HEAD-TO-HEAD · FACTS ONLY, NO SCORES

Orchid Security vs Veza: IAM jobs, prices and limits side by side

Short answer

Both look for accounts outside central identity platforms. Veza builds an Access Graph and runs lifecycle actions and reviews itself; Orchid discovers unmanaged applications, maps identity inside them and feeds that to the IGA and IAM tools you run. Neither publishes prices. Both cover lifecycle and IGA and app coverage. Only Orchid Security covers privileged access and threat detection.

By The Access Desk · Best IAM Tools · Published 2026-10-08

Desk research from public vendor pages read in September 2026, updated 2026-10-11. Editorial profiles, no scores; we did not run the products.

How do they compare job by job?

Coverage as described on each vendor's own pages, read in September 2026 and updated 11 October 2026. Not a score.
Job	Orchid Security	Veza
J1Directory and SSO	Not in our sources Orchid is not an identity provider; it works with the IAM tools already in place. Source: Orchid Security homepage · Read 27 Sep 2026	Not in our sources
J2Lifecycle and IGA	Partial Feeds identity context into IAM, IGA and ITSM tools; joiner, mover and leaver execution and certification campaigns stay in those tools. Source: Orchid Security: IAM programs · Read 27 Sep 2026 · Source: Orchid Security blog: SailPoint partnership · Read 27 Sep 2026	Documented Birthright access, role change and offboarding including local accounts, with Dry Run and Safety Limits; access reviews that show local, machine and service accounts. Source: Veza Lifecycle Management · Read 27 Sep 2026 · Source: Veza Access Reviews · Read 27 Sep 2026
J3App coverage	Documented Discovers SaaS, cloud, on-premises, legacy and custom-built applications, maps local accounts, hardcoded credentials, shadow authentication paths and privilege drift inside them, and brings them under IAM, IGA, PAM and audit control. Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security platform · Read 27 Sep 2026	Partial Reveals accounts even if they exist outside your identity platforms; the Open Authorization API imports authorization data from any system, including custom and on-premises applications. Source: Veza Access Reviews · Read 27 Sep 2026 · Source: Veza Lifecycle Management · Read 27 Sep 2026 · Source: Veza Open Authorization API · Read 11 Oct 2026
J4Privileged access	Partial Brings discovered applications under PAM control and reports privileged accounts it finds to Idira Privilege Cloud's Discovered Accounts queue, without sending credentials; it is not a credential vault. Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security blog: Orchid and Idira · Read 11 Oct 2026	Not in our sources
J5Threat detection	Partial Lists incident response teams as a use case; it is not described as an identity threat detection product. Source: Orchid Security homepage · Read 27 Sep 2026	Not in our sources

Can you run both in one stack?

Neither documents a job the other also documents, so they can sit in the same stack without overlap: Orchid Security for app coverage, Veza for lifecycle and IGA.

What do they cost and how are they deployed?

Orchid Security

Pricing: No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer.
Source: AWS Marketplace: Orchid Security · Read 11 Oct 2026
Deployment: SaaS, per its AWS Marketplace listing (deployed on AWS). Its own site does not say whether the platform itself can run on premises; it discovers SaaS, cloud, on-premises, legacy and custom-built applications.
Source: AWS Marketplace: Orchid Security · Read 11 Oct 2026 · Source: Orchid Security homepage · Read 27 Sep 2026
Integrations: Microsoft, Saviynt, SentinelOne, CyberArk and SailPoint named on the home page; ServiceNow and Jira ticketing in a customer story. It reports privileged accounts it finds to the Discovered Accounts queue in Idira Privilege Cloud, and says it does not send credential values, secrets or session data.
Source: Orchid Security homepage · Read 27 Sep 2026 · Source: Orchid Security: Costco story · Read 27 Sep 2026 · Source: Orchid Security blog: Orchid and Idira · Read 11 Oct 2026
Certifications: HIPAA, SOC 2, GDPR, ISO 27001 and ISO 27701 listed.
Source: Orchid Security homepage · Read 27 Sep 2026

Veza

Pricing: Not published
Deployment: SaaS.
Source: Veza homepage · Read 27 Sep 2026
Integrations: 325+ integrations.
Source: Veza Lifecycle Management · Read 27 Sep 2026
Certifications: Not covered in our sources

What are each one's strengths and limits?

Orchid Security

Strengths

Application discovery across SaaS, cloud, on-premises, legacy and custom-built apps.
Source: Orchid Security homepage · Read 27 Sep 2026
Identity evidence mapped to SOX, PCI, HIPAA, GDPR and NIS2, with every discovery, policy and action recorded.
Source: Orchid Security platform · Read 27 Sep 2026 · Source: Orchid Security: GRC and audit · Read 27 Sep 2026
Built to sit beside an existing IGA: a SailPoint Technology Alliance Partner since August 2026.
Source: Orchid Security blog: SailPoint partnership · Read 27 Sep 2026

Limits

No price on its own site; the public list price is on AWS Marketplace, $250,000.00 per 12 months for 30 applications, with custom pricing by private offer.
Source: AWS Marketplace: Orchid Security · Read 11 Oct 2026
Not a provisioning engine or certification tool: joiner, mover and leaver actions and access reviews run in your IGA or IdP.
Source: Orchid Security: IAM programs · Read 27 Sep 2026
Delivered as SaaS; an on-premises option for the platform itself is not stated.
Source: AWS Marketplace: Orchid Security · Read 11 Oct 2026 · Source: Orchid Security homepage · Read 27 Sep 2026
Not an identity provider, so it does not replace directory or SSO.
Source: Orchid Security homepage · Read 27 Sep 2026

Veza

Strengths

Effective permissions from the Access Graph, down to entitlement level.
Source: Veza homepage · Read 27 Sep 2026
Local, machine and service accounts shown in reviews.
Source: Veza Access Reviews · Read 27 Sep 2026
Dry Run and Safety Limits before lifecycle changes run.
Source: Veza Lifecycle Management · Read 27 Sep 2026

Limits

No public pricing.
Basis: absence on the pages we read
Framework-specific audit evidence export is not described on the pages reviewed.
Source: Veza Lifecycle Management · Read 27 Sep 2026

Which should you look at first?

Orchid Security

Look at Orchid Security first if you need: the jobs both cover.

Orchid Security's pages highlight: Application discovery across SaaS, cloud, on-premises, legacy and custom-built apps.

Source: Orchid Security homepage · Read 27 Sep 2026

Veza

Look at Veza first if you need: the jobs both cover.

Veza's pages highlight: Effective permissions from the Access Graph, down to entitlement level.

Source: Veza homepage · Read 27 Sep 2026

Frequently asked questions

Do Orchid Security and Veza publish prices?

Orchid Security: No price on its own site (its /pricing page returns 404). AWS Marketplace lists "Orchid Fundamental" (Continuous IAM Assurance, Discovery and Readiness, 30 applications) at $250,000.00 per 12 months on a 12-month contract, with 24- and 36-month options, and custom pricing by private offer. Veza: Not published.

Do Orchid Security and Veza overlap?

Neither documents a job the other also documents, so they can sit in the same stack without overlap: Orchid Security for app coverage, Veza for lifecycle and IGA.

How can I compare more than two IAM tools?

Use the side-by-side tool, which shows up to five vendors' job coverage, prices and limits in one table.