Orchid Security review: identity lifecycle coverage for disconnected apps

Orchid describes its platform in four steps: Discover, Analyze, Orchestrate and Audit. It states that it discovers 'SaaS, cloud, on-prem, legacy, and custom-built applications automatically', analyzes authentication and authorization logic inside each application, and 'brings them under IAM, IGA, PAM, and audit control'. In lifecycle terms, Orchid supplies the missing inputs: which applications exist, which accounts live in them, and how each one authenticates.

Orchid uses the term Identity Dark Matter, a trademark of Orchid Security, for identity activity that sits inside applications outside central visibility. Its home page describes local user activity, hardcoded accounts and credentials in code and configuration, alternate authentication paths that bypass the identity provider, and privilege drift as the problems it targets.

This is Orchid's core case. The platform page promises 'continuous inventory across SaaS, on-prem, and custom apps' and says it 'bridges unmanaged applications back into IAM control'. A February 2026 post by Orchid's CPO lists what its analysis surfaced in practice, including 'orphaned accounts lingering across applications' and third-party accounts with admin access. Orchid also publishes an Orphan & Local Accounts report (August 2026) that defines orphaned accounts as accounts 'left active after owners depart or change roles' and local accounts as credentials 'stored directly on systems/applications'.

What Orchid does not claim is to remove those accounts itself. Its IAM programs page says it will 'connect and feed identity context into IAM, IGA and ITSM tools'. The leaver action happens in your IGA, your PAM tool or a ServiceNow or Jira ticket.

Orchid's GRC page describes 'continuous, application-level identity evidence mapped to SOX, PCI, HIPAA, GDPR, and NIS2', intended to replace audit evidence built from 'interviews, screenshots, and assumptions'. The platform page adds that 'every discovery, policy, and action is recorded and auditable'. For audit teams, the value is evidence for applications the IGA does not cover. Access certification evidence still comes from the governance platform.

Orchid positions itself as an addition to existing IAM rather than a replacement. Its home page lists Microsoft, Saviynt, SentinelOne, CyberArk and SailPoint among integrations, and in August 2026 Orchid joined the SailPoint Technology Alliance Partner ecosystem. Orchid's own framing of the division of work: Orchid discovers applications and identities outside traditional controls; SailPoint provides the governance engine. Orchid's Costco story describes integration with existing IAM tools and with ServiceNow or Jira for remediation tracking.