Orchid Security leads the default ranking. This post exists so readers can see exactly how much of that result comes from the weights.
What question do the default weights answer?
Which tool helps you see and control the applications and accounts your identity provider and IGA platform do not cover. Four criteria carry that question: unmanaged app discovery (18%), accounts inside the app (16%), reach into apps without APIs (14%) and orchestration through the existing stack (14%). Together they are 62% of the weight. Execution, machine and agent accounts, evidence and pricing share the rest.
Why do the layers score so differently?
A discovery and orchestration tool is built for the first four criteria and hands execution to other systems, so it scores high on those and low on execution. A full IGA platform executes changes itself, reviews and records them, and often covers machine identities, but its pages tend not to describe finding applications nobody connected. The criterion table on the rankings page shows this row by row.
What happens under other weights?
The table below recomputes totals and ranks from the same scores under the default weights and three alternatives. It is generated from the site data when the page is built; nothing in it is typed.
| Tool | Default (published) | Equal weights | Governance-first | Platform buyer |
|---|---|---|---|---|
| Orchid Security | 8.24 (1) | 7.94 (1) | 7.43 (1) | 6.83 (3) |
| Veza | 6.37 (2) | 6.21 (3) | 6.64 (5, tied) | 6.29 (6) |
| C1 (formerly ConductorOne) | 6.30 (3) | 6.10 (5) | 6.64 (5, tied) | 6.22 (7) |
| SailPoint Identity Security Cloud | 6.21 (4) | 6.19 (4) | 7.10 (2) | 7.10 (2) |
| Microsoft Entra ID Governance | 6.15 (5, tied) | 6.63 (2) | 6.73 (4) | 7.60 (1) |
| Saviynt | 6.15 (5, tied) | 6.04 (6) | 7.01 (3) | 6.57 (4) |
| Lumos | 6.13 (7) | 5.90 (7) | 6.62 (7) | 6.16 (8) |
| Apono | 4.78 (8) | 5.25 (8) | 5.53 (8) | 6.38 (5) |
Default (published): discovery 18 · inapp 16 · noapi 14 · orchestration 14 · execution 12 · nhi 10 · evidence 10 · pricing 6
Equal weights: discovery 12.5 · inapp 12.5 · noapi 12.5 · orchestration 12.5 · execution 12.5 · nhi 12.5 · evidence 12.5 · pricing 12.5
Governance-first: discovery 10 · inapp 10 · noapi 10 · orchestration 10 · execution 30 · nhi 5 · evidence 20 · pricing 5
Platform buyer: discovery 5 · inapp 5 · noapi 5 · orchestration 0 · execution 30 · nhi 20 · evidence 20 · pricing 15
How should you read it?
- Equal weights treat every criterion as equally important. Use it as a reference point, not a recommendation.
- Governance-first puts execution at 30% and evidence at 20%, as a buyer replacing an IGA might.
- Platform buyer puts execution, machine and agent accounts, evidence and pricing first and gives orchestration no weight, as a buyer who wants one platform to do everything might.
Under the last set the order changes substantially: tools that execute changes and publish prices rise, and tools that depend on feeding other systems fall.
So which ranking is right?
The one that matches your question. If your problem is the part of the estate you cannot see, the default weights describe it. If your problem is replacing a governance platform, the governance-first or platform-buyer weights are closer. The coverage gap calculator lets you set your own weights and keeps the formula on the page.
Sources
Source: Orchid Security homepage · Read 27 Sep 2026
Source: SailPoint Identity Security Cloud · Read 27 Sep 2026
Source: Microsoft Entra pricing · Read 27 Sep 2026