C1.ai, Orchid Security, SailPoint and Veza

About Orchid Security

Orchid Security sells an identity-first security platform that discovers, analyzes, governs, and proves identity controls across applications. Orchid says identity now lives across IAM, applications, infrastructure, and code, and that Orchid was built to bring coherence back to that sprawl.^[2][3][4]

Orchid says it eliminates identity blind spots by uncovering unmanaged apps, hidden authentication flows, and ungoverned access. Orchid defines identity dark matter as access, credentials, and authentication logic that security tools can't see or track. Orchid says AI agents now authenticate to enterprise APIs, assume IAM roles, traverse cloud storage, and trigger production workflows, all outside the governance programs built to control exactly that kind of access.^[3][5]

On discovery, Orchid discovers SaaS, cloud, on-prem, legacy, and custom-built applications automatically. Orchid continuously inventories SaaS, legacy, home-grown, and shadow applications. Orchid discovers every app and every identity, human, machine, and agentic AI, automatically. Orchid delivers continuous, telemetry-driven visibility into identity implementations across all automatically discovered applications regardless of geography, technology stack, or existing compliance knowledge.^[3][6][7]

On analysis, Orchid's AI analyzes authentication and authorization logic inside each app, identifying weak encryption, hardcoded credentials, and missing controls, and maps posture against frameworks like NIST, ISO, SOX, and GDPR. Orchid provides a visual identity graph showing every authentication and authorization flow. Orchid maps security and compliance violations directly to the frameworks a customer chooses. Orchid's analysis is entirely autonomous, unlike traditional assessment and onboarding processes that rely on interviews, documentation, or involvement from app owners or developers.^[6][7]

On governance, Orchid integrates with IAM, PAM, and IGA systems to enforce policies, automate remediation, and maintain least-privilege access across all environments. Orchid does not replace IAM, PAM, or IGA tools, because Orchid integrates with existing IAM, PAM, and IGA tools to enhance visibility and governance. Orchid uses application-level identity context to onboard apps into IAM, IGA, and PAM. Orchid automates the collection of identity data that IAM teams spend months chasing. Orchid says application onboarding time can fall from 4 weeks to 1 week for the average application, and that professional services costs can fall from an average of $15,000 to $500 per application.^[1][3][6]

On audit, Orchid records every discovery, policy, and action so that it is auditable. Orchid creates a living identity audit trail across managed and unmanaged systems, delivering real-time evidence instead of annual reports. Orchid's framework-aligned reporting covers SOX, PCI, HIPAA, GDPR, and NIS2. Orchid Identity Audit provides continuous observability to identify Identity Dark Matter across all managed and unmanaged environments, and Orchid describes it as relevant to acquisitions, where application level identities often fall through the cracks and leave orphaned accounts tied to legacy domains that no longer exist.^[6]

Orchid says it is used by teams responsible for regulated industries under audit pressure and identity programs with persistent blind spots. HUB International states that it integrated 200+ new acquisitions in the past years, each bringing unique applications with varying levels of security and compliance. Robert Wiseman is Co-Founder of Orchid, and Tal Herman is Chief Product Officer at Orchid.^{[1][2][3][4][7][10]}

About SailPoint

SailPoint sells identity security software that discovers, governs and secures every human and non-human identity from a single platform. SailPoint says AI agents and bots form a new workforce that legacy tools cannot see. Non-human identities already outnumber the workforce they serve, and few organizations have proper controls to govern them, in SailPoint's words.^[14]

The SailPoint Platform delivers Adaptive Identity through two solutions. SailPoint Identity Security is the continuous, cloud-native solution for modern enterprises. IdentityIQ delivers deep, customizable governance for complex, hybrid, and heavily regulated environments. Atlas is the foundation that powers SailPoint Identity Security. Atlas provides common services for connectivity, data models, AI-driven analytics, and workflow automation. SailPoint says it discovers every identity, entitlement, and access path, governs by enforcing least privilege and orchestrating access policies, and protects by taking real-time action to remediate risk, revoke access, and adapt to changing behavior.^[1][15]

SailPoint Identity Security brings together SailPoint Human Fabric and SailPoint Agentic Fabric to govern human, non-employee, machine, and agent identities within one unified experience. Human Fabric and Agentic Fabric are the two products within SailPoint Identity Security. Human Fabric shifts workforce governance from scheduled audits to continuous, always-on protection. SailPoint Agentic Fabric discovers, governs, and secures non-human identities such as service accounts, machines, and AI agents. Agent Identity Security has evolved into SailPoint Agentic Fabric, which unifies AI agents, their users, and the tools they access in one governed view. SailPoint connects directly to AWS, Azure, Google Cloud Platform (GCP), Salesforce, and other systems to automatically onboard AI agents and other NHIs.^[15][16][17]

SailPoint Entro performs deep, contextual scanning across code repositories, cloud environments, CI/CD pipelines, and SaaS applications to help build a comprehensive inventory of machine identities. SailPoint announced its intent to acquire Entro to advance non-human identity security. SailPoint Entro connects non-human identities to human identities through ownership attribution and deep lineage mapping. NHIDR is a proactive defense mechanism that continuously monitors machine identity behavior. SailPoint-Entro helps IAM and AppSec teams discover, govern, and secure AI agents, non-human identities, and secrets across every environment.^[18]

SailPoint Data Access Security extends identity security and access controls to data, securing access across every identity, human or machine. Data Access Security discovers where critical information lives, classifies it, and enforces least-privilege access policies. Data Access Security adds data-centric risk insight to SailPoint access certifications, showing who accessed what data, how often, and why. SecOps Identity Intelligence delivers governance-grade identity context directly into security workflows to help teams investigate threats faster and make more informed response decisions. With Machine Identity Security, owners can be assigned directly from the discovery results, so that no account is left without accountability.^[19][20][21]

SailPoint IdentityIQ is an identity security platform custom-built for complex enterprises. Its core modules are Compliance Manager, Lifecycle Manager, Password Manager, and File Access Manager. IdentityIQ connects through SailPoint's library of standards-based connectors, using protocols such as REST, SCIM, JDBC, CSV, and LDAP. IdentityIQ applies AI and machine learning through SailPoint Predictive Identity to discover suspicious or anomalous access, maintain continuous compliance, and improve productivity. SailPoint lists 200+ connectors and integrations to help manage access to critical applications. SailPoint Identity Security Cloud is a bundle of SaaS capabilities for building an identity security program wherever a customer is in its identity journey. SailPoint Agentic Acceleration is meant to eliminate hundreds of hours of manual data collection and planning.^[15][22][23]

Lifecycle Management handles onboarding, offboarding, and changes throughout the user journey. SaaS Workflows let customers build and adapt automated tasks. SailPoint provides flexible, policy-based workflows that can distinguish between full-time employees, contractors, partners, and temporary workers. SailPoint says it manages and governs non-employee identities from onboarding to offboarding.^[14][24]

SailPoint states that 53% of the Fortune 500 and 28% of the Forbes Global 2000 are its customers. Satvinder Madhok is Vice President, Business integrated Technology Solutions at Wipro. Lachlan McGill is General Manager of Cyber Risk and Compliance at Salvation Army Australia. Mark Ward is Head of Identity & Access Management at Legal and General. Danial O'Shea is Identity & Access Management Product Owner at Specsavers. Richard Layne is Manager of Identity and Access Management at Main Line Health. Paweł Mosurek is Identity and Access Management (IAM) Manager at BNP Paribas Bank Polska.^{[15][18][22][24]}

About Veza

Veza provides a unified Access Platform that brings together identities across systems for access search, actionable intelligence, automated access reviews and identity lifecycle management. Veza unifies identities and entitlements across people, machines, and third parties, from apps to data, on-prem to SaaS. Veza maps an identity ecosystem across users, groups, roles, policies, permissions and resources to uncover dormant accounts, excessive privileges, access drift, and non-human and third-party access. Veza secures identities across on-prem, non-human identities (NHI), cloud-native, SaaS, and custom apps. Veza offers a unified access authorization platform that covers access governance, privilege access and access management across an entire environment.^[1][7]

Veza describes SaaS adoption as bringing security challenges, including a greatly expanded attack surface and the scale of governing access to so many SaaS apps. Veza says that migration to the cloud made access management harder, with many more identities and resources to manage. Veza describes itself as an authorization platform for identity-first security that is used to understand, manage and control who can and should take what action on what data. Veza says its authorization platform helps organizations understand, manage and control identity-to-data relationships for access governance, privileged access, cloud entitlement management and more.^{[7][8][10][11]}

Veza states that enterprises can enforce least privilege principles and enable Zero Trust with its platform. Veza provides a way to visualize and control data access across all systems, mitigating risks for both human and machine identities. Veza provides a way to understand and control access to unstructured data in data lakes, ML datasets, shared drives and cloud storage. Veza supports access reviews based on the effective permissions of identities, to enforce least privilege and compliance. Veza enables enterprise-wide access governance across all users, apps and systems, covering access reviews, lifecycle management, access requests and separation of duties.^[7][12]

Veza helps show who can do what across Amazon, Google, Azure and Oracle cloud environments. Veza surfaces varying access levels to subscriptions, resources and Azure data assets. Veza covers the permissions of all identities, including service accounts and other machine identities. Veza tracks permissions across SaaS applications, identities and accounts in real time. Veza covers least privilege and governance for AI models, APIs and compute resources across AWS Bedrock, OpenAI and Microsoft Co-Pilot. Access AI provides visibility into enterprise-wide access.^[7][8][9]

Veza detects overprivileged access, dormant accounts and toxic permission combinations. Veza provides audit-ready access reports and demonstrable controls for compliance with industry regulations and internal cyber controls. Veza helps data teams protect sensitive information and enforce least privilege across structured and unstructured data. Veza offers secure access to Snowflake environments, SharePoint repositories and traditional databases. Veza lets platform owners of apps, data and infra understand and manage which users have access to their systems. Veza states that its customers include organizations of all sizes.^[7]

Veza has earned SOC 2 and ISO 27001 certifications after recurring third-party audits. Veza states that it is compliant with the EU General Data Protection Regulation (GDPR) and the California Consumer Privacy Act (CCPA). Veza engages independent third-party security experts to conduct regular audits and penetration tests of its systems.^{[7][8][9][13][14]}