Identity security startup Orchid Security Inc. today added identity drift detection and application-level kill switches for artificial intelligence agents to its Identity Control Plane.
The controls are meant to let security teams strip an agent of its authority the moment its behavior moves outside what was approved.
Agents rarely have to defeat a security control to exceed their intended scope, according to the company. They inherit the problem instead. Hard-coded credentials, dormant accounts and unmanaged authentication paths are already sitting across most enterprise application estates, and an agent working at machine speed can chain them into elevated access in seconds to minutes.
Orchid’s report “The Identity Gap: 2026 Snapshot,” published in May, found invisible identity outnumbering the visible kind 57% to 43%. Two-thirds of nonhuman accounts in that sample had been provisioned inside applications, out of view of identity and access management tooling.
Five capabilities are available now. Orchid tags applications, identities and access paths with an AI readiness status. Orphaned, dormant, over-permissioned and suspicious accounts are surfaced as hygiene findings. Drift detection runs continuously, comparing what an agent was built to do against what it is actually doing. Response is orchestrated through whatever identity and security tooling the customer already runs, and an audit generator documents the agent activity, the identity behind it, the drift detected and the action taken.
Those actions run from trimming permissions to revoking credentials, disconnecting tools or suspending a workflow. The application-level kill switch goes further, terminating the authority the agent operates through.
Roy Katmor, co-founder and chief executive of Orchid, tied the release to boardroom pressure. Boards have stopped asking whether AI will be adopted and started asking why it is not moving faster, he said, and security cannot answer with a blanket no. “AI transformation is exciting. Identity hygiene is not,” Katmor said.
Shannon Wilkinson, chief information officer and chief information security officer at Findlay Automotive Group Inc., said the dealership group is leaning heavily on agents to improve customer experience while trying to keep sight of what those identities can reach. “It honestly terrifies a lot of us,” she said.
Two integrations shipped alongside the release. A certified connector for Palo Alto Networks Inc.’s Idira identity security platform discovers privileged accounts Idira does not already manage and brings them under its control. The second streams Orchid’s identity telemetry into Splunk Enterprise Security for correlation and incident response.
Orchid last extended the Identity Control Plane for agents in May, mapping agents back to their originating identities and adding observability over delegation chains. SailPoint Technologies Inc. certified the company’s governance orchestration in September 2025. Team8 Capital and Intel Capital Inc. co-led a $36 million seed round for Orchid in January 2025.
