Oak
by Oak
An identity operating system built for a world where AI agents outnumber people 100 to 1
Oak is an AI-native identity governance platform that replaces the usual stack of legacy IGA tools with a single control plane covering human, machine and AI agent identities. It builds a live identity graph from observed evidence rather than static directory records, and revokes unused access continuously instead of at quarterly review time.
Oak is an identity governance platform built from scratch for an enterprise where machine and AI agent identities outnumber human ones by more than 100 to 1 — the ratio its investors cite as the reason legacy identity governance architecture has become obsolete. Founded in late 2025 with offices in Tel Aviv and San Francisco, it came out of stealth on 15 July 2026 with $60 million in seed funding co-led by Accel, Greylock Partners and CRV, with Hetz Ventures, AlphaDrive Ventures and angel investors participating. The size of that seed is explained largely by the founders' record: chief executive Shai Morag previously sold Integrity-Project to Mellanox and Ermetic to Tenable for $265 million, where he then served as chief product officer, while chief product officer Tal Marom led product at Salesforce and at Ermetic, where the two met. The product is deliberately a single control plane rather than another point tool. An AI connector framework reaches on-premises, cloud, SaaS and homegrown applications and, the company claims, stands up new connectors in hours where legacy platforms take months. From those connections it assembles a live identity graph out of raw evidence rather than static HR and directory records, then maps each identity's granted permissions against what it actually uses. That comparison is the core claim: rather than waiting for a quarterly certification cycle, Oak surfaces and strips unnecessary entitlements continuously, flags orphaned accounts and undiscovered service accounts, and treats AI agent behaviour as a governed identity class in its own right. It was generally available and deployed at undisclosed enterprise customers at launch, with a team of roughly 50.
The identity and access management lead at a large enterprise whose agent and service-account population has outgrown a quarterly certification process built for human employees.
Continuous, evidence-based revocation of unused access across humans, machines and AI agents, instead of a point-in-time attestation that is stale the day it is signed.
At a Glance
- Category
- Governance & Security
- Pricing
- Contact for pricing, Subscription
- Target Market
- CISOs, CIOs, IAM Architects, Security Engineers, Compliance Leaders
- Deployment
- Cloud-first, Hybrid, API-based
- Founded
- 2025
- Headquarters
- Tel Aviv, Israel and San Francisco, United States
- Team Size
- 11-50
Key Features
- ✓Unified identity graph
Consolidates human, machine and AI agent identities into one live graph built from observed evidence rather than static directory and HR records.
- ✓Usage-versus-entitlement mapping
Compares each identity's granted permissions against what it actually exercises, so unused access is visible as a risk rather than an assumption.
- ✓Connect Any connector framework
An AI-driven connector builder that reaches on-prem, cloud, SaaS and homegrown applications and stands up new integrations in hours rather than months.
- ✓Agentic Identity governance
Treats AI agents as a first-class identity class with their own behaviour governance, rather than mapping them onto service-account abstractions designed for scripts.
- ✓Continuous real-time remediation
Removes unnecessary permissions as risk emerges instead of at scheduled certification, shifting the model from operations-driven to risk-driven.
- ✓Orphan and anomaly detection
Surfaces leftover access from terminated users, undiscovered service accounts and permission anomalies that periodic reviews routinely miss.
Capabilities
Use Cases
- •Offboarding residue cleanup
Find and revoke the access a departed employee still holds in systems that were never wired into the joiner-mover-leaver process.
- •AI agent access governance
Inventory which autonomous agents and copilots hold which entitlements, and constrain them before an agent acts outside its intended scope.
- •Service account discovery
Identify machine identities nobody owns or documents, which are a standard lateral-movement path in breach post-mortems.
- •Replacing quarterly access certification
Swap rubber-stamped periodic attestations for continuous evidence-based review, cutting both reviewer fatigue and standing privilege.
- •Identity tool consolidation
Collapse several overlapping identity governance and access review products into one control plane, which the founders compare to how CNAPP consolidated cloud security.
Ideal For
Best For
- ✓Governing AI agent identities alongside humans and service accounts in one system rather than bolting agent controls onto a human-centric IGA tool
- ✓Discovering orphaned accounts and undocumented service accounts that never appear in HR-driven identity records
- ✓Replacing periodic access certifications with continuous, usage-based entitlement review in environments with tens of thousands of identities
- ✓Consolidating a fragmented stack of identity governance, access review and privilege tools into a single control plane
- ✓Covering homegrown and on-premises applications that packaged IGA connectors never reached
Not Ideal For
- ✗Risk-averse buyers who need a proven vendor — the company was founded in late 2025 and only became generally available in July 2026, with roughly 50 staff and no named public customers
- ✗Small and mid-market organisations, since there is no published pricing, no self-serve path and the onboarding offer is explicitly aimed at qualified Fortune 500 accounts
- ✗Teams satisfied with their existing SailPoint or Saviynt deployment; reporting on the launch notes vendor lock-in runs deep in this category and rip-and-replace is a large programme
- ✗Buyers needing published SOC 2 or ISO 27001 attestations today — the site advertises GDPR and CCPA alignment but no security certification
Deployment
Market Analysis
Pros
- ✓Attacks a genuinely unsolved problem — investors and reporting agree periodic certification cannot govern a machine-to-human identity ratio above 100 to 1
- ✓Usage-versus-entitlement mapping is a substantive architectural difference from records-based IGA, not a repackaging
- ✓Hours-not-months connector build time targets the specific failure mode that stalls legacy identity governance rollouts
- ✓Exceptionally strong founding team with three prior exits and tier-one backing from Accel, Greylock and CRV
- ✓Generally available with production enterprise deployments at launch rather than a waitlist
Cons
- ✗Very early: founded late 2025, out of stealth July 2026, roughly 50 people, and no public customer names or case studies
- ✗No independent product reviews exist on G2, Capterra, TrustRadius or PeerSpot, and no Hacker News or Reddit discussion, so every claim here traces back to the company or its investors
- ✗Even the investor thesis is thin on technical differentiation, focusing on founder pedigree and funding rather than comparative performance data
- ✗Reporting on the launch notes it faces many competitors using AI as a catalyst in a category where vendor lock-in runs deep, so displacement will be slow
- ✗No published pricing, no trial and no SOC 2 or ISO 27001 attestation, which is a hard stop for some security procurement processes
- ✗Specific connectors are not named publicly, so coverage of a given application estate cannot be verified without a sales conversation
Pricing
Enterprise
Contact for pricing
- ✓Demo request is the only entry path
- ✓Unified identity control plane across human, machine and AI agent identities
- ✓Connect Any connector framework
- ✓White Glove onboarding with up to 500 complimentary implementation hours for qualified Fortune 500 organisations
Nothing is published. There is no price list, no per-identity or per-seat rate, no free tier and no trial — the only route in is a demo request, which is normal for an enterprise identity governance product but means cost cannot be modelled at all before engaging sales. The one concrete commercial signal on the site is a White Glove onboarding offer of up to 500 complimentary implementation hours for qualifying Fortune 500 organisations, which both indicates where the company is aiming and implies a deployment large enough to need hundreds of hours of professional services. Budget for that implementation effort alongside the licence, and note that displacing an incumbent identity governance platform is a migration programme rather than a tool swap.
Security & Compliance
Connect
Sources
This page was written from 4 sources, 3 on domains other than oak.id.
Stay Ahead of the Curve
Weekly enterprise AI insights for technology leaders. No spam, no vendor pitches—unsubscribe anytime.
SubscribeRelated Products
Baselayer
Business identity, risk and fraud infrastructure that now verifies AI agents before they transact
SAS AI Navigator
SaaS AI governance inventory for models, agents and use cases, sold through Microsoft Marketplace
Rein Security
Runtime security for enterprise AI agents, deployed as a sidecar inside your own cloud
Armadin
Autonomous offensive security: AI agent swarms that chain your weak spots into proven attack paths before an attacker does