🎧 Prefer to listen?

Cyera, a data security company valued at $12 billion, signed a letter of intent to acquire Oasis Security for roughly $1 billion. The target: non-human identities — the API keys, tokens, and service accounts that AI agents use to act on a company’s behalf. Cyera raised $600 million recently and has passed $150 million in annual recurring revenue; Oasis raised about $195 million to chase this one problem. If you run AI agents in your own business, even as a solo builder, this deal is a signal worth reading.

What does the Cyera-Oasis deal actually mean?

Cyera is paying a billion dollars for a startup in a niche most people haven’t heard of, and the numbers explain why. Cyera recently raised $600 million and surpassed $150 million in annual recurring revenue. Oasis Security raised about $195 million to focus on one thing: non-human identities, or NHIs — the API keys, service accounts, tokens, and permissions that let software talk to other software.

Traditionally, these were set-and-forget items. A Slack bot with a webhook URL. A Zapier connection with an OAuth token. A CI/CD pipeline with a deploy key. A developer set them up once and moved on.

AI agents changed the equation. When you give an agent the ability to browse the web, send emails, access databases, and call APIs, you’re handing over a set of credentials it can chain together in ways you might not predict. And unlike a human employee, agents operate at machine speed. They don’t pause to ask “should I really be doing this?”

So Cyera is betting that the biggest security gap in the AI era isn’t the models themselves; it’s the identities and permissions wrapped around them.

Why should solo builders care about non-human identities?

If you run agents through Make or Zapier, use Claude with MCP integrations, or build autonomous workflows, you’re already dealing with non-human identities. You just might not be thinking of them as security problems.

Three things go wrong in practice.

Your agent has your API keys. If an AI agent interacts with your email, calendar, or project management tools, it operates with your credentials. Every action looks like it came from you. There’s no audit trail that says “the AI did this, not the human.”

Access is all-or-nothing. Most tools solo builders use grant broad permissions. Zapier gets “read and write all your Google Drive files,” not “read this one folder.” Your agent might only need to read a spreadsheet, but it holds the keys to delete your entire Drive.

Nobody is watching the agent. Enterprises have security teams monitoring for anomalous behavior. In a solo operation, you’re the security team. If your agent misbehaves — sending an email to the wrong person, deleting files, calling an API that charges money — you find out after the fact.

That’s the gap Cyera and Oasis are filling at enterprise scale. The underlying problem is already here, and it hits solo builders just as hard.

What should you actually do about it?

You don’t need to spend a billion dollars on security software. Five practical steps cover the same ground.

1. Audit your agent permissions

Take 15 minutes and list every API key, OAuth connection, and service account your AI tools use. For each one, ask: what can this access? If the answer is “everything,” you’ve found your first problem.

Most services offer more granular permissions than the defaults. Google, for example, lets you create service accounts with specific scopes. If your agent only needs to read a calendar, don’t give it write access.

2. Use separate keys for agent access

Don’t give your AI agent the same API key you use for your own work. Create dedicated credentials for each agent or workflow. If something goes wrong, you revoke the agent’s access without disrupting your own tools.

This is the principle behind OAuth scopes — Cloudflare just shipped task-based OAuth consent, which lets you grant apps only the permissions a specific task needs, not blanket access.

3. Add logging you’ll actually check

You don’t need a SIEM dashboard, but you do need visibility into what your agents are doing. Simple automation helps: a Google Sheet that logs every agent action, a Slack notification when the agent touches a new system, a weekly digest of API calls.

The goal isn’t to catch a sophisticated attack. It’s to notice when something unexpected happens. If your agent suddenly makes 10x more API calls than usual, or hits endpoints it’s never touched, that’s worth knowing.

4. Scope your agents narrowly

The best agent frameworks let you define what tools and capabilities each agent has. Don’t give every agent access to everything. If an agent’s job is to summarize emails, it doesn’t need your database. If it’s scraping web data, it doesn’t need your email credentials.

This is least privilege, and it applies to agents the way it applies to human employees — except agents need it more, because they act faster and don’t stop to ask questions.

5. Plan for key rotation

If you haven’t changed your API keys in six months, they’re stale. Set a reminder to rotate credentials quarterly. When you rotate, check that nothing breaks — if it does, your agent has dependencies you didn’t know about, and that’s exactly the visibility gap that leads to security incidents.

How big is the non-human identity security market?

The market for non-human identity security is projected to grow from $12.4 billion in 2026 to $27.3 billion by 2033. That’s a recognition that the identity layer of the internet is changing, and fast.

For years, security meant protecting human accounts: passwords, two-factor authentication, phishing awareness. The agent security gap is about a new category of user that doesn’t sleep, doesn’t get tired, doesn’t second-guess itself, and operates with credentials that look exactly like a human’s.

If you’re building with AI agents today, you’re already in this world. The question isn’t whether you need to think about agent security; it’s how much risk you’re comfortable carrying while you figure it out.

A billion-dollar acquisition tells you the industry is taking AI agent security seriously. Solo builders don’t need enterprise tools, but ignoring the problem because you’re small is a mistake. Your agents have your keys, they act at machine speed, and nobody is watching them but you. Start with an audit, scope permissions narrowly, add even basic logging. Getting this wrong costs a lot more than the 30 minutes it takes to get it right.

Want to go deeper? Read the agent security gap every solo builder should know about or explore how AI agents actually work under the hood.

FAQ

What is a non-human identity (NHI)? A non-human identity is any credential software uses to access other software: API keys, service accounts, OAuth tokens, deploy keys, and bot permissions. AI agents make NHIs riskier because they chain credentials together at machine speed, act with your identity, and don’t pause to question their own actions the way a human employee would.

Why did Cyera acquire Oasis Security for $1 billion? Cyera, valued at $12 billion with over $150 million in annual recurring revenue, is betting the biggest security gap in the AI era is the identities and permissions around AI models, not the models themselves. Oasis raised about $195 million to build products for non-human identity security, the category AI agents have made urgent.

How can a solo builder secure AI agents without enterprise tools? Audit every API key and OAuth connection your agents use, create dedicated credentials for each agent, add simple logging like a Google Sheet of agent actions, scope each agent to only the tools its job requires, and rotate API keys quarterly. These steps take roughly 30 minutes to set up and address the same risks enterprise NHI products target.

How often should I rotate API keys used by AI agents? Rotate them quarterly. If a key hasn’t changed in six months, it’s stale. When you rotate, verify nothing breaks — a breakage means your agent has hidden dependencies on that credential, which is itself a visibility gap worth fixing before it causes a security incident.