Make smarter decisions on the identity security market

Identity security is hot right now, and the biggest security and IT platforms want to own it.

We've found a lot of interesting signals. For example, ServiceNow agreed in December 2025 to buy Veza, whose software maps what every person, machine and AI agent can access inside a company. And in January 2026, CrowdStrike agreed to buy SGNL for $740M, to grant or remove access in real time based on risk. The big platforms are buying identity tools because AI agents are becoming a new kind of user to control.

In this section, we look at why identity has become the main way in for attackers, how AI agents change the problem, and what this wave of deals means for independent startups.

Every employee, contractor, app, server and AI agent needs access to something, and most companies have lost track of who can reach what.

We compare six types of identity security companies, from governance and privileged access to login and passwordless tools, identity threat detection and machine identity. Their buyers range from mid-size firms to banks, hospitals and governments. For each, we rank the biggest pains, like accounts nobody removed, admin rights handed out too widely, slow access reviews and secrets left in code.

This shows which identity problems a company will pay to fix first, and which ones it keeps putting off.

Per-user subscriptions, pricing per machine identity or per secret, platform bundles, paid services for long rollouts and sales through resellers: identity security companies charge in many ways.

We look at who pays and where the costs sit. Per-user pricing is familiar, but machines and AI agents now outnumber people, and buyers push back when every new identity adds to the bill. Governance projects can take months and need consultants, which slows revenue. And bundles from the big platforms make it harder for a specialist to charge for one piece.

You'll see which models keep growing as machine identities multiply, and which ones get squeezed when the big platforms fold identity into larger deals.

Identity security keeps growing for reasons that go beyond more logins. Here, we look at each of them.

Some drivers are plain to see: attacks that start with stolen credentials, more apps and cloud accounts, and rules that require stronger access controls. Others build on each other. Every AI agent a company deploys adds identities to manage. A breach at one company pushes its peers to review their own access. And once a team sees all its identities in one place, it tends to clean up more.

Before building or investing, you should know what convinces a company to take identity seriously before a breach, and what keeps it paying after the first cleanup.

Okta and SailPoint are the names most buyers know in identity, but the market reaches far beyond logins and access reviews.

Plenty of interesting players work out of sight. Some only hunt for API keys and tokens left in code. Others watch Active Directory for signs of an attacker, manage access to factory and hospital systems, or give AI agents short-lived permissions that expire after each task.

They're hard to compare because identity tools overlap. A login product can add governance, a governance tool can add privileged access, and both now claim to cover AI agents. Many startups also sell through resellers or system integrators, so buyers meet them inside a larger project.

Below, you'll find the market grids and ecosystem maps we've built to show which identities each company protects, and where new players are breaking in.

Saviynt, Silverfort, Astrix Security… a few identity companies have won large customers on problems the older leaders handled poorly.

Saviynt sells one platform for governance and privileged access, and raised $700M in December 2025 to grow it. Silverfort adds strong login checks to old systems that can't support them on their own. Astrix Security, younger, focuses on machine and AI agent identities. Each found a gap the incumbents left open, though none has shown yet that it can beat the big platforms everywhere.

We'll look at how these teams picked a gap the big vendors ignored, proved it with a few demanding customers, and widened their product from there.