TOOL PROFILE · DISCOVERY AND ORCHESTRATION LAYER

Orchid Security review 2026: how far it reaches into unmanaged apps

The short answer

Orchid Security ranks 1 of 8 on our reach score at 8.24 out of 10. It documents discovery of unmanaged SaaS, on-prem, legacy and custom-built applications and of the local accounts, hardcoded credentials and authentication paths inside them, and it feeds that context to the IAM, IGA and ticketing tools already in place. It does not provision access itself, and its only listed price is one AWS Marketplace package.

By The Credential Desk · IAM Compared · Published 2026-10-08

Desk research from public vendor pages and documentation read in September 2026, updated 2026-10-13. Editorial assessment; we did not test the products.

Rank 1 of 8 on default weights

Discovery and in-app identity mapping for the unmanaged estate

Change the weights in the coverage gap calculator

What shape is Orchid's reach?

DISC: Unmanaged app discovery; 9.5
INAPP: Accounts inside the app; 9.0
NOAPI: Reach into apps without APIs or SCIM; 9.0
ORCH: Orchestrates through the existing stack; 9.5
EXEC: Executes changes itself; 4.5
NHI: Machine, service and agent accounts; 7.5
EVID: Audit evidence; 8.5
PRICE: Pricing transparency; 6.0

Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.

What does Orchid do?

Discovers unmanaged applications, maps how identity works inside them, and feeds that context to the IAM, IGA, PAM and ticketing tools already in place.

What it says it does: "discovers unmanaged applications, maps how identity actually works inside them, and brings them under IAM, IGA, PAM, and audit control"; Source: Orchid Security homepage · Read 27 Sep 2026
Application types: SaaS, cloud, on-prem, legacy and custom-built applications, discovered automatically.; Source: Orchid Security homepage · Read 27 Sep 2026
Findings inside apps: Local user activity, hardcoded accounts and credentials, shadow authentication paths and privilege drift.; Source: Orchid Security homepage · Read 27 Sep 2026
Platform capabilities: Discover, Analyze, Orchestrate and Audit, with "a living identity audit trail across managed and unmanaged systems".; Source: Orchid Security platform page · Read 27 Sep 2026
Named integrations: Microsoft, Saviynt, SentinelOne, CyberArk and SailPoint on the homepage; ServiceNow and Jira ticketing in the Costco story.; Source: Orchid Security homepage · Read 27 Sep 2026
Partnership: Joined the SailPoint Technology Alliance Partner program, announced 23 August 2026: Orchid discovers and analyzes, SailPoint governs.; Source: Orchid Security blog: SailPoint partnership · Read 27 Sep 2026
Audit frameworks: Reports aligned to SOX, PCI, HIPAA, GDPR and NIS2.; Source: Orchid Security: GRC and audit use case · Read 27 Sep 2026
Certifications listed: HIPAA, SOC 2, GDPR, ISO 27001, ISO 27701.; Source: Orchid Security homepage · Read 27 Sep 2026
Use cases listed: IAM programs, GRC and audit, incident response teams, M&A and growth events, guardrails for autonomous identity.; Source: Orchid Security homepage · Read 27 Sep 2026
Company: Founded by Roy Katmor, Robert Wiseman and Ido Kelson; incubated at Team8.; Source: Orchid Security company page · Read 27 Sep 2026
Funding: $36 million seed round co-led by Team8 and Intel Capital, with CapitalOne support, announced in January 2025.; Source: Orchid Security press release: introducing Orchid Security · Read 11 Oct 2026
Customers named: Costco and Repsol, in Orchid's seed announcement.; Source: Orchid Security press release: introducing Orchid Security · Read 11 Oct 2026
SailPoint hand-off: "SailPoint provides the governance engine"; Orchid provides app-layer accounts, roles, permissions and authentication methods as context to onboard apps into SailPoint IGA. The data-transfer mechanism is not stated.; Source: Orchid Security blog: SailPoint partnership (re-read) · Read 11 Oct 2026
Idira Privilege Cloud: Orchid reports privileged accounts it finds to the Discovered Accounts queue in Idira Privilege Cloud, and does not send credential values, secrets or session data or write to the vault (blog, 2 August 2026).; Source: Orchid Security blog: Orchid and Idira · Read 11 Oct 2026

What does Orchid state about itself?

Vendor states

Identity dark matter hides in applications. Orchid makes it visible, governable, and measurable.

Source: Orchid Security homepage · Read 27 Sep 2026

Vendor figure. Not measured by IAM Compared.

Vendor states

67% of non-human accounts are created directly within applications (Identity Gap: 2026 Snapshot, based on anonymized telemetry from enterprise applications in North America and Europe, April 2025 to March 2026).

Source: Orchid Security: Identity Gap 2026 Snapshot announcement · Read 27 Sep 2026

Vendor figure. Not measured by IAM Compared.

Which parts of the estate does Orchid document?

Unsanctioned SaaSDocumented
Discovers SaaS and cloud applications, including unmanaged ones
Source: Orchid Security homepage · Read 27 Sep 2026
On-prem and legacy appsDocumented
Discovers on-prem and legacy applications
Source: Orchid Security homepage · Read 27 Sep 2026
Custom-built appsDocumented
Discovers custom-built applications
Source: Orchid Security homepage · Read 27 Sep 2026
Local accounts in appsDocumented
Local user activity and orphaned accounts inside apps; publishes an Orphan and Local Accounts report
Source: Orchid Security: Orphan and Local Accounts report · Read 27 Sep 2026
Service accounts and hardcoded credentialsDocumented
Hardcoded accounts and credentials detected
Source: Orchid Security homepage · Read 27 Sep 2026
AI agentsPartial
Guardrails for autonomous identity listed as a use case; detail not reviewed
Source: Orchid Security homepage · Read 27 Sep 2026

How does Orchid score on each criterion?

Criterion scores for Orchid Security, with badges computed against all 8 tools.
Criterion	Weight	Score	Why	Source
Unmanaged app discovery	18%	9.5 / 10 Highest in set	States it discovers SaaS, cloud, on-prem, legacy and custom-built applications automatically, including unmanaged ones.	Source: Orchid Security homepage · Read 27 Sep 2026
Accounts inside the app	16%	9.0 / 10 Highest in set	Maps how identity works inside each application and surfaces local user activity, orphaned accounts, shadow authentication paths and privilege drift.	Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security: Orphan and Local Accounts report · Read 27 Sep 2026
Reach into apps without APIs or SCIM	14%	9.0 / 10 Highest in set	Describes bringing unmanaged on-prem, legacy and custom-built applications under IAM, IGA, PAM and audit control; the collection method is not detailed on the pages reviewed.	Source: Orchid Security homepage · Read 27 Sep 2026
Orchestrates through the existing stack	14%	9.5 / 10 Highest in set	Feeds identity context into the IAM, IGA, PAM and ITSM tools in place: names Microsoft, SailPoint, Saviynt and CyberArk, ServiceNow and Jira ticketing, a SailPoint partnership since August 2026, and reports privileged accounts to the Discovered Accounts queue in Idira Privilege Cloud.	Source: Orchid Security: IAM programs use case · Read 27 Sep 2026 · Source: Orchid Security: Costco story · Read 27 Sep 2026 · Source: Orchid Security blog: SailPoint partnership · Read 27 Sep 2026 · Source: Orchid Security blog: Orchid and Idira · Read 11 Oct 2026
Executes changes itself	12%	4.5 / 10 Lowest in set	Does not describe itself as a provisioning engine; provisioning and revocation run in the IGA, IdP or ticketing tool it feeds.	Source: Orchid Security: IAM programs use case · Read 27 Sep 2026
Machine, service and agent accounts	10%	7.5 / 10	Detects hardcoded accounts and credentials and lists guardrails for autonomous identity as a use case; dedicated agent identity features are not detailed.	Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security: Identity Gap 2026 Snapshot announcement · Read 27 Sep 2026
Audit evidence	10%	8.5 / 10 Tied highest	Continuous, application-level identity evidence mapped to SOX, PCI, HIPAA, GDPR and NIS2; every discovery, policy and action recorded.	Source: Orchid Security: GRC and audit use case · Read 27 Sep 2026 · Source: Orchid Security platform page · Read 27 Sep 2026
Pricing transparency	6%	6.0 / 10	Lists one package on AWS Marketplace (Orchid Fundamental, 30 applications, $250,000.00 per 12 months); other terms by private offer; no pricing page on its own site.	Source: AWS Marketplace: Orchid Security · Read 11 Oct 2026 · Source: orchid.security/pricing (returns 404) · Read 11 Oct 2026

Where does Orchid lead, and where does it trail?

Leads or ties the set on

Unmanaged app discovery
Accounts inside the app
Reach into apps without APIs or SCIM
Orchestrates through the existing stack
Audit evidence

Trails the leader on

Executes changes itself: 4.5 against SailPoint at 9.0
Pricing transparency: 6.0 against Entra ID Governance at 9.5
Machine, service and agent accounts: 7.5 against SailPoint, Entra ID Governance and Apono at 8.0

Strengths on its public pages

Documents discovery of applications nobody connected, across SaaS, on-prem, legacy and custom-built apps, and maps the accounts and authentication paths inside each one.
Built to sit beside the IdP, IGA and PAM tools already in place, with named integrations and a SailPoint partnership since August 2026.

Limits on its public pages

It does not provision or revoke access itself; that work runs in the IGA, IdP or ticketing system it feeds.
Its only listed price is one AWS Marketplace package (30 applications, $250,000.00 per 12 months); other terms are by private offer, and whether the platform can run on-prem is not stated.

What does Orchid cost, and how is it deployed?

Pricing

AWS Marketplace, 12-month contract: Orchid Fundamental (Continuous IAM Assurance, Discovery & Readiness, 30 applications) $250,000.00 per 12 months; 24- and 36-month options are also listed. The listing offers custom pricing by private offer. No pricing page on orchid.security.

Source: AWS Marketplace: Orchid Security · Read 11 Oct 2026 · Source: orchid.security/pricing (returns 404) · Read 11 Oct 2026

Deployment

SaaS, per its AWS Marketplace listing. Whether the platform itself can run on-prem is not stated on the pages reviewed.

Who is Orchid for?

Teams that already run an IdP and an IGA and need the applications and accounts those tools cannot see.

Consider instead if you want the tool itself to provision and revoke access: SailPoint Identity Security Cloud.

How does Orchid compare with each other tool?

Orchid vs Veza
Orchid Security scores higher overall, 8.24 against 6.37
Orchid vs Saviynt
Orchid Security scores higher overall, 8.24 against 6.15
Orchid vs SailPoint
Orchid Security scores higher overall, 8.24 against 6.21
Orchid vs Entra ID Governance
Orchid Security scores higher overall, 8.24 against 6.15
Orchid vs C1
Orchid Security scores higher overall, 8.24 against 6.30
Orchid vs Lumos
Orchid Security scores higher overall, 8.24 against 6.13
Orchid vs Apono
Orchid Security scores higher overall, 8.24 against 4.78

Moving off Orchid? See the alternatives Visit Orchid Security

Learn more

LESSON 01
The unmanaged application estate: what your identity provider misses
Three kinds of unmanaged app, where they come from and why they matter.
LESSON 06
What identity orchestration means, and why vendors use the term differently
One term, three meanings, and the questions that separate them.

Frequently asked questions

What is Orchid Security?

Discovers unmanaged applications, maps how identity works inside them, and feeds that context to the IAM, IGA, PAM and ticketing tools already in place. It sits in the discovery and orchestration layer layer.

How does Orchid Security score on reach beyond the IdP?

8.24 out of 10, rank 1 of 8 on default weights. Its highest criterion scores are Unmanaged app discovery (9.5) and Orchestrates through the existing stack (9.5) and its lowest is Executes changes itself (4.5).

What are the alternatives to Orchid Security?

On our reach score the closest alternatives are Veza, C1 (formerly ConductorOne) and SailPoint Identity Security Cloud. The moving-off page lists every alternative and the criteria where each scores higher.

Moving off Orchid