$1.09 Billion Poured Into AI Agent Permissions in One Day

Cyera agreed to buy Oasis Security for $1 billion on July 28, one of three security deals worth $1.09 billion that day, per SecurityWeek, PR Newswire, Axios Pro and Calcalist.

Gartner expects the average Fortune 500 company to run more than 150,000 AI agents by 2028, up from fewer than 15 in 2025. Only 13% of organizations say they can govern that. Every one of those agents needs credentials, and most hold standing access nobody checks or revokes.

All three deals sell versions of the same fix. Stop handing agents permanent credentials, scope access to the task in front of them, and keep one registry that can kill any agent's access the moment something looks wrong.

Act Security left stealth the same day with $60 million: a $20 million seed from Team8 and Bessemer, plus a $40 million Series A from Notable Capital. Hush Security closed its own $30 million Series A, with Akamai joining as a strategic investor.

The permissions layer is turning into a bought category

Cyera didn't build this in house. It bought Oasis instead, the clearest signal in the batch: nobody in this category thinks there's time left to build agent-identity infrastructure from scratch before the agent count explodes past what any team can track by hand.

In a related release the same day, MCP shipped its largest protocol revision yet, adding OAuth 2.1 and a stateless core, a separate push to formalize how agents authenticate at the protocol level. Between the funding and the protocol work, knowing who an agent is and what it may touch is becoming a purchased dependency, the way SSO did a decade ago.