Head-to-head · updated 13 September 2026
DataShield vs Oasis Security: who counts your agent identities, and who stops one mid-job?
Oasis Security built the best answer we've seen to a boring, awful question: how many non-human identities do you actually have, and who owns each one? Their Ownership Discovery Engine works out the human behind an orphaned service account from its behaviour. That is real work, and we don't do it. In September 2026 Cyera closed a $1B acquisition and Oasis became Cyera Identity.
DataShield starts one step later. We're an identity control plane for agents, not a scanner. Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Every governed tool call is checked against the agent's current authority before it runs, and each decision is sealed into a hash chain you can verify without trusting us. Below is where we differ, sources included, and the rows Oasis wins.
The short version
Pick DataShield when
- You need the answer at the moment a tool call happens. Every governed call passes a scope ceiling, a declared authority tier, and a revocation re-check before dispatch. How Auth does it.
- An examiner, or the EU AI Act's Article 12, will ask you to prove the access record wasn't edited. Our chain answers with math. Run the verifier.
- An agent needs emergency access at 2am and you want it scoped, time-boxed, auto-revoked, and impossible to quietly delete from the log.
- The control plane has to run inside your own account, on your keys, self-hosted or a dedicated single-tenant server.
Pick Oasis Security when
- You don't know what you have. Inventory across IdPs, vaults, cloud and SaaS is their home turf, and it's the right first move if your estate is a mystery.
- You need ownership attribution. Their engine infers the human owner of an NHI from its behaviour and checks context over email and Slack. We have nothing like it.
- Secret rotation and decommissioning orphaned service accounts at estate scale is the project. They report 35% less rotation effort at one Fortune 500 customer.
- You're already a Cyera shop. Cyera Identity now sits next to the data map, and one vendor with one contract is a legitimate reason to buy.
Bottom line: Oasis tells you which non-human identities exist and who owns them. We decide whether a given agent call is allowed, and keep proof of the decision. Most buyers with a real agent estate end up wanting both. If you already know your inventory and the open question is enforcement and evidence, start here.
Feature by feature: NHI management versus agent authorization
Competitor cells describe what Oasis Security's public site, press releases and partner announcements say as of the date above. If we've mischaracterised something, email support@myorg.ai and we'll correct it, credited.
| What matters | DataShield | Oasis Security | Edge |
|---|---|---|---|
| NHI discovery and inventory | None. We govern the agents and connections you register with us. We don't go hunting for the ones you forgot. | Six-pillar platform: Inventory, Ownership, Context, Posture, Remediation, Lifecycle. Agentless, across IdPs, vaults, cloud and SaaS. | ◇ |
| Ownership attribution | Not offered. Agents are registered to an org, app and instance by a human who is already known to us. | NHI Ownership Discovery Engine infers the owner from behaviour and digital footprint, with Slack and email context. Distinctive and hard to copy. | ◇ |
| Agent authorization | Scope ceiling on the MCP tool token, declared authority tier, and a revocation re-check on every governed dispatch. Revocation lands mid-session. | "Access control that understands intent, not just static roles and permissions," with time-bound access. Inline enforcement in the Zscaler partnership runs on Zscaler's Zero Trust Exchange, not on Oasis. | ◆ |
| Audit evidence | SHA-256 row chain with Ed25519-signed checkpoints that are themselves chained. Verification names the failure: tampering, insertion, deletion, or truncation. Public verifier. | Audit oversight and compliance reporting are named as gaps they close. We found no published cryptographic tamper evidence. | ◆ |
| Break-glass | Scoped, time-boxed emergency access for agents that auto-revokes and stays in the chain. | Not described in their public material. | ◆ |
| GDPR erasure | Crypto-shred of per-subject key material plus ISO 27560 consent receipts. Actor identities are HMAC-committed, so the chain still verifies after erasure. | Not described. NHI platforms mostly handle credentials, not data subjects. | ◆ |
| Data handling and tokenization | Datasets are tokenized at ingest; agents query tokenized data over MCP; detokenization is a privileged, audited operation. Deterministic, join-preserving tokens plus quasi-identifier generalization (dates to year, decade or age band; ZIPs to 3 or 4 digits; partial phones, SSNs and emails) with a measured cardinality-reduction score per column. | Not a data-layer product. Credentials and permissions, not records. Cyera's DSPM side covers the data map. | ◆ |
| Secret rotation and lifecycle | Connection Vault holds encrypted per-subject credentials for connections we broker, across eight strategies including Snowflake keypair-JWT. Not an estate-wide rotation program. | Safe secret rotation and full lifecycle from creation to decommission, integrated with HashiCorp, Azure Key Vault, AWS KMS and GCP. | ◇ |
| MCP and agents | Native MCP endpoints on Auth, Ontology and Lighthouse. MCP tool tokens with scope ceilings; per-call metering attributed to the agent. | Agentic Access Management framing and AI-platform integrations including OpenAI. We found no MCP tool-token issuance or per-call metering described. | ◆ |
| Deployment | Self-hosted in your own cloud or data center, or on a dedicated single-tenant server we operate. Your keys. | SaaS, agentless by design. That's what makes the integration breadth work. | ◆ |
| Maturity and independence | Auth, Guardian and Lighthouse are live in production (Guardian and Lighthouse since April 2026). SOC 2 not yet certified, and we say so. Small team, independent. | Founded 2022, $195M raised, $120M Series B in 2026, GuidePoint channel, Fortune 500 references. Acquired by Cyera for $1B on 3 September 2026 and renamed Cyera Identity. | ◇ |
| Pricing | Published model, scoped instant quote, no sales wall. | Quote-only. Packaging under Cyera is not yet public. | ◆ |
◆ DataShield leads◇ Oasis Security leads◈ comparable
Oasis Security claims are drawn from oasis.security, its newsroom, and the Cyera acquisition release, last checked 13 September 2026. We link them below rather than paraphrase from memory.
Three things you get here that you won't get from an NHI posture platform
A decision, not a finding
Posture tells you an identity is over-permissioned. Useful. It doesn't tell you whether the call that just went out was allowed. Ours does, because the check runs before dispatch and fails closed. See the control plane.
Proof that survives an audit
A log that can be silently edited has no evidentiary value. Ours is a hash chain with signed checkpoints, and the verifier tells you what went wrong, not just that something did. That's the property EU AI Act Article 12 and HIPAA §164.312(b) reviewers care about. Try it in your browser, no signup.
An erasure you can defend
GDPR says delete. Your auditor says keep the log. Crypto-shred settles it: the subject's key material is destroyed, the data becomes unreadable, and the chain still verifies. See the diagram.
Where Oasis Security is genuinely stronger
Discovery is harder than it looks, and Oasis is good at it. Most enterprises have thousands of service accounts, API keys and tokens with no owner, no expiry and no record of why they exist. Oasis finds them, works out who is responsible, scores the risk, and drives the cleanup. They cite NHIs outnumbering human identities by roughly 20 to 1, and 46% of organisations hitting an NHI-related breach in a year. Their numbers, but the shape matches what we hear on calls. Their integration list is long, the channel program with GuidePoint gives them reach, and $195M of funding bought four years of focused engineering. We can't match any of that, and we're not going to pretend otherwise.
The push-back is about where enforcement lives. When Oasis announced its Zscaler integration in June 2026, the split was stated plainly: Oasis governs the identity lifecycle, Zscaler's Zero Trust Exchange enforces policy inline on the connection. That's a sensible architecture, and it's also an admission. An inventory with an intent score is not the thing that says no to a tool call at 3.47pm, and a compliance report is not the thing that convinces an examiner the record is intact. Those are separate mechanisms, and they're the ones we build.
Questions worth asking both of us
These are the questions we'd want answered if we were buying. Ask them on every vendor call, including ours.
Can you cryptographically prove an audit log entry wasn't deleted?
DataShield: yes. Each record commits to the one before it, checkpoints are signed and chained, and verification distinguishes deletion from truncation from tampering. Run it against a sample chain at /verify. Oasis Security: their material names audit oversight as a problem they solve, but we found no published tamper-evidence mechanism. Ask them whether a third party can verify the record without trusting the platform.
What happens to a revoked agent mid-session?
DataShield re-checks authority on every governed tool call, so revocation lands on the next call. An analyst leaves at 11am; their agent is 20 minutes into a 40-minute job; the next call fails closed. For Oasis, ask a precise version of the question: does the platform itself block the call, or does it hand enforcement to Zscaler, the IdP, or the target system? The Zscaler release suggests the latter, and the answer changes your blast radius.
Is DataShield an alternative to Oasis Security for NHI discovery?
No, and anyone who tells you otherwise is selling. We don't scan your estate, we don't infer ownership of orphaned service accounts, and we don't run a fleet-wide secret rotation program. If "Oasis Security alternative" means "something else that finds my non-human identities," look at Astrix, Entro or Natoma. If it means "something that decides and proves what my agents are allowed to do," that's us, and the two jobs sit side by side.
What does the Cyera acquisition change for a buyer?
Factually: Cyera completed the $1B acquisition on 3 September 2026 and Oasis is now Cyera Identity, an identity pillar inside a DSPM platform. That's a real upgrade in capital and distribution, and if you already run Cyera it's a simplification. It's also worth asking about roadmap and packaging, because a pillar competes for attention differently than a company does. The wider pattern is worth naming: Astrix went to Cisco, Oasis went to Cyera, and standalone options in this category are thinner than they were a year ago. We're independent and self-hostable, which is a preference, not a virtue. See our /compare/cyera page for the platform side of this.
How does GDPR erasure interact with the audit trail?
DataShield crypto-shreds per-subject key material and issues an ISO 27560 consent receipt; actor identities in the chain are HMAC-committed, so the evidence stays verifiable after the subject is gone. Oasis governs credentials rather than data subjects, so this mostly isn't their problem, which is fine. Just don't assume an NHI platform covers your Article 17 obligation.
Does DataShield have SOC 2?
Not yet, and we won't imply otherwise. Auth is live a public threat model and a verifier anyone can run. Guardian and Lighthouse have been in production since April 2026. Design-partner terms include source escrow so a small vendor isn't a single point of failure. Details on the security page.
- Oasis positioning, verbatim: "Access control that understands intent, not just static roles and permissions." Six pillars: Inventory, Ownership, Context, Posture, Remediation, Lifecycle. — oasis.security, 13 Sep 2026
- Cyera completed its acquisition of Oasis Security for $1B; Oasis becomes Cyera Identity, a dedicated identity pillar. — Cyera press release, 3 Sep 2026
- Oasis governs the NHI lifecycle while Zscaler's Zero Trust Exchange enforces policy inline across connections. — PR Newswire, 10 Jun 2026
- NHI Ownership Discovery Engine infers NHI owners from behaviour; cites NHIs outnumbering humans ~20x and 46%+ of organisations hit by an NHI breach in 12 months. — Digital IT News, 31 Oct 2024
- GuidePoint Security channel program, framed as making non-human identity management mainstream. — PR Newswire, 30 Apr 2025
- ≥80% of unauthorized agent transactions through 2028 will be internal policy violations rather than attacks. — Gartner, 2026
Other head-to-heads
DataShield vs Cyera
The platform that bought Oasis. Who finds the data, who governs the agent.
NHIDataShield vs Astrix
The other NHI startup that got acquired. Discovery versus the enforcement seam.
NHIDataShield vs Entro
Secrets and machine identity posture, next to per-call authority.
AllEvery comparison
One honest scorecard per vendor.
Keep your NHI inventory. Then see the part it doesn't cover: break a live audit chain in your browser, revoke an agent mid-session, and watch the next tool call fail. Demo Center access is free with a work email.
Get free Demo Center accessYou've seen the proof
Ready for a number? Scope your deployment and we'll price it against your own economics.
Get your quote →