METHOD

Assessment method: how we score identity tools on reach

The short answer

We score eight identity tools from 0 to 10 on eight weighted criteria, using only their public pages and documentation, vendor facts read in September 2026, updated 2026-10-13. Totals are computed in code from the weights on this page. We did not test the products.

By The Credential Desk · IAM Compared · Published 2026-10-08

What does the reach score measure?

How far a tool, as described in its own public material, reaches into the applications and accounts that an identity provider and an IGA platform do not cover, and what it does with what it finds. It is not a measure of overall product quality.

It answers one buying question: which tool helps you see and control the applications and accounts your identity provider and IGA platform do not cover. A tool can be excellent at governance inside its connected estate and still score modestly here.

Which criteria and weights do we use?

The eight criteria of the reach score. Weights sum to 100.
Code	Criterion	Weight	Question
DISC	Unmanaged app discovery	18%	Does the tool find applications nobody connected to the IdP or IGA: shadow SaaS, on-prem, legacy and custom-built apps?
INAPP	Accounts inside the app	16%	Does it see local accounts, orphaned and dormant accounts, and app-native permissions inside each application, not only the accounts the IdP issued?
NOAPI	Reach into apps without APIs or SCIM	14%	How does it collect account data from, and act on, applications with no connector, no SCIM endpoint and no modern API?
ORCH	Orchestrates through the existing stack	14%	Does it feed findings and actions into the IdP, IGA, PAM and ITSM tools already in place, rather than requiring you to replace them?
EXEC	Executes changes itself	12%	Does the product itself provision, change and revoke access, or does it hand that work to another system?
NHI	Machine, service and agent accounts	10%	Does it document coverage of service accounts, hardcoded credentials, workload identities and AI agents?
EVID	Audit evidence	10%	Does it keep an audit trail and produce evidence mapped to SOX, PCI, HIPAA, NIS2 or similar frameworks?
PRICE	Pricing transparency	6%	Can a buyer see a price and model cost before a sales call?

Why these weights?

Discovery carries the most weight (18%) because you cannot govern an application you do not know exists. Accounts inside the app (16%) come next, because local and orphaned accounts are what survive an offboarding in the IdP. Reach into apps without APIs (14%) and orchestration through the existing stack (14%) decide whether findings turn into control without replacing tools you already paid for. Execution (12%) matters because something has to revoke the access, but most buyers already own a system that can. Machine and agent accounts (10%) and audit evidence (10%) are growing requirements. Pricing transparency (6%) matters for budgeting but says nothing about reach. No weight is above 30%.

How is a total calculated?

Total = sum of (criterion score × weight) ÷ 100. Scores run from 0 to 10 in steps of 0.1. Totals are shown to two decimals; tools with the same shown total share a rank. Nothing is hand-typed: every table, rank and winner is generated from one data file.

Orchid Security: 9.5×18 + 9.0×16 + 9.0×14 + 9.5×14 + 4.5×12 + 7.5×10 + 8.5×10 + 6.0×6 = 824.0 ÷ 100 = 8.24

What does the rosette show?

Each tool's rosette has eight equal sectors, one per criterion, running clockwise from the top in the order of the table above. The length of each engraved sector is that criterion's score from 0 to 10, not the weighted contribution. Because every sector has the same width, the rosette shows the shape of a tool's reach; the weighted total sits in the centre.

DISC: Unmanaged app discovery; 9.5
INAPP: Accounts inside the app; 9.0
NOAPI: Reach into apps without APIs or SCIM; 9.0
ORCH: Orchestrates through the existing stack; 9.5
EXEC: Executes changes itself; 4.5
NHI: Machine, service and agent accounts; 7.5
EVID: Audit evidence; 8.5
PRICE: Pricing transparency; 6.0

Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.

What counts as evidence?

A capability counts only if the vendor's own product page, documentation, pricing page, press release or official blog describes it. Every score links the pages used.
Where a vendor does not publish something, we write Not published or Not documented and score conservatively. Absence from the pages we read is not proof that a capability is missing.
Vendor figures, such as onboarding-time reductions or report percentages, are quoted as the vendor's statement and never used as our finding.
We do not use user reviews, star ratings, analyst rankings or vendor-supplied benchmarks as score inputs.
Pages read in September 2026 are marked with their read date (27 or 29 September); facts added on 11 October 2026 are marked Read 11 Oct 2026.

Which tools are in scope, and which are not?

We scored tools whose public pages describe discovering, governing or acting on accounts in applications. Identity providers appear only where they sell a governance product that reaches apps outside sign-on (Microsoft Entra ID Governance). We reviewed Okta Identity Governance, Silverfort, Push Security and Idira (Palo Alto Networks, formerly the CyberArk brand) and did not score them; the rankings page gives the reason for each.

What are the limitations?

Public sources only. No hands-on testing, no vendor interviews, no access to private documentation or pricing. Vendor pages describe intended capability; real coverage depends on your applications and deployment. Facts can change after the read date shown next to each source. Treat every score as a starting point and confirm details with the vendor.

How do we handle corrections?

Send a correction through the contact page with the topic Correction to vendor information and a link to the public source. We check it against the vendor's page and update the data; totals recompute automatically.

Frequently asked questions

Did you test these products?

No. Scores come from desk research on public pages. Vendor figures are labelled as vendor statements.

Can a vendor pay to change its score?

No. Scores change only when a public source changes.

Can I use my own weights?

Yes. The coverage gap calculator re-weights the ranking and prints the formula it uses.