Obsidian Security protects the SaaS applications enterprises depend on, and the AI agents, identities and third-party integrations that connect to them. Security teams use it to see who and what has access to their SaaS estate, keep those applications configured safely, detect account takeover and stop risky agent actions as they happen.
Its aim is to let companies adopt AI with guardrails rather than block it, which matters most where agents and integrations already hold more access to business data than most employees.
At A Glance
| Vendor | Obsidian Security |
|---|---|
| Category | SaaS and third-party app security, AI agent security, ITDR |
| Identities covered | Human users, privileged accounts, non-human identities, third-party integrations, AI agents |
| Deployment | SaaS platform with application integrations and a browser extension |
| Agentic AI | Agent visibility, agent governance, agent runtime security, MCP security |
| Customers | T-Mobile, Snowflake, S&P Global, Seagate, Databricks |
| Certifications | ISO/IEC 42001:2023 |
| Market classification | Identity Security Posture Management; also Identity Threat Detection & Response |
What Obsidian Security Does
With work spread across dozens of SaaS applications, there is no network perimeter left to defend. Identity, configuration and integrations have become the controls that matter, and AI agents now hold access of their own inside those same applications. Obsidian’s approach is to treat posture, threats and agent actions as one problem, built on a single shared view of identities, access and activity, so a risky configuration, a stolen session and an over-privileged agent can be seen in relation to each other rather than in separate tools.
Products
Third-Party App Security
Third-Party App Security is for teams that need to keep a growing SaaS estate safe without reviewing each application by hand.
- Posture management that fixes misconfigurations, removes high-risk integrations and watches for configuration drift
- Integration discovery with risk scores, flagging unapproved, new or inactive integrations
- Privileged account checks for controls such as MFA
- Identity threat detection and response that stops account takeover with inline defences against credential and session theft
- Supply chain security that blocks intrusions arriving through risky connected integrations
AI Security
AI Security covers the way employees use generative AI. It finds unsanctioned AI tools through discovery in the browser and blocks sensitive prompts before they leave it. The product groups AI-SPM, Shadow AI discovery, MCP Security, AI Prompt Security, GenAI Data Leakage and AI Threat Detection.
AI Agent Security
AI Agent Security is for organisations where agents built on platforms such as Amazon Bedrock, Microsoft Copilot or Salesforce Agentforce act inside business systems. It discovers agents across the enterprise, including shadow agents, and maps each one to its owner, tools, MCP servers, models and connected apps. Governance flags agents with excessive access and recommends right-sizing based on what each agent actually uses, and AI-SPM assesses agents against OWASP risk factors. Runtime detections act before an agent’s action executes, so high-risk actions can be stopped, with policies per agent, per team or across the organisation.
How It Works
| Component | What it does |
|---|---|
| Data Depth | The data layer collects third-party app and AI configurations, user activity, threat signals and browser telemetry. |
| Knowledge Graph | Identities, access and activity are correlated into a continuously updated map of risky identities, apps and pathways. |
| Detections | Self-learning models refine detections over time. |
| AI Assistant | Specialised agents investigate across the platform and suggest next steps. |
| Browser extension | The extension provides shadow AI discovery and prompt controls at the point of use. |
| Enterprise Trust | The service runs with automated failover, regional data hosting and segregation between customers. |
Identities And Systems Covered
| Human users | User activity, sessions and account takeover. |
|---|---|
| Privileged accounts | MFA and excess access checks. |
| Non-human identities and AI agents | Governed with the same model as human users. |
| Third-party integrations | Discovered and risk scored across connected apps. |
| SaaS applications | Google Workspace, GitHub, Microsoft 365, ServiceNow, Salesforce, Snowflake, Workday. |
| AI platforms | Amazon Bedrock, Microsoft Foundry, Anthropic Claude, n8n, Google Vertex AI, OpenAI, Microsoft Copilot, Salesforce Agentforce. |
Company Background
| Founded | 2017. |
|---|---|
| Headquarters | Southern California, United States. |
| Leadership | Hasan Imam (CEO), Khanh Tran (CPO) and Matt Wolff (Co-Founder and Chief AI Officer). |
| Funding | $90M Series C in 2023 backed by IVP, Norwest and GV; $85M Series D in August 2026 led by Crescent Cove Advisors, at a reported $1.1 billion valuation. |
| Scale | A reported 60 Fortune 500 customers. |
| Recognition | 2025 Deloitte Technology Fast 500 for North America. |
Note: This overview is compiled from Obsidian Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.