Torch Security is an identity governance company that brings hard-to-reach business applications into an organisation’s identity governance and administration (IGA) programme. Its product, Torch, is aimed at identity teams whose IGA tool covers modern SaaS but leaves out mainframes, thick desktop clients, homegrown tools and older SaaS that lack a usable API.
The aim is to extend an existing governance programme to every application rather than replace it, so audits, onboarding and offboarding no longer stop at the edge of what the IGA tool can reach.
At A Glance
| Vendor | Torch Security |
|---|---|
| Category | Identity governance and administration, application connectivity for IGA |
| Identities covered | Workforce user accounts and entitlements inside connected applications |
| Deployment | Connectors delivered to SailPoint, Saviynt, Microsoft Entra ID or the Torch platform |
| Agentic AI | AI connector generation and self-healing connectors |
| Customers | Ameris Bank, Paychex |
| Certifications | SOC 2 |
| Funding | Seed round, April 2024 |
What Torch Security Does
Most IGA programmes reach the applications with clean APIs and SCIM support quickly, then stall. The remainder, often banking cores, ERP systems, terminal-based mainframe apps and internal tools, stays outside governance, which means manual access reviews, spreadsheets and accounts nobody removes when people leave. The last fifth of applications tends to absorb most of the effort.
Torch’s approach is to automate the connector work itself. Once an application is connected, the same certification campaigns, joiner, mover and leaver workflows and business roles apply to it as to everything else.
Products
Identity Studio
Identity Studio is the connector framework underneath everything else. Building a connector for an application with no API has usually meant custom scripting or manual work, so Identity Studio builds one from whatever exists: documentation, screenshots, runbooks or existing scripts. A single workflow definition, such as creating an account, can run against a web admin console, a mainframe terminal over tn3270, a rich desktop client or an API. Finished connectors are delivered to the identity platform the customer already runs, turning applications that platform could not reach into governed ones.
Access Reviews And Certifications
Auditors expect evidence that access to every in-scope application has been reviewed, not only the ones the IGA happens to reach. Torch runs campaign-based access reviews with full audit evidence across all connected applications. Each campaign keeps its evidence trail, and organisations without a separate IGA product can certify access in Torch directly.
Joiner, Mover And Leaver
Lifecycle events are where orphaned and excessive access tends to build up in disconnected applications. Torch automates provisioning and deprovisioning when people join, change role or leave, and applies the same workflows to SaaS, mainframe and desktop applications alike.
Business Roles
Role modelling usually breaks down when half the entitlements live in systems the IGA cannot see. Torch lets teams model access by role, function or team, map entitlements once and reuse that mapping across every connected application.
How It Works
Torch follows a three-step process for each application, and connectors talk to the application through whichever interface it offers: browser, terminal, rich client or API.
| Component | What it does |
|---|---|
| Capture the app | Torch ingests the application’s documentation, APIs, screens and existing scripts to work out what governance hooks exist. |
| Generate the connector | Torch builds a working connector with test users and clear success criteria. The customer’s team reviews and approves it before anything reaches production. |
| Run and self-heal | Torch watches every connector in production and, when a schema changes or authentication drifts, uses AI to diagnose the break and propose a fix. AI handles “drift, recovery, and interfaces that move, never the decision about who gets access”, which stays with policy and human reviewers. |
| Execution model | The design is “deterministic by default, agentic at the edges”: predictable work follows fixed execution paths, and AI is used only where interfaces change. |
Identities And Systems Covered
Torch governs workforce user accounts and their entitlements inside business applications. Its sample connector library spans these application types:
| Vendor-managed SaaS | Applications with modern APIs, SCIM endpoints and MFA flows, such as Salesforce, HubSpot, Slack, Notion, Zoom, Box, Dropbox, Confluence, Anaplan and Dayforce. |
|---|---|
| Mainframe applications | Green-screen terminals and older authentication models, including IBM z/OS, RACF, IBM i (AS/400), CA ACF2 and HCL Notes. |
| Enterprise applications | ERP, HR, finance and GRC platforms such as SAP S/4HANA, Oracle NetSuite, Microsoft Dynamics 365, Workday, BambooHR, ADP, PeopleSoft and Coupa. |
| Banking platforms | FIS, Jack Henry, Fiserv DNA, Temenos T24, Finastra, nCino, MeridianLink, Broadridge and Loan IQ. |
| Vertical platforms | Cerner, Epic, Veeva, Yardi, Guidewire and ComplianceWire. |
| Windows client applications | Thick clients and desktop tools that never had an API, such as Bloomberg Terminal, Tableau Desktop and FactSet. |
| Developer, IT and data tools | GitHub, Jira, Jenkins, BMC, Boomi, Appian, Snowflake, Databricks, Google BigQuery, Amazon Redshift, Looker and dbt. |
| Homegrown applications | Internal tools and legacy systems, including undocumented ones. |
| AI tools | Claude, ChatGPT Enterprise, Microsoft Copilot, Gemini and Perplexity Enterprise. |
| Identity providers | OneLogin and Ping Identity. |
Integrations
| Area | Integrations |
|---|---|
| IGA platforms | SailPoint, Saviynt |
| Identity and directory targets | Microsoft Entra ID, Okta, Active Directory |
| IT service management | ServiceNow |
Company Background
| Founded | March 2024. |
|---|---|
| Leadership | Gal Ron (co-founder and CEO). |
| Locations | Engineering in Tel Aviv, Israel, and a US go-to-market team. |
| Funding | A seed round in April 2024, with TAU Ventures and UpWest named as investors. |
Note: This overview is compiled from Torch Security’s publicly available information as of 3 November 2026. It is provided for information only. NHI Mgmt Group does not endorse any vendor, and nothing on this page represents the opinions of NHI Mgmt Group.