NHI market consolidation tracker

Why we maintain this page

Vendor landscape content decays faster than any other category of security writing, and it decays silently. A comparison article written in April 2026 was materially wrong by July without a single word of it changing. We maintain this tracker because the alternative, publishing point-in-time vendor analysis and letting it rot, is worse than publishing nothing.

Every entry carries a date, a status, and a source type. Where a transaction is announced but not closed, we say so, because that distinction changes what a buyer in an active procurement should do. Corrections are logged publicly in our corrections log.

Transaction log

Compiled from acquirer announcements, target announcements, and contemporaneous trade reporting. Values described as "reported" have not been formally disclosed by the principals. Verified 5 August 2026.

Who bought, and what that tells you

The identity of the acquirers is more informative than the prices. Four different kinds of company bought NHI capability inside one quarter:

• Cisco (network and security platform) is positioning identity as the control plane for agentic AI, integrating Astrix into Identity Intelligence, Duo, and Secure Access, with WideField feeding identity telemetry into Splunk. The thesis: agent security is a network-and-SOC problem that happens to be expressed in identity terms.
• SailPoint (identity governance incumbent) bought depth in secrets and credentials to complement existing governance breadth. The thesis: NHI is an extension of IGA, and the accountability model already exists.
• Cyera (data security) is unifying data classification with identity permissions. The thesis: you cannot govern what an agent may do with data unless you understand the data, so identity and data security are one control point.
• 1Password (credential management) moved into just-in-time access governance. The thesis: credential custody extends naturally into access decisions.

Four incompatible theses, all funded. That is what an unresolved category looks like, and it means the architectural question is genuinely open rather than settled.

What this means if you are buying

1. Re-baseline any shortlist built before May 2026. It contains independent companies that no longer exist as such. This is not a refresh; it is a different decision.
2. Ask about contract continuity explicitly. For completed acquisitions, ask whether the product remains separately purchasable, on what terms, and for how long. SailPoint has stated Entro remains available standalone while integration continues; that is the kind of commitment to get in writing.
3. Treat the Oasis position as genuinely uncertain. A signed letter of intent is not a closed transaction, and terms have not been formally disclosed. Buyers in active evaluation should ask Oasis directly rather than assuming either outcome.
4. Weigh platform lock-in as a first-class criterion. Acquiring NHI capability under an existing platform relationship is a real commercial advantage if you are already standardised there, and a real strategic cost if you are not. This is now the dominant variable in the decision.
5. Be sceptical of the growth statistics being used to justify these prices. Acquirer-published figures on NHI proliferation are marketing artefacts published without methodology. Independent analysts have publicly cautioned against building business cases on them. The underlying trend, machine and agent identities outpacing human ones, is well documented; the specific multipliers are not.

What we are watching next

• Whether the Cyera to Oasis letter of intent converts, and on what final terms.
• Whether a credible independent NHI platform re-emerges. Categories that consolidate this fast usually leave a gap that a new entrant fills within 18 to 24 months. Analysis, moderate confidence.
• Whether the major IdP vendors build rather than buy for agent identity, which would signal the capability is becoming table stakes rather than differentiating.
• Whether "NHI" survives as a category name. As the capability moves inside platforms, the naming is already drifting toward "agentic identity" and "machine and agent identity." Terminology drift is a leading indicator of category absorption.
• Post-acquisition roadmap follow-through, which is where platform acquisitions of point tools most often disappoint.

Frequently asked questions

Which NHI security vendors have been acquired?

Between May and July 2026, all three leading independent non-human identity platforms were acquired or placed under signed agreement. Cisco announced its intent to acquire Astrix Security on 4 May 2026 at a reported ~$400M and has reported completion. SailPoint completed its acquisition of Entro Security on 29 June 2026 at a reported ~$200M. Cyera signed a letter of intent to acquire Oasis Security on 28 July 2026 at a reported ~$1B, which has not closed. Related transactions include Cisco's acquisition of WideField Security and 1Password's acquisition of Apono.

Is non-human identity still a standalone product category?

It is closing as a standalone purchase and reopening as a capability inside larger platforms. Four different types of acquirer bought NHI capability in one quarter: a network and security platform, an identity governance incumbent, a data security vendor, and a credential management vendor. For buyers, the durable decision has shifted from which point tool to which platform you want to govern identity from.

Should I still evaluate Oasis Security while the Cyera deal is pending?

That is a judgement call, but the relevant fact is that a signed letter of intent is not a closed transaction and terms have not been formally disclosed. Buyers in active evaluation should ask Oasis directly about contract continuity and roadmap rather than assuming either outcome, and should treat the answer as a data point about how the vendor handles uncertainty.

How reliable are the reported deal values?

Values described as reported have not been formally disclosed by the principals and come from trade press. The Astrix figure of approximately $400M was reported by Calcalist; Cisco did not disclose terms. Treat all reported figures as approximate and directional.

How often is this page updated?

This page is on a fortnightly re-verification cycle, and is updated immediately on any material transaction. Every entry carries a date and a status. Changes are logged in our public corrections log.