Redstrata Knowledge Base

Cyera

5 min read

Cyera

Type: company (data security / DSPM / AI security platform vendor) Sector: Data security posture management (DSPM), data loss prevention, AI security, and — since 3 Sep 2026 — non-human identity (NHI) management First seen: 2026-06-16 (as a named Databricks AI-security roadmap partner) Last updated: 2026-09-18

Created 2026-09-15 from S-2026-09-03-cyera-oasis-completion and S-2026-07-31-kuppingercole-cyera-oasis-first-take (daily DG/DM vendor-intelligence scan). Cyera is an adjacent player, not on the core DG/DM watchlist; the page exists because its $1bn Oasis Security acquisition reshapes the privacy / sensitive-data / access-governance segment (BigID, Securiti, Immuta, Privacera/Trust3) that the watchlist tracks, and because two sources now discuss it. Updated 2026-09-18 based on S-2026-09-18-weekly-vendor-synthesis (weekly vendor-synthesis): cross-week DG/DM read — Cyera’s completed $1bn Oasis Security acquisition is this week’s clearest competitive-landscape signal: it is the third DSPM/non-human-identity consolidation this wiki has tracked in 2026 (after Veeam–Securiti and SailPoint–Entro), narrowing the field of independent sensitive-data/NHI point tools EU/UK FS buyers can shortlist and adding a DORA ICT-third-party-concentration consideration for any firm currently running one of the acquired tools standalone. No contradiction; cross-reference added on Vendor Lifecycle Events as Evidence-Continuity Risk.

Snapshot

Cyera is a data-security vendor whose platform discovers and classifies sensitive data (DSPM), enforces DLP, and — in its own framing — “secures data at rest, in motion, and in use, whether touched by humans or AI agents” [S-2026-09-03-cyera-oasis-completion]. It self-reports a $12bn valuation and over $2.3bn raised from Accel, Blackstone, Cyberstarts, Georgian, Lightspeed and Sequoia [S-2026-09-03-cyera-oasis-completion]. On 3 September 2026 it completed the acquisition of Oasis Security, a non-human-identity / “agentic access management” vendor, for a headline $1bn, folding Oasis in as a named “Cyera Identity” pillar [S-2026-09-03-cyera-oasis-completion]. It matters to this wiki because it is the clearest instance so far of a DSPM vendor buying, rather than building, the identity half of agent-access control — the “who/what can reach which sensitive data” question that underpins GDPR access-control, DORA ICT-risk and FCA/PRA data-control evidence [inference — regulatory read-across is this wiki’s, neither source names an EU/UK regulation].

Positions / Claims they advance

  • Data and identity as one control point. Cyera’s stated thesis is that data and identity “are the two foundational elements of every trust decision” and that the combined platform “determines what every human, machine, and AI agent can see and do”; permissions must be “evaluated fresh before every action, not set once and forgotten” [S-2026-09-03-cyera-oasis-completion]. Vendor positioning; no capability, availability date or customer of the combined platform is described.
  • Post-close structure. Oasis “will operate as Cyera Identity, the dedicated identity pillar within Cyera’s platform, connecting directly to Cyera’s data intelligence layer” [S-2026-09-03-cyera-oasis-completion]. ⚠️ KuppingerCole, writing pre-completion, had expected Oasis to run as an “independent unit” — see Tensions on Agentic Data Access Governance [S-2026-07-31-kuppingercole-cyera-oasis-first-take].
  • NHI growth statistic. Cyera asserts NHIs in Fortune 500 companies “grew nearly 500% in the last six months” [S-2026-09-03-cyera-oasis-completion]; KuppingerCole treats this as an unmethodologised vendor figure it “would not build a business case on”, while accepting the underlying trend from its own research [S-2026-07-31-kuppingercole-cyera-oasis-first-take].
  • Independent analyst view of the deal (KuppingerCole, 31 Jul 2026): architectural logic valid (DSPM knows data sensitivity; NHI management knows the credential-holder — an agent authorisation needs both); price high (~5x SailPoint–Entro’s reported ~$200m; Oasis a “Rising Star” rather than a rated Leader in KC’s NHIM Compass 2025; shared investors so “not a clean arm’s-length price discovery event”); risks of buyer mismatch (IAM vs data-security budget holders), overlap with Cyera’s existing identity module, no secrets-management/PKI substrate, and integration bandwidth (third acquisition of 2026, after Ryft and Genie Security) [S-2026-07-31-kuppingercole-cyera-oasis-first-take].
  • Named customers: Paramount, Chipotle, Valvoline (boilerplate) — none FS, none EU/UK [S-2026-09-03-cyera-oasis-completion]. No EU/UK regulated-FS deployment, regulator or regulation is named in any captured source.
  • Ecosystem: named by Databricks (June 2026) as an upcoming AI-security partner for the Unity AI Gateway alongside CrowdStrike, Palo Alto Networks, Zscaler, HiddenLayer and others — roadmap, not shipped [S-2026-06-16-databricks-unity-ai-gateway-summit].

Relationships

  • relates-to → Agentic Data Access Governance — DSPM-side consolidation of sensitive-data discovery with non-human/agent identity control; the identity half of the “on-behalf-of / least-privilege agent access” pattern tracked there [S-2026-09-03-cyera-oasis-completion][S-2026-07-31-kuppingercole-cyera-oasis-first-take].
  • relates-to → BigID — same DSPM / sensitive-data-discovery segment and the same “agent authority” positioning; neither source names BigID, so this is an [inference] from category, not a sourced competitive claim.
  • relates-to → Databricks — named upcoming Unity AI Gateway AI-security partner (roadmap) [S-2026-06-16-databricks-unity-ai-gateway-summit].
  • derived-from → S-2026-09-03-cyera-oasis-completion — completion press release (primary, self-interested).
  • derived-from → S-2026-07-31-kuppingercole-cyera-oasis-first-take — independent analyst First Take (pre-completion).

Tracked changes

  • 2026-09-03 — Completion of the Oasis Security acquisition announced; $1bn headline value; Oasis to operate as “Cyera Identity” [S-2026-09-03-cyera-oasis-completion]. (Ingested 2026-09-15.)
  • 2026-07-28 — Letter of intent to acquire Oasis Security announced (per KuppingerCole’s account; the LOI announcement itself was not ingested) [S-2026-07-31-kuppingercole-cyera-oasis-first-take].
  • 2026 (per KuppingerCole) — Ryft and Genie Security acquisitions earlier in 2026; $600m raise at $12bn valuation in June 2026 [S-2026-07-31-kuppingercole-cyera-oasis-first-take]. Not independently ingested; the Cyera press index lists a 10 Jun 2026 “$600 Million at $12 Billion Valuation” release and a 23 Apr 2026 Ryft release (index titles only, releases not fetched — see raw stub).
  • 2026-06-16 — Named as upcoming Databricks Unity AI Gateway AI-security partner [S-2026-06-16-databricks-unity-ai-gateway-summit].

Open questions

  • What ships as “Cyera Identity”, and when? No product, availability or roadmap detail in the completion release [S-2026-09-03-cyera-oasis-completion].
  • Which secrets-management / PKI dependencies does the combined platform carry — KuppingerCole’s suggested pre-purchase question [S-2026-07-31-kuppingercole-cyera-oasis-first-take]?
  • Does the buyer-mismatch risk (IAM teams vs data-security/privacy buyers) materialise, and does the acquired feature set survive platform absorption [S-2026-07-31-kuppingercole-cyera-oasis-first-take]?
  • Any EU/UK regulated-FS customer, EU data-residency option, or explicit GDPR/DORA/EU-AI-Act alignment collateral? None seen in either source.
  • Is the “independent unit → Cyera Identity pillar” difference a change of integration plan or only a relabelling? Not determinable from the sources.

Sources

Graph View

Backlinks

Recently updated

See 113 more →