Orchid Security: who they are, what they sell and what CISOs should ask

What Orchid Security sells

Orchid Security sells an identity security platform to large enterprises. It was headquartered in New York with R&D operations in Israel, and is privately held and venture-backed. It came out of stealth with a $36M seed round co-led by Team8 and Intel Capital, and it describes itself as backed by Intel Capital and Team8. The company says it targets enterprises that handle on average 1,200 different applications across on-premises, cloud and SaaS hosting.

The product is one platform. Its own FAQ says it discovers, analyzes, governs, and proves identity controls across all applications. The company says discovery covers SaaS, cloud, on-prem, legacy, and custom-built applications. On analysis, its platform page states that Orchid's AI analyzes authentication and authorization logic inside each app. That page says the analysis looks for weak encryption, hardcoded credentials and missing controls, and maps the results against frameworks such as NIST, ISO, SOX and GDPR. The company's launch release said the analysis works without requiring access to or changes in the application code.

The company added to that base over time. On February 5, 2026 it launched Identity Audit, which it says collects application-level telemetry on logins (successful or not), logouts, Joiner/Mover/Leaver changes, and more. Later it announced identity drift detection and application-level kill switches for AI agents.

On delivery, the company says Orchid integrates with IAM, PAM, and IGA systems to enforce policy and automate remediation. Its Costco case study describes a service that will passively identify applications with native identity controls that are installed on each host, along with links to ticketing and workflow tools, like ServiceNow or Jira. Named integrations include a certified PAM integration with Palo Alto Networks Idira and a prebuilt integration that streams identity telemetry to the SOC through Splunk Enterprise Security. Orchid also joined the SailPoint Technology Alliance Partner ecosystem. In our reading, the pages reviewed do not say whether the platform runs as a hosted service, on customer premises or both.

Pricing, according to the CEO, was based on the number of applications managed, with sales made directly or through certified channels.

The company is explicit about what Orchid is not. Asked whether it replaces IAM, PAM or IGA tools, its FAQ answers: "No. Orchid integrates with existing IAM, PAM, and IGA tools to enhance visibility and governance." Its CEO called it "not an added feature or a replacement of a different existing tool." Readers can compare it with other identity vendors on our vendors pages.

Figure: Orchid Security's home page, captured 2026-10-29. Source: Bringing Clarity to the Complexity of Identity.

The founders

Orchid Security has three co-founders on our record: Roy Katmor, the chief executive; Robert Wiseman, co-founder, GM and VP R&D; and Ido Kelson, chief software architect. Two of the three had built and sold a company together before.

The company's account of its origin starts with Katmor. In an interview with AlleyWatch at the time of the seed round, he said that while he was entrepreneur-in-residence at Team8, he "was tasked with exploring emerging theses in the security space." The one that stood out, in his words, was "the challenge of onboarding applications and adopting the latest identity security controls." He said that over three years Team8 found identity consumption ranked among enterprises' top three concerns, budget investments and sources of dissatisfaction. The company page states that about a year later, after research into large language models, Wiseman and Kelson joined the team.

Katmor's stated background is in endpoint security. The company page says he was GM and VP of Endpoint Security at Fortinet after Fortinet acquired enSilo, a company he founded and ran as CEO for over five years and which was backed by LightSpeed Ventures. Before enSilo, the page lists product strategy, management and R&D leadership roles at Akamai, Imperva, Trustwave and SAP.

Kelson came from the same company. According to his profile, he co-founded enSilo and served as its VP of Engineering, then became chief architect of the endpoint solution at Fortinet after the acquisition. Before that he led R&D teams designing and building Imperva's core platform, joining at the company's startup stage.

Wiseman's path ran through Team8 itself. His profile says that as VP at Team8 Enterprise Foundry he led the incubation of cybersecurity startups. Since 2021 he has also been a Board Observer for Gem Security (acquired by Wiz) and OX.Security. Earlier, the page states, he held research and presales leadership roles at Claroty and was VP of Technical Operations at Bionic, which CrowdStrike acquired. At Orchid, the company says, he leads both the technical and business operations, including customer success.

On why the timing worked, Katmor pointed to the models themselves. In the seed announcement he said: "The latest LLM models include code recognition and reasoning skills that enable understanding of identity flows in running applications without requiring code access or input from the application owners." More on the people behind the company is in our people records.

What the product does

The company presents Orchid as an identity security platform that, in the words of its homepage, "discovers, analyzes, governs, and proves identity controls across all applications." Those four verbs map to the four stages a team works through, and each stage hands its output to the next.

Discover. The first stage builds the inventory. The platform page says Orchid "continuously inventories SaaS, legacy, home-grown, and shadow applications", and that human, machine and agentic AI identities are found automatically. On its GRC page, the Application Discovery Service is described as identifying code that includes authentication mechanisms. Each application arrives with an initial risk rating, which the company says lets IAM teams see what sits outside their program and decide what to onboard first.

Analyze. The second stage looks inside each application. The company says its AI checks authentication and authorization logic for weak encryption, hardcoded credentials and missing controls, and maps the results against frameworks such as NIST, ISO, SOX and GDPR. The outputs are a visual identity graph of every flow and a list of violations mapped to the frameworks the customer chooses. Orchid's launch announcement said its language models assess identity flows without access to or changes in the application code. For onboarding, the company offers an auto-generated IGA questionnaire meant to replace interviews with application owners.

Orchestrate. The third stage acts on findings through the IAM, PAM and IGA tools covered earlier. The platform page lists automated collection of identity data and bridging unmanaged applications back into IAM control. For incident responders, the company says the product can trigger containment actions with full identity context and decommission every instance of a compromised credential, with proof.

Audit. The last stage is the record. Orchid states that every discovery, policy and action is recorded, with exportable audit data and reporting aligned to SOX, PCI, HIPAA, GDPR and NIS2. The homepage says it sets an identity baseline and tracks improvement against it.

The same loop applies to AI agents. According to Help Net Security, Orchid applies readiness tags to applications, accounts and access paths, and links each agent action to the identity, delegation chain and governance response that followed, alongside the drift and kill-switch controls noted earlier.

On control, the company's account is that Orchid acts through the organization's existing identity, security and AI infrastructure rather than in place of it. Our reading is that the team keeps the policy, the framework choice and the systems of record, while Orchid supplies the inventory, analysis and evidence.

Figure: Orchid Security's product page, captured 2026-10-29. Source: Identity Security Platform: Uncover Identity Dark Matter.

How it works and what it connects to

Orchid describes itself as a layer over the identity tools a customer already runs, not a substitute for them. Its platform page says Orchid "integrates with IAM, PAM, and IGA systems" to enforce policies and automate remediation. Its FAQ answers the replacement question directly: "No. Orchid integrates with existing IAM, PAM, and IGA tools to enhance visibility and governance." The IAM programs page adds ITSM tools to the systems it feeds with identity context (use case page).

The company describes collection as starting at the application. In the Costco customer story, Orchid lists "a transparent service that will passively identify applications with native identity controls that are installed on each host anywhere in the world". The same page names ticketing and workflow tools, ServiceNow or Jira, as the place where remediation work is opened and tracked (Costco story).

Identity Audit widened the data sources. With that release the company said it combined "proprietary audit data captured inside unmanaged applications with audit logs from governed IAM systems". The telemetry it named included logins, successful or not, logouts and joiner, mover and leaver changes (release). It said those signals "are enriched with LLM-powered analytics, turning raw telemetry into intent-based intelligence". It also said inactive or unused accounts are correlated with existing IAM and HR systems to confirm ownership (release).

The company has named three integrations. A blog post by chief product officer Tal Herman announced that Orchid had joined the SailPoint Technology Alliance Partner ecosystem. It set out the division of work as "SailPoint provides the governance engine", with Orchid discovering identities at the application layer. Help Net Security reported a certified PAM integration with Palo Alto Networks Idira that "discovers privileged accounts not previously known to Idira and brings them under management". The same report described a prebuilt Splunk Enterprise Security integration that "streams identity telemetry to the SOC for correlation, investigation, and incident response".

For AI agents, that announcement listed continuous drift detection between an agent's intended purpose and its observed behavior. It also listed application-level kill switches that can restrict permissions, revoke credentials, disconnect tools or suspend agent workflows (Help Net Security).

The sources are silent on several points. They do not say whether the platform runs as SaaS, inside the customer's environment or both. They do not say where collected identity data and telemetry are stored, or which language models Orchid uses. Apart from saying it does not replace IAM, PAM or IGA tools, the company states no limits on what it can discover or analyze.

Where it sits in the market

CISO Tribune's record files Orchid Security under three categories. Identity governance and administration covers provisioning, access requests, role management and periodic access reviews across applications. Identity threat detection and response covers monitoring of identity systems such as Active Directory and identity providers to detect and stop identity-based attacks. Non-human identity security covers the discovery, governance and protection of service accounts, API keys, tokens and workload or AI agent identities. Definitions for each sit in our glossary.

The chart shows how many vendors CISO Tribune's record files under each of the three categories Orchid Security sits in, as of 29 October 2026.

The record lists these vendors in one or more of the same three categories. They appear in alphabetical order: 1Password, Abnormal AI, Aembit, Akeyless, Apono, Astrix Security, Auth0, BeyondTrust, Blackpoint Cyber, Britive, Cayosoft, ConductorOne, CrowdStrike, CyberArk, Cyera, Cygrid, Delinea, Descope, GitGuardian, Grip Security, Guardz, HashiCorp, Huntress, Infisical, Keeper Security, Malwarebytes, Material Security, Mitiga, Oasis Security, Obsidian Security, One Identity, Onyx Security, P0 Security, Permiso, Ping Identity, Reco, RSA Security, SailPoint, Saviynt, Semperis, SentinelOne, Silverfort, Sonrai, SSH Communications Security, Symmetry Systems, Token Security, Truffle Security, Valence, Vectra AI, Veza and WatchGuard Technologies. Profiles of each are under vendors.

Orchid's own pages draw its boundary around what central identity systems do not reach. Its homepage states that "Orchid uncovers applications and identity behavior that operate outside centralized identity systems." The platform page says it "continuously inventories SaaS, legacy, home-grown, and shadow applications to expose blind spots that IAM can’t see." The company's boilerplate describes the product as "the industry’s first Identity Control Plane". That is the company's claim.

On governance, the SailPoint partnership post mentioned earlier gives the aim as to "Expand the universe that IGA can actually govern". It also says the aim is "Not to create another identity silo." Roy Katmor told AlleyWatch that Orchid is "a new infrastructure solution, an enabler, and not an added feature or a replacement of a different existing tool."

On threat response, the incident response page states that "Orchid gives incident responders identity observability across unmanaged systems, where breaches often begin." On non-human identities, the platform page says: "Human, machine, and agentic AI - all discovered automatically." The GRC page refers to "unmanaged, legacy, and non-human identities that traditional IAM can’t see."

Our reading is that these pages present Orchid as a discovery and context layer that works next to the governance, privileged access and detection products sold in these categories, not in place of them. That fits the company's statement, cited earlier, that it does not replace existing identity tools. The pages make no direct comparison with any named neighbour.

Funding, investors and growth

Orchid Security's one disclosed round is a seed round. The company's release said it had raised $36 million in seed funding, co-led by Team8 and Intel Capital. CapitalOne also took part, along with individual backers Jeff Williams, Dror Davidoff and Zohar Alon. The release was datelined New York, January 7. Tech Startups reported the round on January 14, 2025, and wrote that it marked the company's emergence after a year in stealth.

The release listed three uses for the money. Orchid said it would accelerate development of its platform, scale up its sales and support teams, and build its marketing engine. Tech Startups described the purpose more generally, as growth and refining the company's identity management products.

Katmor gave AlleyWatch an account of how the round came together. He said Intel Capital joined after "a meaningful early design partnership program." He described the fundraising process as "both preemptive and smooth." In a Team8 quote in the company's release, managing partner Amir Zilberstein said Team8's venture creation team saw an opportunity in the identity space. Williams is also listed on Orchid's company page, which describes him as an Operating Partner at Bain Capital's Ventures team.

At the time of the round, Orchid said it was working with enterprises in finance, manufacturing, healthcare and retail. AlleyWatch named Costco and Repsol among the customers that had adopted the product. Neither source gives a customer count.

Katmor also described the business model. Pricing is based on the number of applications managed through the platform, and sales go direct or through certified channels. For the six months after the raise, he listed two plans:

• scale operations, mainly in North America and EMEA
• onboard more Global 2000 companies

Tech Startups reported that the company was headquartered in New York with R&D in Israel.

Later company material still named the same two institutional backers. The October 29, 2025 Gartner announcement described Orchid as backed by Intel Capital and Team8. The boilerplate on the February 5, 2026 Identity Audit release used the same wording. On our reading, these sources show no round after the seed, though they do not rule one out.

Customers, partners and public evidence

Most of the public evidence on Orchid's customers comes from Orchid itself. Its customer stories page carries attributed quotes and lists case studies and videos. One video is titled "Automated Onboarding: How Costco expects to reduce services spend by 80%".

The Costco case study, also published by Orchid, gave the most detail. It said Costco's first investment, in 2022, was an Identity Governance and Administration (IGA) tool, and that Orchid was brought in to get more applications into that tool faster. The story said the automation promises to speed the on-boarding process from an average of 4 weeks to just 1. It also listed interaction with ticketing and workflow tools, like ServiceNow or Jira.

Other named customers appear on the same page. David Corral, Global Head of Cybersecurity Architecture, Repsol, is quoted saying Orchid can "automatically extract the IAM controls for each application- something that has been a traditional blind spot for us". Jeremy Embalabala, CISO at HUB International, is quoted noting that HUB integrated 200+ new acquisitions. ISS is quoted on the friction of manually onboarding applications from so many different countries. Orchid's ISS World story adds the scale: the services group, whose origins go back to 1901, at its peak employed more than 500,000 people in 50 countries, and its CISO, Martin Petersen, describes 1400+ applications in 30 different countries as the estate Orchid is being rolled out across.

Shannon Wilkinson, CIO and CISO at Findlay Automotive Group, told Help Net Security that her team must "know what the identities are doing."

On partnerships, a company blog post announced that Orchid had joined the SailPoint Technology Alliance Partner ecosystem. Help Net Security reported that Orchid had expanded its integration ecosystem with Palo Alto Networks Idira, described as a certified PAM integration, and with Splunk Enterprise Security through a prebuilt integration that streams identity telemetry to the SOC. Other vendors in these categories are listed in our vendor directory.

Gartner has now named Orchid twice. The company said it was named a Cool Vendor in the 2025 Gartner Cool Vendors in Identity-First Security report, a report the release dated 24 October 2025. On March 17, 2026 it announced that Gartner had listed it as a Representative Vendor in the Market Guide for Guardian Agents, dated 25 February 2026, as a vendor "managing the identities/access for AI agents with zero-trust policies and governance."

Katmor told AlleyWatch that customers had cut application onboarding time by 90%, reduced professional services costs by 75% and increased identity security posture by 83%. Orchid's own research claimed that as much as 46% of enterprise identity activity occurs outside centralized identity and access management (IAM) visibility. It also claimed its Identity Gap 2026 found that 57% of enterprise identity is unseen and unmanaged. The Identity Audit release included comment from Lawrence Pingree, head of data security and AI research at Software Analyst Cyber Research. None of these figures was published as an independent benchmark.

Research, open source and public work

Orchid's public output is mostly company research released through its own press materials and blog, rather than open-source code. The sources given here show no open-source tools, public benchmarks or vulnerability disclosures from the company.

Findings from early deployments. The February 2026 Identity Audit release, covered earlier, carried a set of findings the company attributed to its own customer work. It stated that "across initial deployments" it found that 85% of applications had accounts from legacy or external domains, and that 20% of those were consumer email domains. It reported that 70% of applications had excessive access privileges, with 60% granting broad admin or API access to external third parties. It also said 40% of all accounts across applications were orphaned, reaching 60% in some cases (Orchid). The release did not publish a sample size or method. The same release cited the company's earlier identity gaps analysis, and its later Identity Gap 2026 figure has already been noted in this profile.

Argument pieces on the blog. Tal Herman, Orchid's chief product officer, used the SailPoint partnership post to argue that governance only reaches applications that have been onboarded. She wrote that "you can have excellent governance over 70% of your identity estate and still have absolutely no idea what is happening in the other 30%." Later posts in the blog index carried the same theme into AI agents. They include "AI Agents Found the Identity Shortcuts. Now Enterprises Need to Close Them." by Herman, "AI Readiness Starts With Identity: The Gaps Autonomous Agents Will Find" by Robert Wiseman, and "PHP2Shell: AI Found the Cracks. Do You Know What's Behind the Walls?" by Roy Katmor.

The Identity Gap: 2026 Snapshot. On May 19, 2026 Orchid released a larger study, based on anonymized telemetry collected from enterprise applications deployed across North America and Europe between April 2025 and March 2026, in financial services, healthcare, retail, manufacturing and energy. Its headline: invisible identity, which Orchid calls identity dark matter, now outweighs visible identity across enterprise environments, 57% to 43%. The report itself breaks that down. It found that 57% of applications are not directly integrated with a secure identity provider, that 67% of non-human accounts are authenticated and authorized inside the application with no directory or IdP behind them, and that 70% of applications are overprivileged. Orphan accounts, active accounts for people no longer in HR systems, made up 40% of all identities, and 36% of applications held cleartext credentials in a configuration file. It also reported more than 1,000 confirmed, currently active accounts across Orchid's customers whose credentials are exposed on the dark web.

The chart sets out the report's main percentages.

Chart data: Orchid Security, The Identity Gap: 2026 Snapshot.

Downloadable material. The company page offers a solution brief built around its "identity dark matter" framing. The GRC use-case page offers an audit playbook. The incident response page links to a case study on incident response at a financial services customer.

Appearances in third-party work. Katmor was quoted in the CyberMadness: Motion & Tailwinds Report 2025-2026, which its authors described as a thought-leadership report built on the research work of the SACR and Deutsch & Co teams. His quoted line was: "The unseen dark matter of identity is overtaking what organizations can manage or even see." On our reading, the term "identity dark matter" is the thread that runs through nearly all of this output, from the deployment findings to the blog posts. For more vendor-authored studies across the field, see /reports.

What a CISO should ask before buying

This list is our reading: questions a CISO could put to Orchid Security during a proof of concept, each tied to something the company says it does. None of it is a verdict on the product.

1. What does the deployment actually touch? The company said its analysis runs "all without requiring access to or changes in the application code." The Costco story describes a service that will "passively identify applications with native identity controls that are installed on each host". Ask what runs on each host, with what privileges, and who patches it.

2. Can it find what you already know is hidden? The platform page states that Orchid "continuously inventories SaaS, legacy, home-grown, and shadow applications". Seed the test with a few applications your team knows sit outside IAM and see whether they surface.

3. How accurate are the code-level findings? The company says its AI flags issues by "Identifying weak encryption, hardcoded credentials, and missing controls". Plant known flaws in a test application and count misses and false positives.

4. Will your auditor accept the evidence? The GRC page says Orchid will "map gaps directly to frameworks like SOX, PCI, HIPAA, GDPR, and NIS2". Hand a sample report to your external auditor before signing.

5. Can you see why the model reached each conclusion? Roy Katmor said the models "provide clear justifications". Ask to see the justification for individual findings. Ask which model processes your data, and where it does so.

6. How is runtime telemetry gathered from unmanaged apps? Identity Audit, the company says, surfaces activity "including logins (successful or not), logouts, Joiner/Mover/Leaver changes, and more." Ask how this works for an application with no usable logs, and what the overhead is.

7. Which HR source decides who owns an account? Orphaned accounts are confirmed by "correlating them with existing IAM and HR systems to confirm ownership". Test this against your own HR feed, contractors included.

8. How is an agent's "intended purpose" defined? The September 2026 announcement listed "Continuous drift detection between an agent’s intended purpose and observed behavior". Ask who writes that baseline and how it is kept current.

9. What happens when the kill switch fires? The company listed actions including "revoking credentials, disconnecting tools, suspending workflows or uniquely activating its own application-level kill-switch." Trigger one in staging. Ask what approval gates exist and how a mistaken action is rolled back.

10. How does it apply modern protocols to legacy apps? The IAM page says Orchid can "apply modern standards without changing application code." Ask what sits in the authentication path, and whether that path fails open or closed if the component goes down.

11. What counts as one application on the invoice? Katmor said "The business model is based on the number of applications managed". Ask how instances, environments and discovered shadow apps are counted.

Timeline

This timeline lists the dated milestones in the sources, from January 2025 to September 2026. Most entries come from Orchid's own releases and one trade article. The busiest stretch was the third quarter of 2026, when a single announcement covered three separate items.

The chart counts the dated milestones in this timeline by quarter, with three of the nine falling in the third quarter of 2026.

Chart data: Milestones cited in this profile; most from Help Net Security: Orchid Security targets AI agent risk with drift detection and kill switches - Help Net Security.

• January 2025. Orchid announced a $36 million seed round. Tech Startups reported that the round marked the company's emergence from a year in stealth.

• October 2025. Orchid announced that Gartner had included it in the "Cool Vendors in Identity-First Security" report, dated 24 October 2025, according to the company's release.

• February 5, 2026. Orchid unveiled Identity Audit, which the company described as "the industry’s first complete picture of identity activity". The same release said that as much as 46% of enterprise identity activity occurs outside centralized IAM visibility.

• March 17, 2026. Orchid announced that Gartner had listed it as a Representative Vendor in the Market Guide for Guardian Agents.

• May 19, 2026. Orchid released The Identity Gap: 2026 Snapshot, its telemetry study of identity outside IAM control.

• May 28, 2026. Orchid extended its Identity Control Plane with delegation-aware identity enrichment, chain-of-delegation audit, and its own graph-native chatbot for AI agent adoption; Help Net Security later covered the same enhancements.

• September 2026. The release also listed a prebuilt Splunk Enterprise Security integration. Orchid says it streams identity telemetry to the SOC for correlation, investigation and incident response.

Read as a sequence, the entries move from funding and analyst mention in 2025 toward agent controls and connections to existing PAM and SOC tools in 2026. The dates follow the release or publication date on each page, not the date a capability reached any customer. A buyer checking availability should ask which of the September 2026 items were generally available and which were limited to early deployments. For other companies on our record in identity governance, identity threat detection and non-human identity security, see the vendor directory.