Beyond Identity, Permiso, Semperis and Silverfort

About Permiso

Permiso's Universal Identity Graph connects every identity to the credentials it owns, the machines it creates, the agents it runs and every action it takes in real time. Permiso states that the chain stays unbroken from a human SSO login to a Lambda function to an MCP tool call.^[3]

Permiso states that modern threat actors are compromising identity providers and moving across environments through cloud service providers, SaaS apps and CI/CD pipelines. Permiso's library of integrations tracks activity across cloud environments. Permiso identifies the gap in agent security as what happens after authentication, where IdPs go blind to every tool call, MCP invocation and sub-agent spawn.^[3]

Permiso Discover gives enterprises an inventory of human, non-human and AI identities wherever they live. Permiso Protect continuously evaluates the risk posture of identities based on usage patterns, exposure and entitlements. Permiso Protect surfaces and quantifies high-risk identities, stale access and toxic combinations across human, vendor, AI and non-human accounts. Permiso's Universal Identity Graph inventories identities in all cloud environments and assesses exposure risk. Permiso describes removing zombie accounts and identities, including vendors, that are no longer active in an environment. Permiso shows where MFA is not used and monitors the age and rotation of password and access keys. Permiso provides visualizations of different ways threat actors could compromise identities to move laterally and gain access to sensitive data.^[1][3][4][6]

Permiso provides identity threat detection and response for human and non-human identities across environments. Permiso's detection engine has 1500+ detection rules engineered by its P0 Labs team, which actively researches and monitors attacks in the wild. Permiso detects access and behavioral anomalies in environments such as AWS, Azure, GCP, GitHub, Slack and Salesforce. Permiso monitors activity and correlates user behavior to produce identity security alerts across AWS, Azure, Okta and M365. Permiso tracks the entire lifecycle of credentials, their privileges and posture, and all of the sessions in which those credentials were used and by what identity. Permiso's watchlist capability identifies and mitigates threats from employees, contractors and other trusted individuals who may pose security risks to the organization. Permiso monitors human and non-human identities for access and behavior anomalies in AWS, GitHub, Jira, Salesforce and Snowflake.^[3][4][7][8]

Permiso defines non-human identities (NHIs) as any digital identity that authenticates and operates without direct human control. Permiso inventories human and non-human identities, including keys, tokens, service accounts, roles and groups. Permiso identifies orphaned, stale and overly permissive NHIs across cloud environments. Permiso provides a centralized dashboard to monitor NHIs. Permiso monitors the behavior of non-human identities and the humans using them to detect suspicious and malicious activity.^[9][10]

Permiso ties every run, event and tool call to the identity behind it in real time across cloud, infrastructure, SaaS and on-prem environments. Permiso launched AI agent runtime security, bringing Identity Runtime Attribution to every agent in production. The Permiso platform gives security teams visibility into agent runs, tool calls and MCP invocations across the full agent lifecycle. Permiso finds agents in Lambda functions, containers and VMs, in the code repositories where they are defined, and behind the model endpoints where they execute. Permiso ties every agent action to a specific human, non-human or AI identity in real time. Permiso visualizes agent actions through the Universal Identity Graph and preserves them as a complete audit trail. SandyClaw runs every skill in a controlled sandbox before it touches the environment, recording every action, every tool call and every downstream request. Permiso's agent lifecycle covers discovering agents, attributing identity at runtime, detecting anomalies, sandboxing skills and enforcing controls, including kill switches. Autodesk is among the first enterprises to deploy the agent capabilities, securing AI agents across its products, workforce and cloud infrastructure.^{[1][3][4][11]}

Permiso detects suspicious activity in Google Cloud Platform across Compute, Storage, App Engine, Secrets Manager, Logging, Network, SSO and IAM. Permiso monitors when GitHub repositories have been transferred outside the organization or updated to public. Permiso provides threat detection for 1Password's password management system. Permiso inventories users in Open AI and monitors their posture and corresponding risk. Permiso monitors only the control plane and is not exposed to any underlying or transaction data. Permiso encrypts control plane data at rest and in transit. ACV Auctions is a Permiso customer. Nutanix is a Permiso customer. Modern Health is a Permiso customer. Permiso states its mission as simplifying cloud security for technology and security professionals.^[3][12][13]

About Semperis

Semperis is an identity-driven cyber resilience and crisis management company that protects critical identity systems from agentic and conventional cyberattacks. Semperis is a private company and B2B cybersecurity provider specializing in Identity Threat Detection and Response (ITDR), cyber crisis management, and hybrid identity protection solutions and services. Semperis focuses on comprehensive identity resilience across the full attack lifecycle of prevention, detection, response, and recovery. Semperis states that its proprietary AI-powered technology is purpose-built for securing hybrid identity environments, including Active Directory, Entra ID, and Okta. Semperis helps organizations prevent, detect, respond to, and recover from agentic and conventional identity attacks.^[1][3]

Semperis states that every user, workload, and agent depends on identity providers like Active Directory, Entra ID, and Okta. Semperis states that Active Directory remains the identity source of truth in most organizations. Semperis states that attackers commonly go after highly privileged identities and embed backdoors to maintain access. Semperis states that misconfigurations and unpatched vulnerabilities pile up over years, while attackers pivot between on-prem and cloud identity systems in search of elevated privileges. Semperis states that recovery historically required a full AD rebuild, a costly, months-long effort with serious operational impact.^[3][5][6]

Directory Services Protector (DSP) is a Semperis product for hybrid identity threat prevention, detection, and response. Semperis delivers identity threat detection and response that combines tamperproof tracking of every directory change with automatic rollback of malicious activity. Directory Services Protector provides a single view of security vulnerabilities across the hybrid AD and Entra ID environment, including non-human identities, or service accounts. DSP includes hundreds of built-in, constantly updated security indicators to monitor hybrid AD and Entra ID environments for legacy vulnerabilities and emerging threats. DSP includes automated rollback to undo unwanted or malicious changes in both AD and Entra ID. DSP can identify service accounts, build an inventory, and monitor them with specialized indicators developed by the Semperis threat research team. Semperis offers attack detection powered by AI models developed by identity security experts to detect password spray, credential stuffing, other brute force attacks, and risky anomalies. Semperis offers out-of-the-box integrations for Splunk and Microsoft Sentinel that forward AD and Entra ID change data, DSP security indicator results, and notification rule events.^[5][6]

Semperis describes Active Directory Forest Recovery (ADFR) as an automated AD disaster recovery approach. Semperis ADFR is a backup and recovery solution purpose-built for recovering Active Directory from cyber disasters. Disaster Recovery for Entra Tenant (DRET) provides backup and recovery for Entra ID. Delegation Manager for AD is a Semperis offering for secure AD permissions delegation. Migrator for AD is a Semperis offering for security-first AD migration and consolidation. Ready1 is an enterprise cyber crisis readiness and crisis management platform.^[1][7]

Semperis Identity Forensics & Incident Response (IFIR) addresses the entire lifecycle of an identity-layer attack. Semperis states that its specialized team provides rapid containment, forensic investigation, and secure recovery. Semperis offers identity forensics following an attack to assess the damage, eradicate threat actors, and recover to a trusted environment. Semperis offers a service that gives a clear picture of AD security posture and a roadmap to address exposures at the strategic, operational, and tactical levels. Semperis offers a service to align recovery time objective (RTO) and recovery point objective (RPO) metrics and identify implicit dependencies that might hinder recovery plan execution. Semperis offers a review of identity and access management configuration from Entra ID security experts. Semperis offers expert guidance and purpose-built technology for AD migration and consolidation.^[1][5]

Semperis offers free community tools: Purple Knight for identity security assessment and Forest Druid for Tier 0 attack path discovery. Semperis publishes original research into emerging threats, threat mitigation, and industry trends.^[1]

Semperis was founded by Mickey Bresman (CEO), Guy Teverovsky (CTO), and Matan Liberman (EVP Business Development). Semperis has its headquarters in Hoboken, New Jersey, and operates internationally. Semperis raised a $40M Series B led by Insight Partners, bringing total funding at that point to $54M. Semperis raised over $200M in a Series C led by KKR, with Ten Eleven Ventures, Paladin Capital Group, Atrium Health Strategic Fund, Tech Pioneers Fund, and Insight Partners. Semperis secured $125M in growth financing to accelerate R&D and global expansion and bolster executive leadership. General David Petraeus (U.S. Army, Ret.), a Partner at KKR and former Director of the CIA, joined Semperis as a strategic advisor to help bolster identity threat detection and response in the public sector. Prime Healthcare needed to modernize and accelerate AD forest recovery after an internal change caused outages across multiple domain controllers. Temple Health, a healthcare system, sought an ITDR approach that met healthcare security and compliance requirements while simplifying recovery. Foulston Siefkin LLP moved to a hybrid AD and Entra ID environment and reviewed business continuity.^{[1][3][5][7][8]}

About Silverfort

Silverfort sells an identity security platform that enforces identity security inline and at the moment of authentication across workforce users, privileged users, third parties, non-human identities and AI agents. Silverfort's platform uses Runtime Access Protection (RAP) technology to integrate with a customer's IAM infrastructure, delivering end-to-end visibility and inline protection to identities. In the RAP flow, the IAM infrastructure forwards a request to Silverfort using RAP technology. Silverfort analyzes risk and triggers inline security controls if needed.^{[1][2][3][6][13]}

Silverfort states that identity has always been the easiest way for attackers to reach what matters most. When an identity requests access, whether human, machine or AI, Silverfort analyzes the full context of the request and acts instantly to allow, challenge or block. Silverfort integrates into IAM infrastructure including Active Directory, cloud IdPs, SaaS, legacy systems and OT without system modifications. Silverfort discovers and maps users, service accounts, non-human identities and AI agents without proxies or manual configuration. Silverfort blocks, challenges or restricts access in real time when it identifies a risk, with no human in the loop required. Silverfort applies security controls across on-prem, OT, hybrid, cloud and multi-cloud infrastructure. Silverfort extends protection to resources from legacy systems and command-line tools to modern cloud workloads and SaaS apps.^{[3][5][7][13]}

Silverfort extends MFA protection to any resource, including legacy apps and command-line tools. Silverfort extends MFA to every AD-managed authentication in Kerberos, NTLM and LDAP flows. Silverfort can act as an organization's single MFA solution or extend the MFA solution an organization already uses. Silverfort enforces identity-based segmentation by limiting each identity to only the systems it should access.^[6][7][8]

Silverfort discovers all NHIs and protects service accounts with purpose-based access policies and fencing. Silverfort builds a behavioral baseline for each service account, learning its usual access paths, privileges and frequency of activity. Silverfort discovers, monitors and controls AI agent activity with real-time access policies. Silverfort maps each AI agent to its provisioning identity and human owner through visual storyline graphs showing roles, accessed resources and permission chains. Silverfort's native integrations with Google Cloud Agent Gateway and Microsoft Copilot Studio and its MCP Gateway monitor every agent call in real time, evaluating authorization scopes before execution. Silverfort enforces privileged access controls dynamically, with no vault required.^{[5][6][9][10]}

Silverfort applies a scoring model based on probability and business impact. Silverfort monitors every authentication and access attempt of every human and machine in a hybrid environment. When Silverfort detects malicious identity activity, it can block or interrupt the flow by denial, MFA challenge or session termination, enforce virtual fences, or quarantine access. Silverfort enriches alerts with identity risk context and forensic detail and pushes them to SIEM, XDR, SOAR or security operations tools.^[11][12]

Silverfort's platform operates with no proxies, no app changes, and no user friction or workflow modifications. Silverfort bases its pricing on the size of an organization and offers four packages. Silverfort packages are available for on-prem, cloud and hybrid environments, and included modules may vary by environment type. Silverfort lets buyers customize a package from individual platform capabilities. Silverfort provides Identity Security Services for threat hunting and incident response, and Silverfort Resident Expert for staff augmentation.^[3][6]

Silverfort discovers users and service accounts and enforces identity access controls on critical resources, from command-line access to file shares, legacy apps and IT infrastructure. Silverfort secures the convergence interfaces of OT networks with the IT network at layer 3.5 and secures engineers and service account access in the production zone. Silverfort addresses ransomware attacks and lateral movement by detecting and blocking malicious authentications at runtime.^[13]

Silverfort was founded in 2016. Silverfort states that identity security is its sole focus and mission. Hed is the CEO of Silverfort and one of its co-founders. Yaron is a co-founder and the Chief Technology Officer at Silverfort. Silverfort extends identity controls already protecting over 1,000 organizations to AI agents, on one policy engine with one audit trail.^{[1][7][8][9][10][11][12][13][14]}