Where Orchid Security fits in an IAM stack, and where it does not

What do Orchid's pages describe?

Orchid says it discovers SaaS, cloud, on-premises, legacy and custom-built applications automatically, and maps how identity works inside them: local user activity, hardcoded accounts and credentials, shadow authentication paths and privilege drift. Its platform page describes four capabilities, Discover, Analyze, Orchestrate and Audit, and "a living identity audit trail across managed and unmanaged systems", with reports aligned to SOX, PCI, HIPAA, GDPR and NIS2. Its home page lists HIPAA, SOC 2, GDPR, ISO 27001 and ISO 27701, and names integrations with Microsoft, Saviynt, SentinelOne, CyberArk and SailPoint. A customer story describes ServiceNow and Jira ticketing. Orchid announced a $36 million seed round, co-led by Team8 and Intel Capital, in January 2025, and reports privileged accounts it finds to Idira Privilege Cloud.

Where does it fit in the five jobs?

• Application coverage: Documented. This is the job Orchid's pages are about.
• Lifecycle and governance: Partial. Orchid feeds identity context into IAM, IGA and ITSM tools; the joiner, mover and leaver actions and the reviews run there. Orchid joined SailPoint's Technology Alliance Partner program in August 2026.
• Privileged access: Partial. It brings discovered applications under PAM control and lists a CyberArk integration, but it is not a vault.
• Identity threat detection: Partial. It lists incident response teams as a use case, but is not described as a detection product.
• Directory and single sign-on: not in our sources. It is not an identity provider.

What are its limits?

• No price on its own site. AWS Marketplace lists Orchid Fundamental at $250,000.00 per 12 months for 30 applications, with custom pricing by private offer.
• No provisioning engine or certification campaigns of its own.
• Delivered as SaaS; its own site does not say whether the platform can run on premises.
• Okta is not among the integrations named on its home page, so Okta customers should ask how the two connect.

Who else does this job?

Saviynt is also documented for application coverage: it onboards connected, disconnected and custom-built applications inside its own IGA. Veza reveals accounts outside identity platforms, C1 watches shadow app signups, Lumos surfaces shadow IT, SailPoint offers an application self-registration portal, and Microsoft documents account discovery; all five are partial. Palo Alto Networks describes robotic process automation in Idira for applications without APIs.

When does Orchid make sense to look at?

When you already run an IGA, especially SailPoint, and many in-scope applications sit outside it; when auditors ask for access evidence on applications reviewed by spreadsheet; or after an acquisition brings unconnected applications. Orchid quotes Costco's Jon Raper saying application onboarding "can take days, weeks, and even months", which describes the problem it addresses.

When should you look elsewhere?

If you are choosing a new IGA and want one platform, Saviynt documents disconnected-application onboarding inside the IGA itself. If nearly all of your applications support single sign-on and SCIM, your identity provider and governance tool may already reach them.

What should you ask in a demo?

• How is it deployed, and what access does discovery need?
• What is the pricing basis: applications, identities or something else?
• Which IGA, PAM and ITSM integrations are in production use, and with which versions?
• What does an evidence export look like for one in-scope application?