Oasis Security

1.1 Identity, product, and operating model

Oasis Security was founded in 2022 and built a cybersecurity platform for non-human identities, including service accounts, API keys, secrets, and AI agents. The available evidence describes a lifecycle-oriented product: discovery and inventory, ownership attribution, posture monitoring, governance, rotation, remediation, and decommissioning across cloud, SaaS, and on-premises environments. A Wiz integration describes the operating workflow more concretely by correlating cloud issues and data-security findings with identity privilege, usage, and ownership before teams take actions such as attestation, key rotation, right-sizing, or decommissioning. Independent review evidence characterizes Oasis as complementary to an existing identity provider and secrets manager rather than a replacement for human SSO or MFA. Pricing is not public, so the commercial model and current revenue remain diligence gaps.[CO001, CO002, CO008, CO009, CO012]

1.2 Leadership, governance, and stakeholder map

Danny Brickman is identified as co-founder and CEO in the retained company-profile evidence, while Cyera's completion announcement names Amit Zimerman as CTO of Cyera Identity and describes Brickman as Oasis's co-founder and CEO. The acquisition therefore creates a material key-person and integration question: the public materials support continuity messaging but do not specify Brickman's formal post-close title or the full governance structure inside Cyera. Cyera is the controlling strategic stakeholder after closing; prior investors remain relevant to capitalization and incentives, while the Wiz partnership illustrates the ecosystem route by which Oasis connected identity context to cloud-risk workflows. Enterprise customers are the most exposed operating stakeholders because pricing, contract terms, support continuity, and integration timing were not published in the retained sources.[CO007, CO011, CO015, CO017]

1.3 Financing, acquisition, and remaining diligence

Tracxn reports $195 million of total funding across three rounds, a Series B on March 20, 2026, and 146 employees as of September 30, 2026; an independent company profile separately reports a $40 million Series A in 2024. These sources establish a financing and scale trajectory but do not disclose Oasis revenue, ARR, gross margin, burn, runway, or customer count. The July 28 letter of intent was described by a secondary report as approximately $1 billion and mostly cash, while Cyera's September 3 announcement confirms completion and a $1 billion deal value; the transaction structure is still not disclosed by the retained primary announcement. The post-close rebrand to Cyera Identity is clear, but contract migration, pricing, and the depth and timing of technical integration remain open questions. The timeline separates dated facts from unresolved diligence items rather than treating a funding total as cash available or a deal value as a valuation of current operations.[CO003, CO004, CO005, CO006, CO010, CO013, CO014]

1.4 Exhibits

2.1 Market boundary and substitutes

The investable boundary is enterprise non-human identity governance: discovering service accounts, secrets, tokens, certificates, bots, and AI agents; assigning ownership; evaluating privilege and use; and executing lifecycle actions such as attestation, rotation, right-sizing, and decommissioning. Oasis spans cloud, SaaS, and on-premises environments, but it is not a human identity provider and does not replace SSO or MFA. It also sits beside, rather than wholly replacing, secrets managers, conventional IAM/PAM, cloud-security posture tools, and internal scripts. That boundary makes the category strategically important without treating all identity-security or cloud-security spend as addressable revenue for Oasis.[CM001, CM002, CM003, CM006, CM007]

2.2 Evidence-constrained sizing

No retained source provides a transparent dollar TAM, SAM, or SOM with geography, denominator, and methodology. The best public sizing lenses are therefore operating proxies, not market values. A March 2026 article relayed Palo Alto Networks' estimate that machine identities outnumber people 82 to 1, while an Oasis-issued January 2024 release claimed 50 to 1. The difference may reflect timing, scope, or methodology, none of which is disclosed well enough to reconcile. Tracxn's 47 active competitors, 10 funded competitors, and three exits indicate a populated category, while the reported acquisition letter of intent shows strategic demand but cannot be converted into recurring market spend.[CM004, CM005, CM014, CM015, CM016]

2.3 Buyers, users, payers, and adoption path

The core buying coalition is likely led by security leadership and identity-security owners, with cloud-security, IAM/PAM, platform engineering, DevOps, and AI-platform teams supplying deployment context and bearing workflow disruption. Wiz's integration description shows why a cross-functional sale is required: privilege, data sensitivity, usage, and ownership must be correlated before a team can rotate or right-size a machine credential without breaking production. Oasis has claimed broad enterprise traction, including a majority-Fortune-500 customer mix and mostly multi-year new revenue. Those signals support enterprise willingness to pay, but they do not reveal seat, identity, workload, or platform budgets.[CM006, CM007, CM010, CM011, CM012, CM013]

2.4 Drivers, constraints, and valuation relevance

Adoption is driven by the proliferation of autonomous agents and machine credentials, the inadequacy of human-centric access controls, and the operational need to move from inventory to safe remediation. Constraints are equally material: Start With Identity describes opaque pricing, a sales-led proof-of-value process, SaaS-only deployment, dependence on existing IdP and secrets tooling, and an early market whose integrations are still expanding. A reported fivefold increase in new annual recurring revenue is directional evidence of demand, not ARR, market growth, or cash generation. The approximately $1 billion acquisition letter of intent indicates strategic scarcity, but it was not closed in the cited reports and is not a market multiple or standalone valuation proof.[CM003, CM008, CM009, CM011, CM015, CM016]

2.5 Exhibits

3.1 Landscape and category boundaries

Oasis addresses non-human identities such as service accounts, secrets, tokens, certificates, API keys, service principals, and AI agents. The closest direct alternatives are specialist machine-identity vendors including Astrix, Token Security, Clutch Security, and GitGuardian, while Keyfactor, Venafi, and AppViewX represent incumbent or adjacent certificate, PKI, and machine-identity automation capabilities. Cyera is an important strategic incumbent after signing a letter of intent to acquire Oasis, and Wiz is an adjacent cloud-security platform with an Oasis integration. The status quo remains a fragmented mix of identity-provider, secrets-manager, cloud-security, and internally scripted workflows; a buyer may therefore compare a specialist purchase with extending existing controls rather than selecting among identical products.[CP001, CP002, CP003, CP004]

3.2 Differentiation, capability, and buyer trade-offs

Public evidence points to Oasis's main distinction being operational depth: discovery is paired with ownership attribution, posture, rotation, attestation, hygiene, right-sizing, and decommissioning. An independent category review says Oasis pushes “past inventory into lifecycle and remediation workflows,” while also documenting boundaries: it is not an identity provider, human authentication, SSO, or MFA product, and its deployment is SaaS-only. Wiz's partner description reinforces the remediation-oriented workflow, describing correlation of cloud findings with privilege, usage, ownership, and blast radius. These strengths can create workflow value, but they also leave room for larger platforms to bundle comparable controls and for buyers to retain existing IdP and secrets-management systems. Unsupported cells in the matrix remain unknown rather than being inferred from marketing language.[CP005, CP006, CP007, CP008]

3.3 Pricing, switching costs, and moat durability

Pricing is not publicly disclosed, so competitive economics cannot be compared on a verified per-identity or per-system basis. The available review describes an annual enterprise subscription scoped by identity count and connected systems, sold through a sales-led proof-of-value process; this is a directional packaging signal, not realized pricing. Switching costs should rise when Oasis is connected to production identities and remediation workflows, because rotation, decommissioning, and ownership decisions must avoid operational impact. However, the same integration surface can favor broader platforms with existing distribution. The Cyera transaction is adverse to durable standalone independence: TechCrunch reports a roughly $1 billion letter of intent and says Cyera plans to integrate Oasis into a unified identity and data-security platform. Deal terms were not closed in the prefetched evidence, so the strategic implication is stronger than any conclusion about final ownership.[CP009, CP010, CP011, CP012]

3.4 Evidence exhibits

The exhibits separate verified competitor descriptions from analyst or directory classifications. Tracxn supplies a broad competitor set and funding snapshots, but its ranking is a database signal rather than a buyer-validated performance benchmark. Start with Identity supplies an independent qualitative assessment, including limitations and opaque pricing. Wiz supplies partner evidence of an integration and use case, not independent proof of customer outcomes. The resulting positioning map is ordinal and evidence-backed: it is a synthesis of documented scope and lifecycle depth, not a quantitative market-share or product performance claim.[CP003, CP005, CP007, CP009]

3.5 Exhibits

4.1 Revenue model and pricing

Oasis appears to monetize as enterprise software rather than through a public self-service tariff. Start With Identity describes an annual enterprise subscription, scoped by identity count and connected systems, sold through a sales-led proof of value; it also says no public pricing is available. That supports recurring contract form, but not realized price, contract duration, discounts, usage overages, revenue recognition, or mix. The Wiz integration shows how additional connected systems and remediation workflows can broaden deployed scope, yet neither source quantifies attach rates or incremental revenue. The underwriting file should therefore treat subscription structure as supported and every dollar-level revenue input as unavailable.[CI001, CI002, CI003, CI004]

4.2 Commercial motion and cost drivers

The disclosed go-to-market motion is enterprise and proof-of-value led. A company-issued 2024 release said Oasis had signed blue-chip customers within its first year, but it provided no customer count, contract value, sales cycle, conversion rate, or expansion measure. The product also spans identity discovery, posture analysis, ownership context, integrations, rotation, right-sizing, and decommissioning. Those capabilities can support platform value and expansion, but they may also create implementation, connector maintenance, customer success, and support costs. Public sources do not separate software gross margin from service-delivery cost, so neither SaaS-like margin assumptions nor implementation revenue should be imposed without cohort-level contract data.[CI002, CI003, CI004, CI014]

4.3 Public traction, capital, and transaction context

Capital formation is visible, while operating traction is not. Oasis announced $40 million of funding in January 2024; Tracxn later reported $195 million raised across three rounds, and separate reporting identified a $120 million Series B in March 2026. These are financing flows, not current cash. The assigned evidence discloses no Oasis revenue, ARR, growth, gross margin, retention, burn, or runway. A July 2026 letter of intent valued a proposed Cyera acquisition at roughly $1 billion, reportedly mostly cash, but multiple sources stress that the deal had not closed. The headline value is therefore a contingent transaction signal, not revenue validation or cash available to Oasis.[CI005, CI006, CI007, CI008, CI009, CI010, CI016]

4.4 Financial verdict and diligence blockers

Revenue quality cannot be underwritten from the public record beyond the likely recurring subscription form. The strongest commercial positives are a sales-led enterprise motion, partner-enabled workflow breadth, and reports of early large-enterprise adoption. The counterweight is severe metric opacity: no public ARR bridge, bookings, ACV, renewal, concentration, CAC, payback, gross margin, operating expense, debt, cash, burn, or runway. The adverse case is also strategic: if incumbent identity or cloud platforms absorb non-human-identity governance, pricing power and standalone renewal durability could weaken. Investment-grade diligence requires the company ledger, contract cohort data, cost allocation, liquidity schedule, and acquisition closing documentation rather than extrapolation from funding or the headline letter-of-intent value.[CI010, CI011, CI015, CI016]

4.5 Exhibits

5.1 Product scope and user workflow

Oasis Security is positioned as an enterprise platform for non-human identities such as service accounts, secrets, API keys, tokens, certificates, bots, and AI agents. The user problem is operational rather than merely inventory: security teams need to identify machine identities, determine who owns them and what they can reach, assess whether they are active, and take lifecycle action without breaking production. SecurityWeek describes an agentless connection to customer environments with continuous observation, resource and privilege context, severity scoring, and remediation recommendations. The public record therefore supports a workflow from discovery and posture assessment to ownership, prioritization, and remediation, but does not establish measured discovery coverage, time-to-value, or production success rates.[CE001, CE002, CE003, CE004]

5.2 Architecture and operating model

The apparent operating model combines an agentless SaaS control plane with connectors or integrations into enterprise environments and adjacent security systems. The Wiz integration is concrete evidence of one pathway: Wiz Issues and DSPM findings are correlated with Oasis identity, privilege, usage, and ownership context, after which teams can initiate attestation, hygiene, right-sizing, key rotation, or decommissioning workflows. This architecture is strategically useful because it connects cloud findings to the machine identity behind access rather than leaving remediation at the resource level. However, the sources do not disclose the connector catalogue, collection protocols, tenant isolation model, data residency, latency, failure handling, or whether lifecycle actions are fully automated versus approval-assisted.[CE005, CE006, CE007, CE008]

5.3 Maturity, differentiation, and roadmap

Public descriptions consistently distinguish Oasis from a human identity provider: its focus is the lifecycle of machine identities, including discovery, ownership attribution, posture, rotation, and decommissioning. The product's differentiating promise is operational closure rather than a dashboard, especially the ability to prioritize by blast radius and safely execute remediation. A community review says pricing is opaque, deployment is SaaS-only, and human SSO and MFA are out of scope; it also characterizes AI-agent coverage as part of the roadmap. Those statements are useful external checks on scope, but they are not independently audited product benchmarks. The category appears early, and the evidence does not establish feature parity, implementation duration, or a durable technical moat.[CE009, CE010, CE011, CE012]

5.4 Trust, safety, and diligence gaps

Oasis's product value depends on acting safely on identities that may power production workloads. The Wiz integration explicitly frames safe rotation, right-sizing, and decommissioning as actions that should avoid production impact, while the company's earlier product description emphasizes risk scoring and tailored remediation recommendations. These are important control objectives, not proof that the controls work under all failure modes. No assigned source provides a public security architecture, independent certification, incident history, uptime commitment, penetration-test summary, privacy posture, or quantified false-positive and rollback performance. A buyer should therefore test permissions, approval gates, auditability, connector failure behavior, rollback, and evidence retention in a proof of value before relying on automated lifecycle actions.[CE013, CE014, CE015, CE016]

5.5 Exhibits

6.1 Enterprise buyers, users, and adoption surfaces

Oasis is positioned for large enterprises whose security, identity, and engineering teams must govern service accounts, secrets, API keys, certificates, and AI agents across hybrid environments. The buyer is most plausibly the CISO organization or identity-security leadership, while identity operations, cloud-security teams, application owners, and developers are the day-to-day users required to assign ownership and execute lifecycle actions. Company materials span IaaS, SaaS, PaaS, and on-premises systems and name major identity providers, vaults, data platforms, developer systems, and AI applications. This breadth supports a cross-environment enterprise workflow, but it does not reveal customer mix by geography, vertical, company size, or revenue band. Independent directory coverage likewise describes an enterprise non-human-identity focus rather than a quantified segment distribution.[CU001, CU002, CU011]

6.2 Adoption evidence is concrete but selectively disclosed

The strongest named proof is a 2024 JLL testimonial in an Oasis-issued release: JLL's head of identity security said the product improved visibility, lifecycle automation, security, and governance. The current homepage adds four outcome examples, including avoided regulatory exposure, lower secret-rotation effort, outage containment, and attack-surface reduction. Those examples show relevant enterprise pain and measurable value, yet the customers are unnamed and one result is explicitly described as occurring during a proof of value. The evidence therefore establishes use-case resonance more strongly than repeatable, production-scale adoption. A Wiz integration page provides partner-issued proof that joint customers can connect cloud findings to identity remediation, but it reports no deployment count, realized customer outcome, or commercial channel contribution.[CU003, CU004, CU005, CU006, CU007, CU008, CU009]

6.3 Durability and concentration remain private as ownership changes

The retained public evidence does not disclose an active-customer count, NRR, GRR, churn, renewal rates, contract duration, cohort behavior, expansion revenue, or top-customer concentration. These are not merely missing dashboard metrics: without them, investors cannot distinguish broad logo acquisition from durable production use or test whether a small number of enterprises or partners drives revenue. An independent identity review describes Oasis as best suited to enterprises seeking lifecycle and rotation workflows, but also flags opaque pricing, sales-led procurement, and proof-of-value onboarding. The pending Cyera transaction introduces another durability variable. Oasis promises continuity for customers, team, platform, and roadmap, while independent coverage notes that only a letter of intent existed and that post-acquisition integration depth and vendor lock-in remain execution questions.[CU010, CU012, CU013, CU014, CU015, CU016]

6.4 Exhibits

7.1 Transaction, legal, and ownership exposure

The most consequential current risk is transaction status. The Brief and Masternode AI describe a July 28, 2026 letter of intent for Cyera to acquire Oasis for approximately $1 billion, with consideration expected to be mostly cash and partly Cyera shares. Masternode explicitly says the deal was not closed and final terms could change, while Tracxn labels Oasis as acquired on the same date. Until definitive documents and closing evidence are produced, ownership, consideration, timing, employee treatment, and product commitments remain unsettled. The assigned evidence also does not resolve litigation, regulatory, privacy, sanctions, or security-incident exposure. That is a material diligence gap, not evidence of a clean record. Nasdaq Private Market's fetched Oasis page adds no transaction pricing and states that its investor services are limited to accredited investors, so it should not be treated as proof of secondary liquidity or a market-clearing value.[CR001, CR002, CR006, CR007, CR008, CR009]

7.2 Integration and operational-control risk

Cyera reportedly intends to combine Oasis's non-human identity capability with a broader identity and data-security platform. The strategic fit is plausible, but the integration must preserve discovery, ownership attribution, posture, rotation, and decommissioning workflows across heterogeneous systems. Wiz's partner page shows that Oasis consumes Wiz Issues and DSPM findings to correlate cloud risk with identity context, illustrating both useful interoperability and dependence on connected products and data quality. Oasis's own company-issued release claims automatic discovery, risk assessment, and remediation, but the assigned pool does not independently quantify coverage, false negatives, failed rotations, or production impact. A loss of product fidelity, broken connector coverage, or unsafe lifecycle actions would directly undermine the product's risk-reduction thesis. Diligence should therefore test control effectiveness, connector failure modes, audit logs, release continuity, and named deployment outcomes rather than rely on feature descriptions.[CR003, CR004, CR015]

7.3 Commercial, financial, and capacity risk

Start with Identity identifies structural commercial constraints: Oasis is not an identity provider, human authentication, SSO, and MFA are outside scope, deployment is SaaS-only, and pricing is opaque. It recommends using Oasis alongside an existing identity provider and secrets manager. Those boundaries increase procurement coordination and can make realized value depend on adjacent systems, implementation quality, and enterprise willingness to buy another control plane. Public capacity indicators are also inconsistent: DecipherU described a 50-100 employee company in April 2026, whereas Tracxn reported 146 employees as of September 30, 2026. More importantly, the assigned evidence does not provide revenue, retention, gross margin, burn, runway, implementation cost, or customer-concentration denominators. Funding raised must not be treated as cash available, and the reported acquisition headline must not substitute for operating evidence.[CR005, CR010, CR011, CR012, CR013]

7.4 Dependencies, monitoring indicators, and thesis breaks

Oasis depends on the reported acquirer, enterprise identity and secrets-management stacks, cloud-security integrations, and a still-forming non-human identity category. Tracxn reports 47 active competitors, including 10 funded companies and three that have exited; the count is market-data context, not an independent product benchmark. Investors should monitor definitive transaction status, retained product leadership, connector and remediation reliability, deployment time, referenceable renewals, expansion, gross margin, cash runway, and customer or partner concentration. Thesis-break triggers are a failed or materially changed transaction, discontinuation or dilution of agent-governance functionality, loss of referenceable enterprise renewals, repeated unsafe remediation, or evidence that opaque pricing and implementation burden prevent repeatable sales. Each trigger is observable and should prompt a re-underwrite rather than a narrative adjustment.[CR003, CR004, CR005, CR014, CR016]

7.5 Exhibits

8.1 Investment thesis and anti-thesis

The thesis is that Oasis built a differentiated position in a newly important security category and converted that position into strategic value. CRN reports that Cyera agreed to acquire Oasis for $1 billion and that Oasis had raised $195 million, while an independent review describes the product as unusually operational because it extends beyond inventory into ownership, rotation, and decommissioning. The product page supports a broad workflow from discovery and context through posture, threat detection, remediation, and lifecycle management. This combination supports category relevance and a credible strategic buyer rationale, but it does not establish standalone revenue quality or a cash-on-cash return. The anti-thesis is that the public price is reported rather than a completed transaction consideration, and the product's independent review identifies opaque pricing and an early market. A buyer should therefore underwrite strategic scarcity as an option, not as proof that the reported headline price is fair.[CV001, CV002, CV003, CV004]

8.2 Financing context and entry discipline

Public financing evidence establishes a capital and exit frame but not a complete valuation bridge. Tracxn records $195 million of total funding across three rounds and identifies a March 2026 Series B, while CRN independently reports the $120 million Series B and $195 million total. The acquisition reporting places the transaction near $1 billion, implying roughly 5.1 times total capital raised, but that ratio is a capital multiple, not a revenue multiple and should not be treated as an operating valuation. A separate report says the letter of intent is expected to be mostly cash with the remainder in Cyera shares; because the deal was not closed in that account, liquidity, consideration mix, preferences, escrow, earn-outs, and employee rollover remain open. The evidence therefore supports entry discipline based on verified closing terms and operating metrics rather than a precise public mark. The missing ARR, gross margin, burn, runway, NRR, and cap-table terms are material to any investor return model.[CV006, CV007, CV008, CV009, CV010]

8.3 Scenarios, comparables, and downside

Scenario work should use the reported acquisition as an observable strategic reference while keeping operating assumptions explicit. The bull case is a closed transaction near the reported price followed by successful integration that preserves Oasis's agent and non-human identity capability inside Cyera's data-security platform. The base case is a strategic outcome that validates the category but leaves the standalone economics unproven, warranting a research-more decision until terms and metrics are disclosed. The bear case is a delayed, repriced, or failed transaction, or an integration that weakens product fidelity; an independent review specifically cautions that the letter of intent and roadmap can change. Tracxn supplies a directional peer set including Keyfactor, GitGuardian, AKEYLESS, Astrix, Token Security, and Clutch Security, but its score and funding table are not a like-for-like public-company multiple set. These references help define category breadth, not a defensible comp-derived enterprise value. No public source in the assigned pool supplies comparable revenue multiples, so precision would be false.[CV012, CV013, CV014, CV015]

8.4 Recommendation and thesis-break triggers

The recommendation is research-more with high uncertainty and a high risk rating. The strategic logic is supported by Cyera's stated plan to unite data and identity security, by independent commentary on the scarcity of non-human identity capability, and by Oasis's documented lifecycle product surface. The price conclusion is deliberately narrower: public evidence supports strategic importance and a reported $1 billion headline, but not fair value, investor proceeds, or a target return. The decision should move toward a more positive valuation stance only after signed closing terms, consideration mix, preference treatment, and standalone operating metrics are obtained. Thesis-break indicators are a failed or materially repriced transaction, loss of key product functionality after integration, evidence that customer adoption does not convert to durable recurring revenue, or concentration and renewal metrics that make the category position economically fragile. Exit readiness is consequently conditional on transaction completion and retention of Oasis's technical and customer momentum inside Cyera.[CV016, CV017, CV019]

8.5 Exhibits