AI Agents Need Their Own Identity, Not Your Login

TL;DR

An Israeli startup called Oak came out of stealth on July 15 with $60 million in seed funding to build what it calls a single control plane for every identity in a company: employees, service accounts, and AI agents alike (TechCrunch). You don't need to buy what Oak sells. Almost no business our size does. But the problem Oak named is real, it's mostly invisible until something goes wrong, and most small businesses have never actually looked at it.

What did Oak actually launch?

Oak builds a live map of every identity in an organization, what each one is allowed to access, and what it actually uses, then flags and can remediate unused permissions instead of waiting for an annual access review. Where older identity tools kept human accounts, service accounts, and now AI agents in separate systems, Oak treats all three as one governance problem.

The round was co-led by Accel, CRV, and Greylock Partners, with Hetz Ventures and AlphaDrive Ventures also participating (TechCrunch). Co-founder Shai Morag previously sold Ermetic to Tenable for $265 million in 2023, and the company already has enterprise customers running the platform.

One timing note worth being precise about. July 15 was the public unveiling, not the founding date. Oak has reportedly been building since late 2025 and was already deployed with early customers before this announcement. The news is the funding and the coming-out, not a brand-new company.

Why is this a different problem than "should the agent take this action"?

Identity governs who or what an AI agent is allowed to act as. Approval gates govern what action an already-identified agent needs sign-off to take. Those are two different failures, and it's easy to fix one while leaving the other wide open.

We covered the approval-gate side of this on July 18, when Automox shipped an MCP Server update built around requiring sign-off before an agent executes something (see our piece on AI agent approval gates). That's about catching a bad action before it happens.

This is a different failure mode entirely. A well-behaved agent that never takes a single wrong action can still be logged into an account that has far more access than the job requires, using a credential nobody has rotated in a year. A tightly gated agent and a well-identified agent are not the same thing, and a business can have one without the other.

How exposed is a typical small business already?

Palo Alto Networks' 2026 Identity Security Landscape report found organizations now manage an average of 109 machine identities for every human identity, up sharply from roughly 82-to-1 the year before, and expects AI agent identities specifically to grow another 85% over the next twelve months (Help Net Security). More than half the organizations surveyed said they can't consistently enforce least-privilege access for service accounts across their cloud, SaaS, and on-premises systems.

Most small businesses don't run 109 machine identities. They run a handful of AI tools and automations, often sharing one login, one API key pasted into two or three places, or a team member's personal account doing double duty as "the AI access" account.

The scale is smaller. The exposure per credential is often worse, because there's nothing standing between that one login and everything it touches. And when something does go wrong, the numbers are not gentle: Verizon's 2025 Data Breach Investigations Report found 88% of confirmed small and medium-business breaches involved ransomware, against 39% at larger organizations (Verizon). Larger companies have more identities to defend, but they also have more people watching them.

What can a small business actually do about this?

Not buy an enterprise IAM platform. Oak's customer is a company with a security team and thousands of employees; that isn't most of the businesses reading this. What actually works at our scale is a handful of habits that cost an afternoon, not a budget line.

Give every tool its own credential. If your invoicing bot, your scheduling assistant, and your CRM's AI feature all log in under the same email and password, one leaked password takes down all three instead of one.

Check what a leaked key would actually reach, not what it's supposed to reach. Log into the account you gave an AI tool and look at what else sits behind that login. Most owners are surprised by the answer.

Scope permissions down before you scope them up. Most software defaults to broad access because it's easier for the vendor to ship that way. Turn off what a given tool doesn't need on day one, rather than assuming you'll tighten it later. Later rarely comes.

Keep a plain list of what has access to what. A spreadsheet with the tool name, the credential, what it can reach, and who owns it beats no record at all. That's the "identity inventory" that enterprise platforms automate; at our size, a spreadsheet somebody actually updates is a real system.

Rotate credentials and revoke access on a schedule, especially when someone leaves. A departed employee's old login and an abandoned free-trial account are two of the most common ways a stale credential quietly outlives its usefulness.

I've sat with SMB owners who could tell me exactly what their AI scheduling tool does and could not tell me what it could reach if that vendor got breached tomorrow. That gap, knowing the job but not the reach, is the small-business version of the exact problem Oak is trying to solve at enterprise scale. Ours just fits on one page instead of a dashboard.

So what does this mean for your business?

Fixing this doesn't save you time or make you money the way a good scheduling automation does. It protects the time and money you've already put into every AI tool you've adopted. A single compromised credential that reaches your customer list, your billing system, or your inbox can cost far more in cleanup, notifications, and lost client trust than the automation attached to it ever saved you.

There's a growth angle too, and it's the one people miss. Businesses that get comfortable adding AI tools quickly, without one security scare freezing the whole program, are the ones that actually compound the time saved and money made across every tool they add. A business that gets burned once often stops adopting anything new for a year. Proportionate identity hygiene, not enterprise software, is what keeps that door open.

Related reading: our piece on what OpenAI's own AI agent breach reveals covers the vendor-side questions; this piece covers what's in your control regardless of which vendor you use. If you want a second set of eyes on what your AI tools can actually reach, that's exactly the kind of gap we look for in a free AI Opportunity Call before anything more formal.

Further reading on building this into your stack from day one: How to Build an AI-Ready Tech Stack and The AI Operations Blueprint.