4 confirmed deals and 3 significant funding rounds moved through the agentic services stack during March 8–22, representing an estimated $13.4B+ in disclosed deal value across the five ACI categories. The defining transaction of the cycle closed on March 16: Accenture completed its acquisition of Faculty, a 400-person UK-based AI-native professional services firm, extending its AI delivery bench into applied science and decision intelligence — terms undisclosed but the deal signals strategic, not bolt-on, intent. Simultaneously, OpenAI's proposed $10B enterprise AI joint venture with TPG, Bain Capital, Advent International, and Brookfield — reported March 16 — and Anthropic's parallel talks with Blackstone and Hellman & Friedman position AI foundation model companies as the new anchor of an emerging AI-Native Consulting category.
3 of the 4 Tier 1 deals carry an NHI flag. Oasis Security's $120M Series B (led by Craft Ventures with Sequoia and Accel) on March 19 is the largest pure-play NHI round in the tracking period, bringing total NHI infrastructure capital in this cycle to $170M across Oasis and GitGuardian's $50M Series C (February 11, Insight Partners). The Palo Alto Networks–CyberArk close on February 11 — a $25B strategic acquisition — confirms that legacy IAM PAM assets now command identity-era premiums; Thoma Bravo's concurrent exploration of a $7B Imprivata exit underscores that the prior generation of healthcare identity platforms is cycling into new hands. AI classification for this inaugural issue: 55% ai_native, 27% ai_augmented, 18% ai_adjacent.
The Signal
Foundation Models Are Collapsing the Distance Between AI Labs and PE Portfolios
8 months ago, private equity firms wrote checks to AI companies. Today, they are being offered equity stakes in AI consulting arms. The structural inversion arrived publicly this cycle: OpenAI is in advanced discussions with TPG, Bain Capital, Advent International, and Brookfield Asset Management to form a joint enterprise AI venture valued at approximately $10 billion, with the PE firms committing roughly $4 billion in exchange for preferred equity and board seats. Concurrently, Anthropic is in parallel talks with Blackstone, Hellman & Friedman, and Permira on a comparable structure. The architecture of these proposed deals — preferred equity, minority stake, enterprise software distribution across PE portfolios — is neither a traditional investment nor a services contract. It is a distribution play masquerading as a capital transaction.
$4 billion in PE capital committed to an AI lab's enterprise arm is, functionally, the largest AI-Native Consulting deal in history if it closes. The strategic logic is explicit: OpenAI's Frontier Alliances, announced February 23, already pairs its engineers with BCG, McKinsey, Accenture, and Capgemini to implement its Frontier agent platform across enterprise workflows. The proposed PE venture accelerates that distribution by plugging directly into portfolio company IT spend — a channel PE firms uniquely control. For Accenture, which completed its acquisition of Faculty on March 16, the Frontier Alliance creates a competitive tension: Faculty's AI-native delivery model is now embedded inside a firm that is simultaneously co-distributing a competing AI platform with its own client base.
3 of the 7 tracked transactions this cycle carry NHI flags — the highest concentration in any period ACI has modeled. Oasis Security's $120M Series B on March 19 (Craft Ventures, Sequoia, Accel) explicitly calls its product "Agentic Access Management," reflecting a market that has moved from NHI-as-a-threat-surface to NHI-as-an-infrastructure-category in under 18 months. Machine identities now outnumber human identities by an estimated 82-to-1 ratio per Palo Alto Networks data — the ratio that justified the $25B CyberArk acquisition closed February 11. The capital is tracking the identity ratio.
The Thoma Bravo signal deserves its own paragraph. The firm is simultaneously running a $7B Imprivata exit process (JPMorgan, Evercore) and exploring a potential FactSet take-private alongside Hellman & Friedman. These are not contradictory moves — they reflect a thesis rotation. Imprivata is a 2016 vintage healthcare SSO asset; FactSet is a data infrastructure play that PE views as undervalued by AI disruption fears. The common thread is Thoma Bravo's conviction that software assets with high switching costs and recurring revenue remain acquirable at rational multiples even as AI reshapes their categories. That conviction — more than any single deal — is the leading indicator for where the next 6 months of Tier 1 activity concentrates.
Tier 1 — Primary Coverage
2 structural transactions define this category in Cycle 1. The Accenture–Faculty close on March 16 is a capability acquisition, not a headcount deal: 400+ AI-native professionals — PhDs, data scientists, AI engineers — absorbed into an 800,000-person firm that has committed $3 billion to AI. Faculty's IP, including its Frontier decision intelligence product and applied AI methodology, enters Accenture's delivery pipeline at a moment when the firm has simultaneously become a Frontier Alliance partner to OpenAI. The implication: Accenture is now both deploying its own AI-native talent (Faculty) and distributing a foundation model's enterprise platform (OpenAI Frontier) — a dual positioning that no traditional competitor can replicate at equivalent scale.
The OpenAI–PE joint venture reports are the second and structurally more significant event. At a reported $10B pre-money valuation with $4B in PE commitments from TPG (anchor), Bain, Brookfield, and Advent, this proposed vehicle is organized as a majority-owned OpenAI subsidiary employing engineers to provide advisory and execution services — what Reuters describes as an "enterprise AI consulting arm." If it closes, this is an ai_native consulting platform with no prior revenue trajectory, no delivery track record at scale, and the distribution advantage of four of the world's largest PE firms channeling it into hundreds of portfolio companies. For the AI-Native Consulting category, the implication is that the competitive ceiling just moved: incumbent AI services firms are now competing against a structure that combines model access, PE channel, and Anthropic-side alternatives simultaneously.
| Target | Acquirer / Investor | Type | Size | Date | Classification |
|---|---|---|---|---|---|
| Faculty (UK-based AI company) | Accenture (NYSE: ACN) | STRATEGIC | Undisclosed | March 16, 2026 | AI-NATIVE |
| OpenAI Enterprise AI Joint Venture (proposed) | TPG (anchor), Bain Capital, Advent International, Brookfield Asset Management | jv_formation | $4.0B | March 16, 2026 (reported) | AI-NATIVE |
2 disclosed funding rounds in this cycle — Oasis Security's $120M Series B (March 19) and GitGuardian's $50M Series C (February 11, within the extended lookback) — put $170M of growth equity into pure-play NHI infrastructure. Both rounds feature top-tier crossover investors: Craft Ventures, Sequoia, and Accel in Oasis; Insight Partners (with $90B AUM) leading GitGuardian. The investor overlap is not coincidental — it reflects a market view that NHI governance is a category, not a feature, and that the category is early enough to support multiple independent platform bets.
Oasis Security's framing is the more aggressive of the two: its product is explicitly called "Agentic Access Management," a terminology shift that positions NHI governance not as a subset of PAM but as a distinct infrastructure layer built for the AI agent era. The company cites Palo Alto Networks data that machine identities now outnumber human identities 82-to-1. At that ratio, legacy PAM tooling — built for a handful of privileged human admins — cannot scale to governing the credential surface of autonomous agent fleets. Oasis's $195M total raised in under four years signals the market is pricing in that architectural gap.
GitGuardian's Series C angle is different but complementary: its NHI governance pitch starts from secrets detection (it is the #1 app on GitHub Marketplace) and expands upward into full NHI lifecycle management. The distinction matters for PE trajectory analysis — GitGuardian has distribution depth (600,000+ developers, 550+ secret types) that an NHI-native like Oasis does not yet have. These two companies are currently on parallel PE runways: Oasis is a platform bet, GitGuardian is an upsell story.
| Target | Acquirer / Investor | Type | Size | Date | Classification |
|---|---|---|---|---|---|
| Oasis Security | Craft Ventures (lead), Sequoia Capital, Accel, Cyberstarts | GROWTH | $120M | March 19, 2026 | AI-NATIVE NHI |
| GitGuardian | Insight Partners (lead), Quadrille Capital, Balderton, BPI, Eurazeo, Fly Ventures, Sapphire Ventures | GROWTH | $50M | February 11, 2026 | AI-NATIVE NHI |
$170M in confirmed growth equity flowed into pure-play NHI infrastructure in the February 11–March 19 window, across 2 rounds with combined participation from Craft Ventures, Sequoia, Accel, Insight Partners, Balderton, and Eurazeo. This is not a vertical inside identity security. It is the formation of a standalone infrastructure category.
The underlying dynamic: enterprise AI agent deployments are scaling faster than governance tooling. 81% of enterprise teams have moved past the AI agent planning phase, yet only 22% treat AI agents as independent, identity-bearing entities. 45.6% still use shared API keys for agent-to-agent authentication — a practice that is architecturally incompatible with least-privilege access at agent scale. Oasis Security and GitGuardian are both building toward the governance layer that fills this gap: just-in-time access, automated credential rotation, and lifecycle enforcement for non-human principals.
The PE signal here is forward-looking rather than current-cycle. Neither Oasis nor GitGuardian is PE-investable at current ARR scale, but both are on the 18–24 month trajectory that historically precedes growth equity buyout or strategic acquisition. CrowdStrike's acquisition of SGNL (January 8, undisclosed) and ServiceNow's acquisition of Veza ($1B+, announced December 2025) establish the exit comp table: strategic buyers are paying $800M–$1B+ for NHI-adjacent platforms with enterprise identity governance differentiation. The $120M Oasis round implies a valuation that would require a 2–3x step-up to reach that exit range — achievable if ARR growth compounds at the rate that Series B cybersecurity infrastructure companies have achieved in this market.
Tier 2 — Monitoring
The Palo Alto Networks–CyberArk close on February 11 ($25B) is the defining transaction in the Legacy IAM category — and arguably the defining transaction of the broader identity security market in Q1 2026. The deal repositions CyberArk's privileged access management capabilities inside a $75B+ platform play, with explicit rationale that AI agents require the same PAM governance architecture that enterprises built for human admins. Palo Alto Networks' CEO Nikesh Arora stated directly: "The emerging wave of AI agents will require us to secure every identity — human, machine, and agent."
The Imprivata exit process — Thoma Bravo engaging JPMorgan and Evercore for a $7B+ sale — is the second major Legacy IAM signal this cycle. Imprivata is a 2016 vintage healthcare SSO/PAM asset generating approximately $500M in annual revenue. A $7B+ valuation implies 14x EV/Revenue, a multiple that would have been aggressive 24 months ago but reflects current market pricing for identity assets with durable recurring revenue and healthcare vertical concentration. The Verosint merger (ITDR capability added pre-sale) suggests Thoma Bravo is packaging the asset for an AI-era acquirer.
Booz Allen Hamilton's acquisition of Defy Security (Sverica Capital exit, February 17) is the third Tier 2 deal this cycle. Sverica tripled Defy's size organically over a 5-year hold before the strategic exit to Booz Allen. Terms were not disclosed; the transaction closes Q2 2026. This is an ai_adjacent cybersecurity managed services deal — Defy is a cybersecurity VAR and services firm rather than an identity-native platform — but it illustrates the continued appetite of government services primes for commercial cyber delivery capacity.
| Target | Acquirer | Type | Size | Date | Classification |
|---|---|---|---|---|---|
| CyberArk (NASDAQ: CYBR) | Palo Alto Networks (NASDAQ: PANW) | STRATEGIC | $25.0B | February 11, 2026 | AI-ADJACENT NHI |
| Imprivata (exit process, not closed) | TBD — Thoma Bravo exploring sale via JPMorgan/Evercore | pe_exit_process | Undisclosed | January 30, 2026 (process initiated) | AI-ADJACENT |
Tier 3 — Pipeline Intelligence
The AI Implementation category is producing two distinct pipeline signals this cycle. The first is structural: OpenAI's Frontier Alliances (February 23) — formal multi-year partnerships with Accenture, Capgemini, BCG, and McKinsey — effectively creates a co-delivery model where top-tier consulting firms function as implementation distribution for a foundation model platform. This is not a funding event, but it reshapes the competitive landscape for independent AI implementation firms by anchoring the largest consulting brands to a specific AI platform, forcing mid-market implementers to choose between platform alignment and differentiated positioning.
The second signal is at the company level. Wonderful, an enterprise AI agent platform (Amsterdam-based, founded 2023), raised a $150M Series B on March 12 (Insight Partners, Index Ventures, IVP, Bessemer) at a $2B valuation — 4 months after its $100M Series A. Wonderful's model is operationally intensive: deploying locally embedded teams that speak the target market's language to implement AI customer service agents in non-English-speaking markets. This is ai_native implementation with a geographic arbitrage play — the valuation implies 13x+ on revenue run-rate if the company is generating meaningful ARR at this early stage. The $286M total raised and aggressive headcount tripling (350 to 900) signals investor conviction in a land-grab strategy.
For PE trajectory analysis: pure-play AI implementation firms remain largely too early-stage for traditional buyout. The strategic acquisition path (Accenture–Faculty model) is the most active current exit channel, but it requires the target to have defensible IP or delivery methodology differentiation — not just headcount.
The AI-Native Managed Services category logged two notable events in the tracking period. Surf AI, an agentic security operations platform, launched on March 17 with $57M in funding led by Accel — the company connects identity, cloud, data, HR, and IT systems to drive autonomous security operations with human oversight guardrails built in. Surf is too early for PE consideration but represents the architectural direction the MSSP category is heading: not managed humans doing security work, but managed AI agents doing security work with human review triggers.
Booz Allen Hamilton's acquisition of Defy Security (noted in Tier 2) is relevant here as well: Defy operates as both a cybersecurity VAR and a managed services provider, and its exit from Sverica Capital (5-year hold, tripled organically) is the most instructive managed services PE hold-period data point in this cycle. Sverica acquired Defy in November 2020 and achieved 3x organic growth without M&A — a result that validates the managed cybersecurity services model as a PE-viable organic compounder when the client base is enterprise and the service is outcome-oriented rather than time-and-materials.
The broader MSP market is bifurcating: AI-native MSPs (Guardz $56M Series B in 2025, 300% ARR growth) are targeting SMB via the channel; AI-augmented MSSPs (Booz Allen, Arctic Wolf, ReliaQuest) are absorbing specialists to serve enterprise. PE interest is concentrating in the latter segment — specifically MSSPs with recurring managed detection and response contracts above $10M ARR and demonstrated AI operational integration.
PE Landscape
| Firm | AUM | Portfolio | Categories | Recent Move |
|---|---|---|---|---|
| Thoma Bravo | $166B | 3 |
45
|
Completed $12.3B Dayforce take-private (February 4, 2026). Exploring $7B+ Imprivata exit. Evaluating FactSet take-private. |
| Palo Alto Networks | N/A (strategic acquirer) | 1 |
24
|
Completed $25B CyberArk acquisition February 11, 2026. Acquired Koi for $400M (agentic endpoint security, February 2026). |
| Insight Partners | $90B | 3 |
235
|
Led GitGuardian $50M Series C (February 11). Led Wonderful $150M Series B (March 12). Active across NHI and AI implementation categories. |
| Craft Ventures | ~$1.5B | 1 |
2
|
Led Oasis Security $120M Series B (March 19, 2026). |
| Accenture (strategic acquirer) | N/A | 1 |
1
|
Completed Faculty acquisition March 16, 2026. Joined OpenAI Frontier Alliance February 23. |
| TPG | $224B | 0 |
1
|
In advanced talks as anchor investor in OpenAI enterprise AI joint venture (~$10B valuation). |
| Sverica Capital | ~$2B (estimated lower-middle market) | 0 |
5
|
Exiting Defy Security to Booz Allen Hamilton (February 2026, closes Q2 2026). |
Thoma Bravo is running three identity-adjacent transactions simultaneously — and they tell a coherent story. The Imprivata exit process ($7B+, JPMorgan and Evercore engaged) is a vintage cleanup: a 2016 healthcare SSO platform with $500M in revenue and a decade of bolt-on acquisitions (including Verosint, ITDR) that has been optimized for the healthcare compliance market. The buyer universe is expected to include both corporate and PE, and the implied 14x EV/Revenue multiple is the ceiling for what the legacy IAM category can sustain.
The Dayforce close ($12.3B, February 4) is the active investment: HCM software with high switching costs, enterprise ARR, and a workforce management platform that Thoma Bravo's operational playbook — standardization, margin expansion, platform consolidation — applies cleanly. Dayforce is not an identity play; it is a recurring software revenue play in a category Thoma Bravo understands at the enterprise scale.
The FactSet exploration is the most interesting signal. FactSet's shares have declined 39% in six months on AI disruption fears. Thoma Bravo and Hellman & Friedman are reportedly studying whether those fears are overpriced — and whether the financial data infrastructure business can be acquired at a discount, AI-hardened operationally, and re-rated. This is Thoma Bravo's thesis in its purest form: buy well-understood software assets that the public market has mispriced on AI risk, apply the operational playbook, and exit to a market that has corrected. The identity of the buyer reveals the thesis. Thoma Bravo is not buying AI companies. It is buying software companies that sell to the enterprise, then making them more defensible against AI disruption from inside.
Valuation Comps
| Category | n= | EV/Rev Range | EV/Rev Median | Trend |
|---|---|---|---|---|
| AI-Native Consulting & Advisory | 3 | Undisclosed (strategic acquisitions dominate) | Not available — Faculty terms undisclosed; OpenAI JV pre-revenue | Expanding ▲ |
| Non-Human Identity Infrastructure | 4 | 9.5x–50x+ (early-stage) | Strategic exits $800M–$1B+ for $100M+ ARR targets | ~15x–20x implied (growth stage rounds) | Expanding ▲ |
| Legacy IAM & Cybersecurity Services | 2 | 14x–50x (wide dispersion by NHI-adjacency) | ~14x EV/Revenue (Imprivata implied at $7B / $500M revenue) | Expanding ▲ |
NHI-specific platforms command a structural premium over broad legacy IAM. The Palo Alto Networks–CyberArk transaction ($25B) carried an EV/Revenue multiple estimated at 20x+ — significantly above the Imprivata implied 14x for a comparable-revenue healthcare identity asset. The delta (35–45% premium) reflects the market's pricing of the AI agent identity thesis: CyberArk's PAM architecture extends to non-human identities by design; Imprivata's healthcare SSO model does not. ServiceNow's Veza acquisition ($1B+ for an NHI governance platform with sub-$100M ARR) implies a premium multiple justified by the 82-to-1 machine/human identity ratio and the absence of incumbent solutions at enterprise scale. The inference for cycle tracking: every NHI-flagged deal in this index should carry a baseline 25–40% multiple premium vs. functionally comparable non-NHI identity assets.
Adjacent Signals
Reuters reported March 5 that Thoma Bravo and Hellman & Friedman are studying FactSet as a potential take-private target after a 39% share decline driven by AI disruption fears. Morningstar and Gartner are in the same analyst disruption narrative. This is not AI-native deal flow — it is AI-fear-driven value creation opportunity for software-focused PE. The adjacent signal for ACI: if PE firms are willing to buy financial data infrastructure at AI-disrupted multiples, the same logic applies to legacy professional services platforms (compliance, audit, regulatory advisory) that have similarly declined on AI narrative. Watch for parallel processes in data/analytics adjacent to the five ACI categories.
ReutersWhat to Watch
-
OpenAI–PE joint venture close: will TPG, Bain, Brookfield, Advent formalize the $10B enterprise AI consulting structure?
30–45 days
strong
1
If closed, this becomes the largest AI-Native Consulting transaction ever recorded and restructures the competitive landscape for all incumbent AI services firms. Preferred equity structure and portfolio distribution model creates a new PE–AI lab deal archetype.
-
Thoma Bravo Imprivata sale process outcome: watch for buyer identity (corporate vs. PE) and final multiple
60–90 days
strong
4
A $7B+ close would set the EV/Revenue comp table for healthcare identity assets at ~14x. Corporate buyer (Palo Alto, CrowdStrike) would signal platform consolidation; PE buyer would signal another hold-and-build cycle.
-
Palo Alto Networks Q2 FY2026 earnings (February 17 call) — listen for NHI revenue break-out within CyberArk integration
Already occurred — watch for Q3 call in May
strong
24
First post-acquisition earnings with CyberArk integrated. NHI revenue line disclosure would validate the $25B identity thesis and set precedent for how PAM-adjacent NHI capability is priced separately.
-
Anthropic–Blackstone/H&F/Permira joint venture structure — will it mirror or differentiate from the OpenAI–TPG deal?
30–60 days
moderate
1
Two competing AI-native consulting structures launching simultaneously creates a duopoly dynamic with significant implications for mid-market AI services firms that must choose platform alignment.
-
Oasis Security ARR trajectory — Series B milestones will determine whether PE buyout or strategic acquisition is the exit path
12–18 months
emerging
2
At $120M raised and 82-to-1 machine/human identity ratio, Oasis needs to demonstrate ARR velocity to bridge the gap to NHI exit comps ($800M–$1B+ per CrowdStrike–SGNL and ServiceNow–Veza precedents).
The Agentic Capital Index tracks PE, growth equity, and strategic M&A activity across five categories of AI-native and AI-adjacent services. Deal data is sourced from company press releases, Reuters, Bloomberg, Axios, SecurityWeek, Forbes, TechCrunch, PE Professional, and secondary databases including Crunchbase. AI classification (AI-Native, AI-Augmented, AI-Adjacent) is assigned based on the Applied Identities taxonomy: founding date relative to AI inflection, core delivery mechanism, and revenue composition. NHI flags are applied to companies whose primary value proposition involves non-human identity management, governance, or infrastructure for AI agents, service accounts, API keys, and machine identities. Valuation comps are derived from disclosed transactions and comparable exit data. This is the inaugural ACI issue — no cycle-over-cycle delta metrics are available. Delta fields are omitted per Issue 1 protocol.
Conflict of Interest Disclosure: Applied Identities provides consulting services to organizations in the AI-native services and identity governance sectors. Some companies tracked in this index may be current or prospective clients. The Agentic Capital Index is produced for informational purposes only and does not constitute investment advice. Daniel Davenport and Applied Identities may have commercial relationships with companies mentioned in this report. All deal data is sourced from public filings, news reports, and third-party databases. Applied Identities does not verify the accuracy of third-party data sources.