PAIRING · MEASURED SIDE BY SIDE
Orchid Security vs Veza: reach beyond the IdP and IGA
The short answer
On our default weights Orchid Security scores higher overall, 8.24 against 6.37 out of 10. Orchid scores higher on Unmanaged app discovery, Accounts inside the app, Reach into apps without APIs or SCIM, Orchestrates through the existing stack, Audit evidence and Pricing transparency; Veza scores higher on Executes changes itself. They tie on Machine, service and agent accounts. They sit in different layers (Discovery and orchestration layer and Access graph and governance), so many teams run both.
Both look for accounts outside central control, by different routes: Veza through its Access Graph over the systems it integrates with, Orchid by discovering applications and analyzing identity inside them.
Source: Veza Access Reviews · Read 27 Sep 2026 · Source: Orchid Security homepage · Read 27 Sep 2026
By The Credential Desk · IAM Compared · Published 2026-10-08
Desk research from public vendor pages and documentation read in September 2026, updated 2026-10-13. Editorial assessment; we did not test the products.
How do they score on each criterion?
| Criterion | Weight | Orchid | Veza | Higher |
|---|---|---|---|---|
| Unmanaged app discovery | 18% | 9.5 States it discovers SaaS, cloud, on-prem, legacy and custom-built applications automatically, including unmanaged ones. | 3.5 Finds accounts outside identity platforms within the systems it integrates with; discovery of applications nobody connected is not described. | Orchid |
| Accounts inside the app | 16% | 9.0 Maps how identity works inside each application and surfaces local user activity, orphaned accounts, shadow authentication paths and privilege drift. | 8.0 Reveals local, machine and service accounts and dormant accounts, with effective permissions from the Access Graph. | Orchid |
| Reach into apps without APIs or SCIM | 14% | 9.0 Describes bringing unmanaged on-prem, legacy and custom-built applications under IAM, IGA, PAM and audit control; the collection method is not detailed on the pages reviewed. | 7.0 The Open Authorization API imports authorization metadata from any system, including custom or on-premise apps, through a JSON schema and REST API; someone has to build the feed. | Orchid |
| Orchestrates through the existing stack | 14% | 9.5 Feeds identity context into the IAM, IGA, PAM and ITSM tools in place: names Microsoft, SailPoint, Saviynt and CyberArk, ServiceNow and Jira ticketing, a SailPoint partnership since August 2026, and reports privileged accounts to the Discovered Accounts queue in Idira Privilege Cloud. | 7.5 Adds visibility beside existing IdP and HR sources and writes changes back through OAA Write; now part of ServiceNow. | Orchid |
| Executes changes itself | 12% | 4.5 Does not describe itself as a provisioning engine; provisioning and revocation run in the IGA, IdP or ticketing tool it feeds. | 7.2 Birthright access, role-change and offboarding automation, including local accounts, with Dry Run and Safety Limits. | Veza |
| Machine, service and agent accounts | 10% | 7.5 Detects hardcoded accounts and credentials and lists guardrails for autonomous identity as a use case; dedicated agent identity features are not detailed. | 7.5 Reveals machine and service accounts; the acquisition post frames the combined offer as an agent identity control plane. | Tie |
| Audit evidence | 10% | 8.5 Continuous, application-level identity evidence mapped to SOX, PCI, HIPAA, GDPR and NIS2; every discovery, policy and action recorded. | 7.0 Audit logging for lifecycle actions; a framework-mapped evidence export is not described on the pages reviewed. | Orchid |
| Pricing transparency | 6% | 6.0 Lists one package on AWS Marketplace (Orchid Fundamental, 30 applications, $250,000.00 per 12 months); other terms by private offer; no pricing page on its own site. | 2.0 No public pricing. | Orchid |
| Total | 100% | 8.24 | 6.37 | Orchid |
What shape is each tool's reach?
- DISC
- Unmanaged app discovery
- 9.5
- INAPP
- Accounts inside the app
- 9.0
- NOAPI
- Reach into apps without APIs or SCIM
- 9.0
- ORCH
- Orchestrates through the existing stack
- 9.5
- EXEC
- Executes changes itself
- 4.5
- NHI
- Machine, service and agent accounts
- 7.5
- EVID
- Audit evidence
- 8.5
- PRICE
- Pricing transparency
- 6.0
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
- DISC
- Unmanaged app discovery
- 3.5
- INAPP
- Accounts inside the app
- 8.0
- NOAPI
- Reach into apps without APIs or SCIM
- 7.0
- ORCH
- Orchestrates through the existing stack
- 7.5
- EXEC
- Executes changes itself
- 7.2
- NHI
- Machine, service and agent accounts
- 7.5
- EVID
- Audit evidence
- 7.0
- PRICE
- Pricing transparency
- 2.0
Each sector is one criterion. The longer the engraved sector, the higher the editorial score. Sectors are equal width, so the picture shows the shape of a tool's reach, not its weighted total.
Which parts of the estate does each document?
| Zone | Orchid | Veza |
|---|---|---|
| Unsanctioned SaaS | Documented Discovers SaaS and cloud applications, including unmanaged ones | Not documented Discovery of unconnected SaaS not described |
| On-prem and legacy apps | Documented Discovers on-prem and legacy applications | Documented The Open Authorization API imports authorization metadata from custom or on-premise apps |
| Custom-built apps | Documented Discovers custom-built applications | Documented Custom systems connect through OAA |
| Local accounts in apps | Documented Local user activity and orphaned accounts inside apps; publishes an Orphan and Local Accounts report | Documented Reveals local accounts outside identity platforms |
| Service accounts and hardcoded credentials | Documented Hardcoded accounts and credentials detected | Partial Reveals machine and service accounts; hardcoded credentials not described |
| AI agents | Partial Guardrails for autonomous identity listed as a use case; detail not reviewed | Partial Acquisition post frames the combined offer as an agent identity control plane |
What do they cost?
Orchid Security
Pricing
AWS Marketplace, 12-month contract: Orchid Fundamental (Continuous IAM Assurance, Discovery & Readiness, 30 applications) $250,000.00 per 12 months; 24- and 36-month options are also listed. The listing offers custom pricing by private offer. No pricing page on orchid.security.
Source: AWS Marketplace: Orchid Security · Read 11 Oct 2026 · Source: orchid.security/pricing (returns 404) · Read 11 Oct 2026
Deployment
SaaS, per its AWS Marketplace listing. Whether the platform itself can run on-prem is not stated on the pages reviewed.
Which should you choose?
Frequently asked questions
Which scores higher overall, Orchid Security or Veza?
On our default weights Orchid Security scores higher overall, 8.24 against 6.37 out of 10.
Where does Orchid Security score higher than Veza?
Orchid scores higher on Unmanaged app discovery (9.5 against 3.5), Accounts inside the app (9.0 against 8.0), Reach into apps without APIs or SCIM (9.0 against 7.0), Orchestrates through the existing stack (9.5 against 7.5), Audit evidence (8.5 against 7.0) and Pricing transparency (6.0 against 2.0).
Can Orchid Security and Veza be used together?
Often, yes. They sit in different layers (Discovery and orchestration layer; Access graph and governance), and each one's pages describe working with existing identity tools.