Orchid Security
Identity-first platform that finds unmanaged "shadow" authentication paths inside applications and brings them under existing IAM controls.
Visit Website ↗ + Add to Compare Claim This CompanyOverview
Orchid Security targets what it calls “identity dark matter”: authentication and authorization logic buried inside SaaS, cloud, on-premises, legacy, and custom-built applications that never gets surfaced to centralized IAM, IGA, or PAM tools. Its platform discovers these applications, analyzes their real login and permission flows using large language models, and helps bring them under existing identity governance without rewriting the applications themselves.
Rather than replacing IAM, IGA, or PAM platforms, Orchid is built to complement them, closing the visibility gap that leaves hardcoded credentials and shadow login paths outside of audit and compliance scope. Customers named publicly include Costco and Repsol.
Founded in San Francisco, Orchid emerged from stealth in January 2025 with a $36 million seed round led by Team8 and Intel Capital, with participation from Capital One. In May 2026 it extended its Identity Control Plane to govern AI agents, addressing the same shadow-access problem as autonomous agents proliferate inside the enterprise.
Innovation Matrix Assessment
Extended its identity-discovery engine from legacy applications to AI-agent governance within about 16 months of emerging from stealth.
Surfacing hidden authentication paths and hardcoded credentials gives identity and audit teams visibility they otherwise lack entirely, directly reducing compliance blind spots.
A $36M seed co-led by Team8 and Intel Capital, with Capital One participating, plus named enterprise customers (Costco, Repsol) reported by Axios, is unusually strong independent validation for this stage.
It fills a real, previously unaddressed gap next to IAM/IGA/PAM rather than replacing those systems outright, so it extends rather than reinvents identity governance.
Specific efficiency figures (75% faster onboarding, 97% lower services cost) are vendor-published and unverified; the one public customer testimonial (ISS) corroborates faster onboarding only in general terms.
Shadow identity in both legacy applications and now AI agents is a growing, durable attack surface as enterprises adopt more autonomous systems.
Why CISOs Should Care
Closes identity blind spots in legacy and custom applications that routinely fail audits and go unmanaged by standard IAM tooling.
What Makes It Different
Uses LLM-based analysis of real authentication flows to onboard applications into existing identity stacks without code changes, rather than requiring app-side integration.
The Matrix Verdict
65/100 — INCREMENTAL INNOVATOR
A Meaningful Innovator: well-capitalized with credible named customers and a real architectural gap addressed, tempered by unverified vendor efficiency statistics.
Editorial Note: Claims vs. Verified Findings
Named customers (Costco, Repsol) and funding come from Axios reporting and are independently sourced; percentage efficiency claims are vendor-published and were discounted accordingly.
Sources
Alternatives to Orchid Security
Teleport
An identity-based infrastructure access platform issuing short-lived cryptographic identities for humans, machines, and AI agents in place of…
SpecterOps
Identity attack-path security specialist behind BloodHound, the widely used open-source tool for mapping Active Directory and Entra ID…
Astrix Security
Non-human identity security platform that discovers and governs API keys, OAuth tokens, service accounts, and AI-agent credentials across…
Socure
AI-driven identity verification and fraud platform used by banks, fintechs, and government agencies to validate identities during digital…
Keyfactor
Machine identity and PKI management platform helping enterprises secure certificates, keys, and post-quantum cryptography readiness at scale.
Astrix Security
Non-human and AI agent identity security platform that discovers and remediates over-privileged API keys, service accounts and secrets.