Orchid Security and SailPoint: what a discovery-to-governance partnership changes

This post describes what both vendors published and scores nothing new.

What was announced?

On 23 August 2026 Orchid Security announced that it had joined the SailPoint Technology Alliance Partner ecosystem. In the announcement "SailPoint provides the governance engine", while Orchid discovers app-layer accounts, roles, permissions and authentication methods and provides that context to onboard applications into SailPoint IGA. The exact data-transfer mechanism is not stated.

Why does the pairing make sense on paper?

The two products sit in different layers. SailPoint Identity Security Cloud is a governance platform: it automates joiner, mover and leaver changes, runs certification campaigns and collects audit evidence for the applications connected to it. Its Application Management add-on helps owners register applications and offers integration templates, and SailPoint states it reduced application onboarding time by 45-70%, a vendor figure. What its pages do not describe is automatic discovery of applications nobody has registered.

Orchid Security describes the opposite emphasis. It states that it discovers SaaS, cloud, on-prem, legacy and custom-built applications, maps how identity actually works inside them, and brings them under IAM, IGA, PAM and audit control. It does not describe itself as a provisioning engine. Our pair page shows the split criterion by criterion, computed from the scores: the discovery-side criteria on one side, execution and identity-type coverage on the other.

What does it change for a SailPoint customer?

If the announcement works as described, a SailPoint customer gets a route for applications that never reached SailPoint: Orchid finds them and the accounts inside them, and SailPoint governs what is handed over. That matters most where the unknown part of the estate is large, such as after an acquisition or in an organization with many custom-built applications.

What does the announcement leave open?

The pages we read describe the division of labor, not the mechanics. Before relying on it, ask both vendors:

1. What exactly moves from Orchid to SailPoint: application records, account lists, ownership, risk findings?
2. Does a discovered application become a SailPoint source automatically, or does someone onboard it?
3. Who closes the loop when SailPoint revokes access in an application Orchid found, and how is that recorded for audit?
4. Which licences are needed on each side? Orchid lists one package on AWS Marketplace and SailPoint lists suites without prices.

Is there a more detailed hand-off to compare?

Yes. On 2 August 2026 Orchid described its integration with Idira Privilege Cloud: Orchid reports the privileged accounts it finds to Idira's Discovered Accounts queue, with Orchid as the source, and states that it does not send credential values, secrets or session data or write to the vault. That is the level of detail worth asking for on the SailPoint side.

Does it change any score?

No. Partnership announcements count only where they change what a vendor documents. The Orchestrates through the existing stack criterion already credits Orchid's named integrations, and SailPoint's orchestration reason mentions partnering with discovery vendors. Both currently rank where the rankings show: Orchid Security 1 of 8 and SailPoint 4 of 8.

The wider pattern

SailPoint also made Agentic Fabric for AI and machine identities generally available on 4 August 2026. Read together, the two announcements show a governance platform extending to new identity types and partnering for discovery, rather than building every layer itself. Buyers who already run an IGA should expect more of these pairings and should evaluate the hand-off, not only each product.

Sources