Non-Human Identity Security: Cisco, Cyera Deals Reshape Market

A niche becomes a buying spree

Non-human identity (NHI) security is the practice of tracking and governing the service accounts, API keys, tokens and, increasingly, AI agents that act inside corporate systems. In 2026 it went from a crowded startup category to one of the most active corners of cybersecurity M&A. Three of its best-known independent vendors have become acquisition targets within a few months, and venture money keeps arriving behind them.

The first signal came from Cisco. The company was reported to be in talks to buy New York-based Astrix Security for between $250 million and $350 million, at least a 25% premium over the startup's last valuation of roughly $200 million 1. Astrix was founded in 2021, has 121 employees and raised $85 million in total 1. Later coverage describes the deal as done. Astrix is now part of Cisco, and its standalone sales ended on June 30, 2026 3.

SailPoint, the identity governance company, also bought a player in the space. Its acquisition of Entro Security closed on June 29, 2026, after Entro had raised an $18 million Series A in 2024 3.

The largest deal is Cyera's planned $1 billion purchase of Oasis Security 2. Oasis was founded in 2022, has 172 employees and raised $195 million, including a $120 million Series B led by Craft Ventures in March 2026 2. It is led by Danny Brickman, who previously headed cyber R&D for the Israel Defense Forces 2. Cyera is primarily a data security company, and it frames the deal as a way to connect identities and permissions to sensitive-data context so customers can see who, or what, can reach their data, including AI systems 2.

Where the accounts differ

The accounts disagree on some details. Coverage of the Cisco talks dates Astrix's $45 million Series B, led by Menlo Ventures, to December 2024 1. A later comparison places it in August 2025 and credits Menlo's Anthology Fund 3.

The status of Oasis is less clear. The Cyera deal was announced in late July 2026 as a planned acquisition 2. A September snapshot still lists Oasis as independent 3. The likeliest explanation is that the deal had been agreed but not yet closed. Still, buyers evaluating Oasis should not assume the integration is finished.

The money behind the momentum

The deals sit on top of continued venture funding. In one recent stretch, 12 cybersecurity companies raised about $1.09 billion, and seven of them protect AI agents, AI-enabled applications or non-human identities 4. That count includes:

• Oak: a $60 million seed round for identity governance and AI-agent identity security 4
• Hush Security: a $30 million Series A for machine identity and AI-agent access security 4

The totals are top-heavy. Horizon3.ai, ThreatLocker and Glow took about 57% of the disclosed funding 4. Even so, the number of identity- and agent-focused deals shows where investors expect the next spending cycle to go.

Why identity is the attack surface now

The consolidation follows how attackers actually work. Microsoft has described a group tracked as Storm-3168/JADEPUFFER using compromised Azure service principals to run destructive operations inside cloud tenants without ever compromising an endpoint 5. Microsoft's Digital Defense Report found cloud identity abuse in 78% of observed critical-infrastructure activity 5. Unit 42 found that 99% of more than 680,000 cloud identities it analyzed held excessive, often unused permissions 5. The same reporting argues that endpoint-centric defenses and most 2026 security budgets have not caught up with this shift 5.

So the practical case for NHI tooling is easy to state. Organizations are full of machine credentials that nobody owns, with more access than they need. Agentic AI adds a fast-growing new population of such identities.

Reading the signal

The pattern suggests that large platforms no longer see NHI security as a standalone product. They see it as a missing layer that has to be absorbed:

• Cisco gets Astrix for its security portfolio.
• SailPoint extends identity governance to machines.
• Cyera ties identity to data.

Each buyer is betting that knowing which non-human actors hold access is now inseparable from its core offering.

The premiums show buyers are willing to pay up rather than build. Astrix sold above its last valuation 1, and Oasis's $1 billion price is a large multiple of its funding 2.

Security teams will face two consequences:

1. Fewer independent vendors. Product roadmaps will increasingly follow the parent company's priorities, as the end of Astrix's standalone sales already shows 3.
2. Questions about the newer startups. Companies like Oak and Hush may become the next targets 4. Alternatively, they may become the neutral alternatives for buyers wary of platform lock-in.

Either way, the market has decided that machine and agent identities are central to security, not a side concern.