What Solo Builders Should Learn From the $1B Cyera-Oasis Deal

Cyera — a data security company valued at $12 billion — just signed a letter of intent to acquire Oasis Security for roughly $1 billion. The reason? AI agents. Specifically, the problem of giving agents access to systems without those agents having proper identities, permissions, or oversight. If you’re running AI agents in your own business — even as a solo builder — this deal is a signal worth paying attention to.

What this deal actually means

The numbers tell the story. Cyera recently raised $600 million and has surpassed $150 million in annual recurring revenue. Oasis Security raised about $195 million to focus on one specific problem: non-human identities. When a company spends a billion dollars to acquire a startup in a niche most people haven’t heard of, something big is happening underneath.

Non-human identities — or NHIs — are the API keys, service accounts, tokens, and permissions that let software talk to other software. Traditionally, these were things a developer set up once and forgot about: a Slack bot with a webhook URL, a Zapier connection with an OAuth token, a CI/CD pipeline with a deploy key.

AI agents changed the equation. When you give an agent the ability to browse the web, send emails, access databases, and call APIs, you’re not just granting a single permission — you’re handing over a set of credentials the agent can chain together in ways you might not predict. And unlike a human employee, agents operate at machine speed. They don’t pause to think “should I really be doing this?”

That’s why Cyera paid a billion dollars. They’re betting that the biggest security gap in the AI era isn’t the models themselves — it’s the identities and permissions wrapping around them.

The problem for solo builders

If you’re running agents through Make or Zapier, or using tools like Claude with MCP integrations, or building autonomous workflows, you’re already dealing with non-human identities. You just might not be thinking about them as security problems.

Here’s what that looks like in practice:

Your agent has your API keys. If you’re using an AI agent to interact with your email, calendar, or project management tools, the agent is operating with your credentials. Every action it takes looks like it came from you. There’s no audit trail that says “the AI did this, not the human.”

Access is all-or-nothing. Most of the tools solo builders use grant broad permissions. Zapier gets “read and write all your Google Drive files,” not “read this one specific folder.” Your agent might only need to read a spreadsheet, but it has the keys to delete your entire Drive.

Nobody is watching the agent. In an enterprise, there are security teams monitoring for anomalous behavior. In a solo operation, you’re the security team. If your agent misbehaves — sending an email to the wrong person, deleting files it shouldn’t, calling an API that charges money — you find out after the fact.

This is the gap that Cyera and Oasis are building products to fill at enterprise scale. But the underlying problem is already here, and it affects solo builders just as much.

What you should actually do about it

You don’t need to spend a billion dollars on security software. But here are five practical steps that address the same problem the Cyera-Oasis deal is highlighting:

1. Audit your agent permissions

Take 15 minutes and list every API key, OAuth connection, and service account your AI tools use. For each one, ask: what can this access? If the answer is “everything,” you’ve found your first problem.

Most services offer more granular permissions than the defaults. Google, for example, lets you create service accounts with specific scopes. If your agent only needs to read a calendar, don’t give it write access.

2. Use separate keys for agent access

Don’t give your AI agent the same API key you use for your own work. Create dedicated credentials for each agent or workflow. That way, if something goes wrong, you can revoke the agent’s access without disrupting your own tools.

This is the principle behind OAuth scopes — Cloudflare just shipped task-based OAuth consent, which lets you grant apps only the permissions they need for a specific task, not blanket access.

3. Add logging you’ll actually check

You don’t need a SIEM dashboard. But you do need some visibility into what your agents are doing. Simple automation can help: a Google Sheet that logs every action your agent takes, a Slack notification when the agent accesses a new system, a weekly digest of API calls.

The goal isn’t to catch a sophisticated attack — it’s to notice when something unexpected happens. If your agent suddenly starts making 10x more API calls than usual, or accessing endpoints it’s never touched before, that’s worth knowing.

4. Scope your agents narrowly

The best agent frameworks let you define what tools and capabilities each agent has. Don’t give every agent access to everything. If an agent’s job is to summarize emails, it doesn’t need access to your database. If it’s scraping web data, it doesn’t need your email credentials.

This is the principle of least privilege, and it applies to agents exactly the way it applies to human employees — except agents need it more, because they act faster and don’t stop to ask questions.

5. Plan for key rotation

If you haven’t changed your API keys in six months, they’re stale. Set a reminder to rotate credentials quarterly. When you rotate, check that nothing breaks — if it does, that’s a sign your agent has dependencies you didn’t know about, which is exactly the kind of visibility gap that leads to security incidents.

The bigger picture

The Cyera-Oasis deal is part of a broader trend: the market for non-human identity security is projected to grow from $12.4 billion in 2026 to $27.3 billion by 2033. That’s not a niche — it’s a recognition that the identity layer of the internet is fundamentally changing.

For years, security was about protecting human accounts: passwords, two-factor authentication, phishing awareness. The agent security gap is about a new category of user that doesn’t sleep, doesn’t get tired, doesn’t second-guess itself, and operates with credentials that look exactly like a human’s.

If you’re building with AI agents today, you’re already in this world. The question isn’t whether you need to think about agent security — it’s how much risk you’re comfortable with while you figure it out.

The bottom line

A billion-dollar acquisition is a clear signal: the industry is pivoting to take AI agent security seriously. Solo builders don’t need enterprise security tools, but ignoring the problem because you’re small is a mistake. Your agents have your keys, they act at machine speed, and nobody is watching them but you. Start with an audit, scope permissions narrowly, and add even basic logging. The cost of getting this wrong is a lot higher than the 30 minutes it takes to get it right.

Want to go deeper on agent security? Read the agent security gap every solo builder should know about or explore how AI agents actually work under the hood.