Startup Oasis Security Raises $120 Million From Craft, Sequoia

Oasis Security raised $120 million in a funding round led by Craft Ventures with participation from Sequoia Capital, Accel and Cyberstarts; the company has now raised $190 million in total. The startup provides access-management solutions for non-human accounts such as AI agents and declined to disclose a valuation. The round signals continued investor interest in AI-related cybersecurity solutions but is unlikely to have meaningful market-wide impact.

Analysis

Specialization in non-human account security (machine identities, agent-level access control, secrets/credential lifecycle) is shifting the identity market from human-first to hybrid identity. Incumbent IAM and zero-trust vendors that can productize machine identity quickly (OKTA, ZS, PANW) will capture incremental ARR through attach motions; pure-play privileged access managers (CYBR) face margin pressure unless they modernize APIs and developer ergonomics within 12–24 months. Cloud providers (MSFT, AMZN, GOOGL) will balance embedding basic controls vs partnering — their decision will determine whether this segment commoditizes or stays premium.

Near-term catalysts include enterprise pilot wins, major cloud integrations or API partnerships, and any high-profile machine-agent breach that reframes board-level spend. Expect pilots and proofs-of-concept over the next 3–9 months, with material recurring revenue showing in 12–36 months; M&A interest from large security/platform vendors is a 6–18 month catalyst that would rerate acquirers. Tail risks: rapid embedding by cloud hyperscalers or a regulation-driven slowdown in autonomous-agent deployments could collapse addressable spend, while a major outage/hack could accelerate budget reallocation to identity controls.

Second-order effects: developer/DevOps tooling (CI/CD, secrets managers), observability stacks, and SIEM/XDR vendors gain new telemetry streams — this increases cross-sell and upsell potential for vendors that integrate machine identity signals into detection logic. The market may underprice integration complexity: real-world rollout requires deep hooks into orchestration, service meshes, and vendor-specific SDKs, favoring well-capitalized incumbents or strategic acquirers over small independents. Watch partnership announcements and large enterprise logos as leading indicators of sustainable monetization.

Key Decisions for Investors

• Long OKTA (12 months): buy the equity or a call spread to express 20–30% upside if Okta secures machine-identity attach deals; hedge with a 10–12% trailing stop. Rationale: leader in identity with largest enterprise footprint to cross-sell non-human controls.
• Pair trade — Long ZS / Short CYBR (6–12 months): Zscaler benefits from zero-trust demand and developer-friendly integrations while CyberArk risks disintermediation. Target asymmetric payoff ~2:1; tighten stops if CYBR announces a modernized cloud-native platform.
• Long CRWD (9–18 months) via call spread: CrowdStrike can monetize new telemetry from machine identities into XDR; expect 25–40% upside on successful product launches and partner integrations, with downside limited by durable endpoint franchise.
• Event-driven long on PANW (6–18 months): buy shares or Jan 2027 calls ahead of potential M&A/partnership catalysts to package machine-identity into broader network/security stacks. Risk: execution on developer ergonomics; reward: re-rating if PANW leads consolidation.