune 500 chief information security officer, and the homepage lists outcomes for a Fortune 50 healthcare provider and a Fortune 500 logistics company. No source in this record attaches a company name to any of them.

The core platform discovers and governs the machine identities a hybrid estate accumulates. SiliconANGLE describes automated discovery of machine identities, classification by role and usage, policy-driven governance for credential rotation and access control, detection of unused or orphaned identities, least-privilege enforcement, and anomaly monitoring. That is the recognized non-human identity feature set.

Agentic Access Management is where the product moves from observing identities to provisioning them. The launch release documents three mechanisms: intent inference that interprets what an agent is trying to do, a policy engine that validates access decisions and escalates to a human when privilege boundaries are crossed, and just-in-time session identities that provision ephemeral least-privilege credentials for seconds-to-minutes sessions and capture an audit trail of person, prompt, policy, actions, and teardown. The control plane is described as policy-based and infrastructure-agnostic.

The verifiable edge is engineering breadth rather than a unique data asset. GitGuardian credits strong multi-environment discovery while flagging that exposure detection runs shallower than dedicated secret-scanning vendors. The cited record names no non-public training corpus and no third-party accuracy benchmark, so a funded rival could rebuild the capability from the same telemetry.

Oasis runs a sales-led enterprise motion with no published self-service path. GitGuardian records enterprise-tier pricing for commercial SaaS, the reviewed product pages route prospects to a demo request, and no rate card or free tier appears in the cited record, the posture of a vendor selling negotiated deals to large security organizations.

Cyera signed a letter of intent on July 28, 2026 to acquire Oasis for about $1 billion, mostly in cash with the remainder in Cyera shares, roughly five times the $195 million Oasis had raised across its disclosed rounds since 2022. The March 2026 Series B that preceded it drew Craft Ventures alongside returning backers Cyberstarts, Sequoia Capital, and Accel.

Disclosed traction below that headline stays thin. SiliconANGLE reports, citing a Bloomberg interview, that business with Fortune 500 companies accounts for the majority of Oasis sales, and the homepage carries customer outcomes without company names. The cited record contains no named reference customer and no revenue figure.

Oasis does not publish pricing, so the charged unit and list price stay private. GitGuardian records only enterprise-tier pricing for commercial SaaS, and the reviewed pages route prospects to a demo request, which signals a vendor targeting large negotiated deals rather than self-serve adoption. The absence withholds the budget-anchoring signal some peers publish.

The two product lines suggest two value meters. The core non-human identity platform reads as a subscription scaled to the size of the identity estate under management, while Agentic Access Management reads as a per-agent or per-session access charge, given the ephemeral identities it issues. This is an inference from the delivery mechanics rather than a disclosed model, and the cited record does not state which unit Oasis bills by.

The inferable belief is that buyers pay to govern the machine and agent estate rather than for discrete features. Confirming the billing unit and whether agentic usage is metered separately would require a sales conversation, which the hidden-price posture signals is the intended path.

Oasis delivers as hosted software, which GitGuardian's roundup records as commercial SaaS priced at the enterprise tier. SiliconANGLE describes the platform integrating with cloud providers, identity systems, and application environments to inventory machine identities and map their relationships to resources and privileges. The product page claims that connection produces a comprehensive inventory within minutes, a vendor assertion no independent source in this record tests.

Lifecycle and governance run continuously once connected. The platform analyzes authentication patterns, credential usage, and permission scopes to build a continuously updated view, then orchestrates rotation, least-privilege enforcement, and anomaly alerting, which gives a security team an operating console for machine-identity risk rather than a one-time scan.

Agentic Access Management changes the operational risk profile. A component that issues the short-lived per-session identities agents authenticate through sits in the access path, where availability and latency affect whether agents can act, and the cited record documents neither service-level commitments nor failure modes, the evidence a careful review requests before routing production agents through it.

Oasis displays the baseline attestations an enterprise buyer expects. The homepage footer serves a SOC 2 badge and an ISO 27001 badge from the company content domain, with the badge images carrying SOC 2 and ISO 27001 alt text in the served page. Those place Oasis level with the category on baseline assurance rather than behind it.

What is missing is the inspectable layer above the badges. The trust subdomain does not resolve, and the cited record contains no downloadable SOC 2 report or ISO certificate. For a platform that holds an inventory of the credentials and agent identities in a customer's environment, the cited record does not make the underlying reports inspectable, so a buyer may need to request them from Oasis.

The pending Cyera transaction adds a diligence item rather than removing one. Reporting says Oasis will run as an independent unit once the deal closes, which leaves open where a customer's identity inventory sits and under whose data-handling terms after close. A buyer should resolve retention, residency, and failure-mode terms in a formal review that goes beyond the published seals.

Oasis positions itself as the governance layer legacy identity providers do not cover. It connects with cloud providers, identity systems, and application environments to build a unified view of non-human identities, and the why-Oasis page rests the claim on a policy-based infrastructure-agnostic control plane that automates the lifecycle, so the platform bet is to own that view and the policy engine across a hybrid estate.

Agentic Access Management extends that bet into the access path. By issuing the per-session identities agents authenticate through, Oasis moves from observing identities to provisioning them, which is the sharper platform position because dependent agent workflows would have to be re-plumbed to remove it, though the cited record offers only an anonymous vendor-published testimonial and names no customer whose production agents run on the session-identity path.

The Cyera transaction relocates that bet rather than settling it. Cyera classifies enterprise data, and its stated rationale for buying Oasis is to govern what touches that data from one control point, which pairs the inventory Oasis holds with the data map Cyera holds. The same ground stays contested by the identity systems Oasis integrates with, which reach the same buyer natively.

Oasis rests on two publicly identifiable founders with a documented military intelligence background. Reporting on the Cyera transaction names Danny Brickman and Amit Zimerman as the pair who started the company in 2022 and identifies both as alumni of Israeli military intelligence Unit 81, and the launch release names the same two founders. The about page lists Brickman as co-founder and chief executive and Zimerman as co-founder and chief product officer. The cited record documents no prior exit for either founder.

The leadership bench below the founders is now named on the about page, which lists roles across sales, product, research and development, operations, customer success, finance, and technology. Individual prior builds for those leaders do not appear in the cited record, so the page evidences breadth of function rather than depth of track record.

Investors and an acquirer have both priced this team. Craft Ventures led the March 2026 Series B with returning investors Cyberstarts, Sequoia Capital, and Accel, and four months later Cyera signed a letter of intent to buy the company for about $1 billion. That sequence says more about how the market reads this team than any single credential the founders hold.