SET SIDE BY SIDE
Set identity tools side by side: compare 2 to 5 on reach
The short answer
Choose two to five tools to see their reach scores, each criterion with the reason behind it, the parts of the estate their pages document, and what they publish about price. The default set is the top three on our published weights. Scores are editorial and come from public vendor pages, vendor facts read in September 2026, updated 2026-10-13.
Choose tools
3 selected. Choose two to five.
| Row | Orchid Security | Veza | C1 (formerly ConductorOne) |
|---|---|---|---|
| Reach score | Rank 1 of 8 | Rank 2 of 8 | Rank 3 of 8 |
| Layer | Discovery and orchestration layer | Access graph and governance | Identity governance (IGA) platform |
| Unmanaged app discovery | 9.5Highest here States it discovers SaaS, cloud, on-prem, legacy and custom-built applications automatically, including unmanaged ones. | 3.5 Finds accounts outside identity platforms within the systems it integrates with; discovery of applications nobody connected is not described. | 6.0 Monitors shadow app sign-ups and logins to decide whether to bring an app under governance, and lists Shadow AI Discovery. |
| Accounts inside the app | 9.0Highest here Maps how identity works inside each application and surfaces local user activity, orphaned accounts, shadow authentication paths and privilege drift. | 8.0 Reveals local, machine and service accounts and dormant accounts, with effective permissions from the Access Graph. | 6.0 Finds what offboarding missed; mapping of local accounts inside apps is not detailed. |
| Reach into apps without APIs or SCIM | 9.0Highest here Describes bringing unmanaged on-prem, legacy and custom-built applications under IAM, IGA, PAM and audit control; the collection method is not detailed on the pages reviewed. | 7.0 The Open Authorization API imports authorization metadata from any system, including custom or on-premise apps, through a JSON schema and REST API; someone has to build the feed. | 6.5 Open-source Baton connectors and C1 Bridge for on-prem systems; apps with no connector are not described in detail. |
| Orchestrates through the existing stack | 9.5Highest here Feeds identity context into the IAM, IGA, PAM and ITSM tools in place: names Microsoft, SailPoint, Saviynt and CyberArk, ServiceNow and Jira ticketing, a SailPoint partnership since August 2026, and reports privileged accounts to the Discovered Accounts queue in Idira Privilege Cloud. | 7.5 Adds visibility beside existing IdP and HR sources and writes changes back through OAA Write; now part of ServiceNow. | 7.0 Connects to existing IdPs and HR systems rather than replacing them. |
| Executes changes itself | 4.5 Does not describe itself as a provisioning engine; provisioning and revocation run in the IGA, IdP or ticketing tool it feeds. | 7.2 Birthright access, role-change and offboarding automation, including local accounts, with Dry Run and Safety Limits. | 7.8Highest here HR systems and directories trigger join, role change and departure workflows. |
| Machine, service and agent accounts | 7.5Highest here Detects hardcoded accounts and credentials and lists guardrails for autonomous identity as a use case; dedicated agent identity features are not detailed. | 7.5Highest here Reveals machine and service accounts; the acquisition post frames the combined offer as an agent identity control plane. | 6.0 Shadow AI Discovery is listed; service account and credential coverage is not detailed. |
| Audit evidence | 8.5Highest here Continuous, application-level identity evidence mapped to SOX, PCI, HIPAA, GDPR and NIS2; every discovery, policy and action recorded. | 7.0 Audit logging for lifecycle actions; a framework-mapped evidence export is not described on the pages reviewed. | 6.5 Records each offboarding action; a framework evidence export is not described. |
| Pricing transparency | 6.0Highest here Lists one package on AWS Marketplace (Orchid Fundamental, 30 applications, $250,000.00 per 12 months); other terms by private offer; no pricing page on its own site. | 2.0 No public pricing. | 3.0 Publishes the pricing structure but no prices. |
| Unsanctioned SaaS | Documented | Not documented | Partial |
| On-prem and legacy apps | Documented | Documented | Documented |
| Custom-built apps | Documented | Documented | Partial |
| Local accounts in apps | Documented | Documented | Partial |
| Service accounts and hardcoded credentials | Documented | Partial | Not documented |
| AI agents | Partial | Partial | Partial |
| Pricing | AWS Marketplace, 12-month contract: Orchid Fundamental (Continuous IAM Assurance, Discovery & Readiness, 30 applications) $250,000.00 per 12 months; 24- and 36-month options are also listed. The listing offers custom pricing by private offer. No pricing page on orchid.security. Source: AWS Marketplace: Orchid Security · Read 11 Oct 2026 · Source: orchid.security/pricing (returns 404) · Read 11 Oct 2026 | Not published | Not published Pricing structure published (Platform or Flex; Pro or Advanced; 100 to 20,000 managed identities) without prices. Source: C1 pricing · Read 12 Oct 2026 |
| Deployment | SaaS, per its AWS Marketplace listing. Whether the platform itself can run on-prem is not stated on the pages reviewed. | SaaS with integrations, as described by Veza. | SaaS with hosted or on-prem connectors (C1 Bridge). EU instance with tenant data held in the EU since September 2026. |
| Rosette | |||
| Read more | Profile | Profile | Profile |
Highest here is computed among the tools you selected, not the full set of 8.
Frequently asked questions
How is the default set chosen?
It is the three highest totals on our published weights, computed when the page is built.
Can I share a comparison?
Yes. The address bar keeps your selection, for example ?v=orchid-security,veza.
Why are some prices missing?
Microsoft publishes a per-user price, Orchid Security lists one package on AWS Marketplace, C1 publishes a pricing structure without figures, and the others are by quote.