RANKINGS · SCORES 0 TO 10 · WEIGHTS PUBLISHED
IAM rankings 2026: identity tools scored on reach beyond the IdP and IGA
The short answer
Orchid Security leads at 8.24 out of 10, followed by Veza at 6.37. The ranking rewards finding and mapping what central identity tools miss, so discovery and orchestration tools rise and full IGA platforms fall; on execution alone, SailPoint Identity Security Cloud leads. Change the weights in the coverage gap calculator if your priority differs.
By The Credential Desk · IAM Compared · Published 2026-10-08
Desk research from public vendor pages and documentation read in September 2026, updated 2026-10-13. Editorial assessment; we did not test the products.
How do the eight tools rank?
Reach score (editorial assessment, 0 to 10)
| Rank | Tool | Layer | Reach score | Designation |
|---|---|---|---|---|
1 | Orchid Security | Discovery and orchestration layer | Discovery and in-app identity mapping for the unmanaged estate | |
2 | Veza | Access graph and governance | Entitlement-level view across 325+ integrations | |
3 | C1 (formerly ConductorOne) | Identity governance (IGA) platform | Shadow app detection and open-source connectors | |
4 | SailPoint Identity Security Cloud | Identity governance (IGA) platform | Deepest lifecycle execution, with agent and machine identity coverage | |
5 (tied) | Microsoft Entra ID Governance | Governance add-on to an identity provider | Published per-user price and documented on-prem connectors | |
5 (tied) | Saviynt | Identity governance (IGA) platform | One IGA platform that onboards disconnected apps | |
7 | Lumos | Identity governance (IGA) platform | Shadow IT analytics and HRIS-driven offboarding | |
8 | Apono | Just-in-time privileged access | Just-in-time privileged access for people, machines and AI agents |
How far a tool, as described in its own public material, reaches into the applications and accounts that an identity provider and an IGA platform do not cover, and what it does with what it finds. It is not a measure of overall product quality.
How does each tool score on each criterion?
| Tool | Discovery 18% | Inside the app 16% | No-API reach 14% | Orchestration 14% | Execution 12% | Machine and agent 10% | Evidence 10% | Pricing 6% | Total |
|---|---|---|---|---|---|---|---|---|---|
| Orchid Security | 9.5 highest in set | 9.0 highest in set | 9.0 highest in set | 9.5 highest in set | 4.5 lowest in set | 7.5 | 8.5 highest in set | 6.0 | 8.24 highest in set |
| Veza | 3.5 | 8.0 | 7.0 | 7.5 | 7.2 | 7.5 | 7.0 | 2.0 lowest in set | 6.37 |
| C1 (formerly ConductorOne) | 6.0 | 6.0 | 6.5 | 7.0 | 7.8 | 6.0 | 6.5 lowest in set | 3.0 | 6.30 |
| SailPoint Identity Security Cloud | 4.0 | 6.0 | 6.0 | 6.0 | 9.0 highest in set | 8.0 highest in set | 8.5 highest in set | 2.0 lowest in set | 6.21 |
| Microsoft Entra ID Governance | 3.5 | 5.5 | 6.5 | 5.0 lowest in set | 8.0 | 8.0 highest in set | 7.0 | 9.5 highest in set | 6.15 |
| Saviynt | 3.5 | 6.8 | 8.0 | 5.5 | 8.5 | 5.5 lowest in set | 8.5 highest in set | 2.0 lowest in set | 6.15 |
| Lumos | 6.0 | 6.2 | 5.0 | 7.0 | 8.0 | 6.0 | 7.0 | 2.0 lowest in set | 6.13 |
| Apono | 2.0 lowest in set | 3.0 lowest in set | 3.0 lowest in set | 6.0 | 7.0 | 8.0 highest in set | 6.5 lowest in set | 6.5 | 4.78 lowest in set |
Weights: Unmanaged app discovery 18, Accounts inside the app 16, Reach into apps without APIs or SCIM 14, Orchestrates through the existing stack 14, Executes changes itself 12, Machine, service and agent accounts 10, Audit evidence 10, Pricing transparency 6. Totals are computed in code from the scores and weights shown.
Orchid Security ranks 1 of 8. It is highest in set on Unmanaged app discovery, Accounts inside the app, Reach into apps without APIs or SCIM, Orchestrates through the existing stack and Audit evidence and below the criterion leader on Executes changes itself, Machine, service and agent accounts and Pricing transparency.
What shape is each tool's reach?
- Orchid Security
8.24 / 10
Orchid Security: reach score 8.24, rank 1 of 8, edition 8 October 2026. - Veza
6.37 / 10
Veza: reach score 6.37, rank 2 of 8, edition 8 October 2026. - C1 (formerly ConductorOne)
6.30 / 10
C1 (formerly ConductorOne): reach score 6.30, rank 3 of 8, edition 8 October 2026. - SailPoint Identity Security Cloud
6.21 / 10
SailPoint Identity Security Cloud: reach score 6.21, rank 4 of 8, edition 8 October 2026. - Microsoft Entra ID Governance
6.15 / 10
Microsoft Entra ID Governance: reach score 6.15, rank 5 (tied) of 8, edition 8 October 2026. - Saviynt
6.15 / 10
Saviynt: reach score 6.15, rank 5 (tied) of 8, edition 8 October 2026. - Lumos
6.13 / 10
Lumos: reach score 6.13, rank 7 of 8, edition 8 October 2026. - Apono
4.78 / 10
Apono: reach score 4.78, rank 8 of 8, edition 8 October 2026.
Sector codes, clockwise from the top
- DISC
- Unmanaged app discovery
- INAPP
- Accounts inside the app
- NOAPI
- Reach into apps without APIs or SCIM
- ORCH
- Orchestrates through the existing stack
- EXEC
- Executes changes itself
- NHI
- Machine, service and agent accounts
- EVID
- Audit evidence
- PRICE
- Pricing transparency
What does each vendor document outside the IdP?
The Outside-Estate Register, edition 2026.10
For each scored tool, what its own public pages say about six parts of the estate that an identity provider usually does not reach. We record the status and the page. Nothing here is tested: a blank means the pages we read do not describe it, not that the product cannot do it.
| Tool | Unsanctioned SaaS | On-prem and legacy apps | Custom-built apps | Local accounts in apps | Service accounts and hardcoded credentials | AI agents | Sources |
|---|---|---|---|---|---|---|---|
| Orchid Security | Documented Discovers SaaS and cloud applications, including unmanaged ones | Documented Discovers on-prem and legacy applications | Documented Discovers custom-built applications | Documented Local user activity and orphaned accounts inside apps; publishes an Orphan and Local Accounts report | Documented Hardcoded accounts and credentials detected | Partial Guardrails for autonomous identity listed as a use case; detail not reviewed | Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security: Orphan and Local Accounts report · Read 27 Sep 2026 |
| Veza | Not documented Discovery of unconnected SaaS not described | Documented The Open Authorization API imports authorization metadata from custom or on-premise apps | Documented Custom systems connect through OAA | Documented Reveals local accounts outside identity platforms | Partial Reveals machine and service accounts; hardcoded credentials not described | Partial Acquisition post frames the combined offer as an agent identity control plane | Source: Veza: Open Authorization API · Read 11 Oct 2026 · Source: Veza Lifecycle Management · Read 27 Sep 2026 · Source: Veza Access Reviews · Read 27 Sep 2026 · Source: Veza blog: ServiceNow completes acquisition · Read 27 Sep 2026 |
| C1 (formerly ConductorOne) | Partial Shadow app sign-up and login monitoring | Documented C1 Bridge for on-prem systems | Partial Open-source Baton connectors you can extend | Partial Find what offboarding missed | Not documented Not described on the pages reviewed | Partial Shadow AI Discovery listed | Source: C1: Shadow IT · Read 27 Sep 2026 · Source: C1 homepage · Read 27 Sep 2026 · Source: C1 Lifecycle · Read 27 Sep 2026 |
| SailPoint Identity Security Cloud | Not documented Automatic discovery of unconnected apps not described | Partial Integration templates and owner self-registration | Partial Integration templates | Not documented Orphan and local account discovery inside apps not described | Partial Entro Security acquisition: non-human identities, secrets and tokens | Documented Agentic Fabric generally available for AI and machine identities | Source: SailPoint blog: Application Management · Read 27 Sep 2026 · Source: SailPoint press release: Entro Security acquisition closed · Read 27 Sep 2026 · Source: SailPoint press release: SailPoint Identity Security · Read 27 Sep 2026 |
| Microsoft Entra ID Governance | Not documented Discovery of apps outside Entra not described in the governance docs reviewed | Documented ECMA connector host, LDAP and SQL for on-prem apps | Partial REST, SOAP and PowerShell connectors; CSV path otherwise | Partial Account discovery shows app users not matched to Entra users | Partial Workload identities priced and governed in Entra; hardcoded credentials in apps not described | Documented Entra Agent ID generally available | Source: Microsoft Learn: app provisioning · Read 27 Sep 2026 · Source: Microsoft Learn: governing an application's existing users · Read 27 Sep 2026 · Source: Microsoft Entra pricing · Read 27 Sep 2026 · Source: Microsoft Learn: Entra Agent ID for AI agents · Read 27 Sep 2026 |
| Saviynt | Partial A 2022 release note mentions enhanced application discovery; scope not detailed | Partial Disconnected-app onboarding; on-prem apps not named as such | Documented Custom-built application onboarding | Partial Usage modeling of accounts and entitlements | Partial CPAM auto-discovers Windows service accounts and Azure privileged accounts (2022 release note) | Partial Zuma AI identity security platform launched July 2026; agent detail not reviewed | Source: Saviynt blog: 2022 release wrap-up · Read 11 Oct 2026 · Source: Saviynt Identity Governance and Administration · Read 27 Sep 2026 · Source: Saviynt press release: Zuma launch · Read 27 Sep 2026 |
| Lumos | Partial Shadow IT surfaced in Identity Analytics | Partial Revocation across on-prem systems | Partial Revocation across custom apps | Partial Revocation across local accounts; dormant accounts surfaced | Not documented Not described on the pages reviewed | Partial MCP Governance for agent tool calls | Source: Lumos Identity Analytics · Read 27 Sep 2026 · Source: Lumos Lifecycle Management · Read 27 Sep 2026 · Source: Lumos blog: MCP Governance · Read 27 Sep 2026 |
| Apono | Not documented Discovery of unconnected SaaS not described | Not documented On-prem and legacy apps not described | Not documented Custom-built apps not described | Not documented Local accounts inside apps not described | Partial Just-in-time access for machines; hardcoded credentials not described | Documented Just-in-time access for AI agents and Agent Privilege Guard | Source: Apono homepage (re-read) · Read 11 Oct 2026 |
Which pairings can I read?
- Apono measured against C1 (formerly ConductorOne)
- Apono measured against Lumos
- Apono measured against Microsoft Entra ID Governance
- Apono measured against Orchid Security
- Apono measured against SailPoint Identity Security Cloud
- Apono measured against Saviynt
- Apono measured against Veza
- C1 (formerly ConductorOne) measured against Lumos
- C1 (formerly ConductorOne) measured against Microsoft Entra ID Governance
- C1 (formerly ConductorOne) measured against Orchid Security
- C1 (formerly ConductorOne) measured against SailPoint Identity Security Cloud
- C1 (formerly ConductorOne) measured against Saviynt
- C1 (formerly ConductorOne) measured against Veza
- Lumos measured against Microsoft Entra ID Governance
- Lumos measured against Orchid Security
- Lumos measured against SailPoint Identity Security Cloud
- Lumos measured against Saviynt
- Lumos measured against Veza
- Microsoft Entra ID Governance measured against Orchid Security
- Microsoft Entra ID Governance measured against SailPoint Identity Security Cloud
- Microsoft Entra ID Governance measured against Saviynt
- Microsoft Entra ID Governance measured against Veza
- Orchid Security measured against SailPoint Identity Security Cloud
- Orchid Security measured against Saviynt
- Orchid Security measured against Veza
- SailPoint Identity Security Cloud measured against Saviynt
- SailPoint Identity Security Cloud measured against Veza
- Saviynt measured against Veza
Which tools did we review but not score?
These products came up in our research. Each answers a different question from the one this ranking asks.
Okta Identity Governance
Access requests, certifications and entitlement management that require Okta Workforce Identity. Its pages describe governance of apps inside Okta and do not document discovery or governance of apps outside it, so it sits outside this question. Workforce suites are priced from $6 to $17 per user per month, with Identity Governance in suites priced on inquiry and a $1,500 annual minimum.
Source: Okta Identity Governance · Read 27 Sep 2026 · Source: Okta pricing · Read 27 Sep 2026
Silverfort
Runtime identity protection: universal MFA for legacy apps, command-line access and OT "with zero agents and zero code changes", identity threat detection and response, and AI agent discovery across Entra ID, Okta and the major clouds. It protects authentication rather than discovering and governing the accounts inside applications. No public price: pricing is based on organization size, across four packages (Core, Plus, Advanced, Enterprise), available on-prem, in the cloud or hybrid.
Source: Silverfort homepage · Read 29 Sep 2026 · Source: Silverfort: AI agent security · Read 29 Sep 2026 · Source: Silverfort pricing · Read 11 Oct 2026
Push Security
A browser extension that finds shadow SaaS and AI apps and "hidden login paths that bypass SSO", with phishing detection and MFA guardrails. Useful evidence of logins outside the IdP; it does not describe governing accounts inside applications. Standard plan (up to 500 employees): $5 per user per month on an annual contract, or $6 per employee per month billed monthly; Enterprise pricing on request.
Source: Push Security homepage · Read 29 Sep 2026 · Source: Push Security pricing · Read 11 Oct 2026
Idira (Palo Alto Networks, formerly the CyberArk brand)
Palo Alto Networks unveiled Idira on 12 May 2026 as its identity security platform and the upgrade path for CyberArk customers: privileged access with zero standing privilege and just-in-time access, workforce access, and machine and AI identity security, with no prices stated. Its Idira Identity Governance page describes robotic process automation to connect to applications that lack APIs, and the former zillasecurity.com domain redirects there. Governance scope and packaging could not be confirmed, so it is not scored.
Source: Palo Alto Networks press release: Idira · Read 11 Oct 2026 · Source: Orchid Security blog: Orchid and Idira · Read 11 Oct 2026 · Source: Palo Alto Networks: Idira Identity Governance · Read 27 Sep 2026
Frequently asked questions
Why is Okta Identity Governance not ranked?
Its pages describe governance of applications inside Okta and require Okta Workforce Identity. This ranking asks which tools reach applications outside the IdP, and Okta's pages reviewed do not document that, so it is listed under tools reviewed but not scored.
Why does a tool that does not provision access rank first?
Because the ranking measures reach into the unmanaged estate: discovery, accounts inside apps, no-API reach and orchestration carry 62% of the weight together. Execution carries 12%, and the tools that provision access themselves score higher there. The calculator lets you change the weights.
What does a tie mean?
Totals are shown to two decimals, and tools with the same shown total share a rank. Entra ID Governance and Saviynt are tied on default weights.
Read next
- Assessment method
Criteria, weights and limits
- Coverage gap calculator
Re-weight the ranking
- Set side by side
Compare two to five tools
- Identity classroom
Lessons on the unmanaged estate