Oak’s $60 Million Bet Lands in an Already Crowded Identity Race

Oak, a cybersecurity startup with offices in Tel Aviv and San Francisco, walked out of stealth this week carrying $60 million in seed funding for what it calls an AI-native identity operating system. Accel, Greylock Partners and CRV co-led the round, joined by Hetz Ventures, AlphaDrive Ventures and a group of angel investors.

Rivals chasing the same idea got there first. In the past five months, the identity security market has produced a $21.1 billion acquisition and a $400 million buyout of a five year old startup that had raised just $85 million total. Oak is asking investors to believe there is still room to build something bigger than either.

What Oak Is Selling

Oak was founded by Shai Morag and Tal Marom to replace a patchwork of legacy tools with one system: a live map of every identity inside a company, whether it belongs to an employee, a contractor, a service account or an AI agent. The company describes it as a control plane spanning human, machine and AI identities, built to replace the fragmented governance tools most enterprises still run.

Morag is a repeat founder. He previously built and sold three companies, including Ermetic, a cloud identity firm bought by Tenable in 2023 for $265 million, where he then served as chief product officer. He stayed in that role until Tenable’s chief executive, Amit Yoran, became ill and died, after which Morag told his wife he planned to retire. He did not. Instead he teamed up with Marom, a former product lead at Tenable and Salesforce, to start Oak.

“The market has reached a breaking point.”

Morag said that in the company’s funding announcement, adding that the tools enterprises rely on were never designed to work as one system and that stacking on more of them was never going to fix that. Marom has said the company interviewed more than one hundred security leaders before writing a line of code. “We spent months speaking with more than 100 CISOs and IAM leaders,” he said, describing a shared complaint about disconnected tools and no way to govern AI agents.

The company waited to announce anything until the product was generally available and running inside paying enterprise customers, though it has not named any of them. Oak has around 50 employees today, a number it expects to grow quickly as it hires across the United States.

A Market Already Getting Crowded

Oak is not the first well funded company chasing this problem, and it will not be the last. Non human identity security, covering service accounts, API keys, bots and AI agents, has become one of the busiest corners of cybersecurity venture funding over the past year.

Oasis Security, an Israeli firm founded in 2022, raised $120 million to govern machine identities in March, taking its total funding to $190 million. Linx Security, a New York based startup founded in 2023, closed a $50 million Series B in April on the back of revenue that its chief executive says grew tenfold in a single year. GitGuardian raised $50 million in February to push further into secrets and agent security, lifting its own total past $100 million.

Then came the exit. Cisco announced its intent to secure the agentic workforce by buying Astrix Security, a five year old non human identity (NHI) startup that had raised $85 million total and was last valued around $200 million. Terms were not officially disclosed, but Israeli outlet Calcalist put the price near $400 million, close to five times what Astrix had ever raised.

Every one of those companies existed, and in most cases had paying customers and disclosed revenue growth, before Oak had said a public word about itself.

CyberArk and Astrix Already Sold

The clearest sign that identity has become the fight worth winning sits above the startups, in what the largest platform vendors just paid. Palo Alto Networks agreed in July 2025 to buy CyberArk, the longtime leader in privileged access management, in an equity value of approximately $25 billion, a 26 percent premium to CyberArk’s trading price at the time.

The deal closed on February 11, 2026. By then Palo Alto’s own stock had slipped, so the transaction booked at a completed purchase consideration of $21.1 billion in its quarterly filing with the Securities and Exchange Commission (SEC), made up of roughly $2.3 billion in cash and $18.5 billion in stock. Palo Alto chairman and chief executive Nikesh Arora framed the logic simply, saying “the emerging wave of AI agents will require us to secure every identity, human, machine, and agent.”

Cisco’s Astrix purchase is smaller in dollar terms but tells the same story from the acquirer side. Cisco is folding Astrix into Duo, Secure Access and Splunk, the same products it already sells to a customer base far larger than any identity startup could reach alone. Menlo Ventures, an early Astrix investor, an early bet on non-human identity security, wrote that machines “now outnumber human users in the enterprise by an order of magnitude,” and that no established vendor had built the equivalent of Okta for machines before Astrix did.

Why Machines Now Outnumber Employees 80 to 1

Enterprise security spent two decades building tools around one assumption: a person logs in, a person gets access, a person gets reviewed once a year. That assumption has quietly stopped matching reality inside most companies.

• 80 to 1: the rough ratio of machine and AI agent identities to human employees inside a typical enterprise, according to Linx Security, a figure echoed in separate reporting on the CyberArk deal.
• 70%: the share of chief information security officers (CISOs) that Gartner expects will adopt identity visibility tools to shrink the attack surface by 2028.
• 25%: the share of security breaches Gartner expects to run through agent based attack surfaces by 2028, as AI agents get handed real access to real systems.
• 90%: the share of enterprises that have already suffered some form of identity related breach, according to one widely cited industry tally on the CyberArk acquisition.

Each new AI agent needs its own credential, its own permissions and, eventually, its own offboarding. Most companies cannot yet say how many of those credentials they have handed out, let alone which ones still need to exist. That gap, more than any single feature Oak or its rivals have built, is what investors are actually pricing.

Europe Runs Its Own Version of This Race

Oak’s raise is a Tel Aviv and San Francisco story, but the same pressure is building inside European security budgets. Enterprises across the region are buying identity and access management (IAM) tools for the same reason American ones are: AI agents are showing up faster than anyone can formally review them.

Identity security startup Saporo recently closed a €7 million round to block identity attacks, while digital security firm Evertrust raised a €10 million push into European digital security. Neither round comes close to Oak’s $60 million, but both point at the same underlying demand: European security teams need to know who, and what, can act inside their systems, and most cannot answer that today.

What Oak Still Needs to Prove

Morag has said Oak intends to keep raising large amounts of capital, arguing that building a category defining platform takes sustained investment rather than one big check. That is a reasonable strategy. It also means Oak’s $60 million buys a head start, not a finish line, in a field where Oasis has three years of runway and revenue Oak does not yet have in public.

What We Know

• Oak’s $60 million round actually closed quietly late last year and only became public this week.
• The product is generally available and already running inside paying enterprise customers.
• Both founders have sold cybersecurity companies before, including a $265 million exit at Ermetic.

What’s Unconfirmed

• Oak has not named a single customer running its software.
• The company has not disclosed a valuation for the new round.
• Cisco has never confirmed the roughly $400 million price tag reported for Astrix.

Oak is scheduled to demonstrate the platform publicly for the first time at the Black Hat USA security conference in August, the same industry stage where several of its better funded rivals will be making the identical pitch.

Frequently Asked Questions

How Fast Can Oak Connect to a Company’s Existing Systems?

Oak says its AI connector framework can build a new integration into a company’s on premise, cloud, SaaS or homegrown systems in hours rather than the months legacy identity governance tools typically require, since it builds its picture of each identity from live behavior instead of static records.

When Will Oak Show Its Product in Public?

Oak plans to publicly demonstrate its platform for the first time at the Black Hat USA conference in August 2026. Until now, the company has only shown the product privately to the paying enterprise customers already running it.

Has Oak Disclosed What the Company Is Worth?

No. Oak has not released a post money valuation for its $60 million seed round. For scale, rival Astrix was last valued at roughly $200 million before Cisco’s reported $400 million offer, and CyberArk sold to Palo Alto Networks for a completed purchase price of $21.1 billion.