Orchid Security builds an identity security platform for organisations whose applications sit outside their central identity programme. It finds every application in the estate, works out how each one handles authentication and authorisation, and then brings the unmanaged ones under the IAM, IGA and PAM tools the organisation already runs.
The platform covers human, machine and AI agent identities across SaaS, on-premises, legacy, custom and shadow applications, and it keeps an audit trail of what it found and what was changed.
At A Glance
| Vendor | Orchid Security |
|---|---|
| Category | Identity-first security orchestration |
| Identities covered | Human, machine and agentic AI identities |
| Agentic AI | Agent enrichment, observability and guardrails, drift detection, kill switches |
| Customers | ISS, Costco, HUB International, Repsol, Findlay |
| Certifications | SOC 2, ISO 27001, ISO 27701, HIPAA, GDPR |
| Market classification | NHI Platforms & Machine Identity |
What Orchid Security Does
In most enterprises a large share of identity logic lives inside individual applications. It is often undocumented, and the central identity team cannot see it. Orchid closes that gap. It continuously discovers self-hosted and SaaS applications, reviews the login and permission flows in each one, flags exposures and recommends fixes without any change to application code.
Large language models do the analysis work, reading each application’s identity logic and explaining the reasoning behind their conclusions, and the existing identity stack stays in charge of enforcement.
Products
Orchid Platform
The platform is built around four stages that follow an application from discovery to audit.
| Discover | A continuous inventory of applications and identities, with risk analysis to decide which exposures to deal with first |
|---|---|
| Analyze | Review of authentication and authorisation logic for weak encryption, hardcoded credentials and missing controls, shown in a visual identity graph with posture trends |
| Orchestrate | Policy enforcement and automated remediation carried out through existing identity tools |
| Audit | Records of discoveries, policies and actions, with exportable data and framework-aligned reporting |
For an IAM team trying to onboard hundreds of applications, or an acquirer absorbing another company’s estate, this turns a manual application-by-application review into a repeatable process.
Identity Audit
Identity Audit gives security and compliance teams visibility of identity activity that happens inside applications and never reaches the central directory. It helps auditors and incident responders see who actually did what in systems that were previously opaque.
AI Readiness Controls
These controls help organisations decide which applications are ready for AI agents before agents are let loose on them. They tag applications and access paths that are not yet safe for agentic access and surface identity hygiene findings, so platform owners can fix the gaps first.
How It Works
Orchid connects to the organisation’s applications and identity tools and runs its analysis without changes to application code. Discovery runs continuously, so new and shadow applications join the inventory as they appear, and the results of each analysis feed the identity graph. When remediation is needed, Orchid orchestrates it through the IAM, IGA and PAM systems already in place, so those systems stay the point of enforcement. Evidence of every discovery, policy and action is kept for reporting aligned to NIST, ISO, SOX, GDPR, PCI, HIPAA and NIS2.
Identities And Systems Covered
| Human identities | Workforce accounts across applications, including orphaned, dormant and over-permissioned accounts |
|---|---|
| Machine identities | Discovered automatically alongside human accounts, with hardcoded credentials flagged during application analysis |
| AI agents | Mapped to their originating identity, owner, application and inherited permissions |
| Privileged accounts | Privileged accounts that the PAM system does not yet know about |
| Applications | SaaS, on-premises, legacy, home-grown, custom and shadow applications |
Agentic AI Capabilities
Agent Governance In The Identity Control Plane
Orchid’s Identity Control Plane extends to AI agents. Agentic Enrichment links each agent back to the human or system identity it acts for. Agentic Observability traces “the full chain of delegation behind each action”, so a security team can follow an agent’s action back to the person who started it. Agentic Guardrails apply least privilege and identity hygiene to keep agents within defined bounds.
Drift Detection And Kill Switches
The AI readiness controls also compare an agent’s intended purpose with what it actually does, and raises drift when the two diverge. Application-level kill switches let teams stop a misbehaving agent by cutting its permissions, revoking credentials, disconnecting tools or pausing workflows. These controls are generally available.
Integrations
| Area | Integrations |
|---|---|
| IGA | SailPoint (certified orchestration), Saviynt |
| PAM | CyberArk, Palo Alto Networks Idira (certified integration) |
| IAM | Microsoft |
| Security operations | Splunk Enterprise Security, SentinelOne |
Company Background
| Leadership | Roy Katmor (co-founder and CEO), Robert Wiseman (co-founder) and Tal Herman (CPO) |
|---|---|
| Funding | A $36 million seed round co-led by Team8 and Intel Capital, with Capital One participating, in 2025 |
| Recognition | Included in Gartner Cool Vendors in Identity-First Security (2025) and Gartner research on Guardian Agents |
Note: This overview is compiled from Orchid Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.