NHI Security Vendor Index
Every significant non-human identity security platform, organized by functional category. No sponsored placements, no rankings. Where a vendor's products span multiple categories under different names, the platform is described once, in the category where its portfolio is broadest, with a cross-reference from each other relevant category.
Pricing tiers are indicative, not published rates: $ means accessible to mid-market on usage-based or startup pricing, $$ means enterprise SaaS with annual contracts, $$$ means platform economics that require formal procurement. Most vendors in this category do not publish list prices.
Jump to:
01 · NHI Governance and Discovery
02 · Secrets Management
03 · Workload Identity and Access Management
04 · Certificate Lifecycle Management
05 · PAM and IAM with NHI Extension
The landscape overview explains the differences between these categories. The comparisons cover the platforms most frequently evaluated against each other.
01
NHI Governance and Discovery
What this category does
These platforms discover non-human identities, service accounts, API keys, OAuth tokens, and automated credentials, across cloud, SaaS, on-premises, and CI/CD environments, then enrich that inventory with ownership, access, and risk context.
Discovery and governance is not enforcement. These platforms identify and rank what exists and what's risky; remediation requires action in the underlying system where the credential lives, the vault, the IAM console, or the SaaS admin panel.
Established
NHI discovery and governance platform originally built around SaaS-to-SaaS integration security: OAuth grants, API keys, and service accounts connecting third-party applications to platforms such as Microsoft 365, Google Workspace, Salesforce, and GitHub. Risk scoring incorporates third-party vendor reputation alongside privilege level and observed activity. Coverage has expanded to include cloud and on-premises environments. The AI Agent Control Plane, added in 2025, extends discovery and governance to AI agent identities.
Best fit: Organizations whose NHI exposure is concentrated in SaaS-to-SaaS integrations and OAuth token sprawl across business applications.
NHI discovery and governance platform covering cloud IAM roles, service accounts, and instance profiles across AWS, Azure, and GCP; SaaS applications; on-premises Active Directory and Linux service accounts; Kubernetes workload identities; and credentials held in HashiCorp Vault, AWS Secrets Manager, and CyberArk. A policy intelligence layer compares stated access policy against observed activity. Agentic Access Management adds time-bound, just-in-time access governance for AI agents. Oasis researchers disclosed a Microsoft MFA bypass vulnerability in 2024.
Best fit: Organizations with NHI exposure distributed across cloud, Kubernetes, on-premises, and SaaS environments, where cross-environment coverage from a single platform is the priority.
NHI discovery and governance platform focused on credential context across the software development lifecycle, from development and CI/CD through production secrets managers including HashiCorp Vault, AWS Secrets Manager, Azure Key Vault, GCP Secret Manager, and CyberArk. Each discovered credential is enriched with its owner, the systems it accesses, and the impact of rotating or revoking it. Rated 9.5 out of 10 on PeerSpot as of May 2026, the highest rating in the NHI governance category.
Best fit: Organizations with established DevSecOps programs that need NHI governance integrated across the SDLC, with ownership context for remediation.
Challengers
NHI discovery and governance platform positioned as a single inventory and policy layer across cloud, SaaS, and on-premises environments, with zero-trust access enforcement applied centrally regardless of where a credential originates. Developer workflow integration is less extensive than in detection-first platforms such as GitGuardian.
Best fit: Organizations prioritizing a centralized, cross-environment NHI inventory and policy enforcement layer over developer-workflow-native tooling.
NHI discovery and governance platform covering cloud, SaaS, and on-premises environments, with posture scoring and remediation workflow integration. Positioned similarly to Clutch as a centralized inventory and zero-trust enforcement layer, with a smaller deployment footprint than the established pure-plays.
Best fit: Organizations evaluating an alternative to the established NHI governance platforms, particularly where cross-environment visibility and posture scoring are the priority.
02
Secrets Management
What this category does
Secrets vaults store credentials and control who can retrieve them, handling rotation, audit logging, and access policy for what they hold.
Secrets management governs only credentials that were deliberately placed in the vault. In most environments, that's a fraction of what exists.
Established
Acquired by IBM, 2024
Open-source secrets management platform for storing and controlling access to tokens, passwords, certificates, and encryption keys, with support for dynamic, short-lived secrets generated on demand for databases and cloud providers. Available as self-hosted Vault or as a managed service (HCP Vault). Broad integration ecosystem across major clouds, CI/CD systems, and orchestration platforms. The 2023 shift from MPL to BSL licensing affects how Vault can be used in competing products, a consideration for new Enterprise contracts following the IBM acquisition.
Best fit: Platform engineering teams needing a flexible, multi-environment secrets backend with broad integration coverage. New Enterprise evaluations should confirm licensing and support terms directly given the change in ownership.
→
CyberArk Conjur covers secrets management as part of CyberArk's broader machine identity portfolio. See CyberArk under PAM and IAM with NHI Extension (05).
Managed secrets storage for AWS environments, with automatic rotation for RDS, Redshift, and DocumentDB credentials and native IAM integration. Scope is limited to AWS; multi-cloud or hybrid environments require a separate or additional secrets layer. Pricing is per secret stored plus per API call.
Best fit: Organizations running primarily on AWS that want low-overhead secrets management integrated with IAM, without a separate platform.
Managed key and secrets management for Azure environments, with HSM-backed key protection options and integration with Microsoft Entra ID. Scope is limited to Azure. Microsoft's broader NHI capabilities, including Entra Agent ID, are positioned as extensions of the same identity stack.
Best fit: Organizations standardized on Azure or the Microsoft ecosystem where native Entra ID integration is the priority.
Managed secrets storage for GCP environments, integrated with IAM and Cloud Audit Logs. Scope is limited to GCP. For service-to-service authentication within GCP, Workload Identity Federation is a separate, credential-free alternative to storing secrets.
Best fit: Organizations running primarily on GCP, evaluated alongside Workload Identity Federation for service-to-service authentication.
Specialists
Secrets detection platform monitoring public and private repositories, CI/CD pipelines, containers, infrastructure-as-code, and collaboration tools for exposed credentials in real time. The company's State of Secrets Sprawl report found 28.65 million hardcoded secrets added to public GitHub in 2025. GitGuardian NHI Governance, added in 2024, extends the platform with lifecycle management integrations across HashiCorp Vault, CyberArk Conjur, and cloud secrets managers, covering vault-backed credentials but not SaaS OAuth tokens or AI agent identities.
Best fit: Organizations whose primary exposure is credentials committed to source code, CI/CD configuration, or container images, with developer-workflow-native detection.
03
Workload Identity and Access Management
What this category does
Workload identity replaces static credentials with cryptographic attestation: a service proves what it is through a short-lived identity document issued by a trusted authority, rather than presenting a stored password or key. SPIFFE is the open standard underlying this category.
Implementation requires more engineering investment than secrets management, and does not address legacy systems that cannot participate in attestation.
Commercial workload identity and access management platform. Manages workload-to-workload authentication and authorization without static credentials, across AWS, Azure, GCP, Active Directory, Kubernetes, and Microsoft Entra ID. Policy is enforced at the point of access based on context, not only on whether a workload can authenticate. Built on SPIFFE; provides the implementation layer that organizations would otherwise build on open-source SPIRE.
Best fit: Organizations moving cloud-native workloads from static secrets toward workload identity, without building and operating SPIRE directly.
Open standard (SPIFFE) and reference implementation (SPIRE) for workload identity. SPIFFE defines the identity format and workload API; SPIRE issues and manages the resulting identity documents. Integrated into Google Cloud, Azure, Istio, cert-manager, HashiCorp Consul, Dapr, and Vault Enterprise 2.0, and packaged into OpenShift by Red Hat. Running SPIRE in production across hybrid environments requires dedicated engineering investment and ongoing operational ownership.
Best fit: Organizations with the engineering capacity to build and operate SPIRE directly, or already running infrastructure with native SPIFFE integration. Also the reference point for evaluating commercial workload identity platforms.
Just-in-time access management for human and non-human identities across AWS, Azure, GCP, Snowflake, Kubernetes, and major SaaS platforms. Permissions are granted for a defined window and removed automatically afterward, including for service accounts and automation that would otherwise hold standing privileges.
Best fit: Organizations implementing time-bound access for cloud infrastructure across both human administrators and automated processes.
Cloud access governance platform with a request-and-approval workflow for temporary AWS and GCP access, covering both human users and non-human service identities and workload identities. Narrower scope than Britive, with a workflow built around engineering teams rather than enterprise access management.
Best fit: Engineering-led organizations wanting JIT access for humans and service identities in AWS and GCP without an enterprise access management platform.
→
CyberArk Workload Identity Manager covers SPIFFE-based workload identity as part of CyberArk's broader machine identity portfolio. See CyberArk under PAM and IAM with NHI Extension (05).
04
Certificate Lifecycle Management
What this category does
Certificate lifecycle management platforms handle the discovery, issuance, renewal, and revocation of TLS and other certificates at enterprise scale. The driving procurement concern is operational: certificate expiry causing outages, and certificate inventories too large to track manually.
→
CyberArk (formerly Venafi) covers certificate lifecycle management as part of CyberArk's broader machine identity portfolio. See CyberArk under PAM and IAM with NHI Extension (05).
Enterprise PKI and certificate lifecycle management platform covering discovery, issuance, renewal, and revocation across cloud, on-premises, and hybrid environments. Keyfactor EJBCA is an open-source certificate authority covering issuance; Keyfactor Command is the enterprise CLM layer built on top of it.
Best fit: Organizations needing enterprise CLM with certificate authority management, independent of the CyberArk ecosystem. Common in regulated industries with complex PKI requirements.
Certificate automation and PKI management platform covering renewal, rotation, and remediation workflows across multiple certificate authorities and environments, aimed at organizations managing large, heterogeneous certificate inventories.
Best fit: Organizations needing CLM automation at mid-market pricing, frequently evaluated alongside Keyfactor.
05
PAM and IAM with NHI Extension
What this category does
Established PAM and IAM vendors have extended existing platforms to cover non-human identities rather than building separate products. These extensions are strongest for service account governance within environments already under PAM management, and weakest at discovering credentials that were never under PAM management or at governing AI agent identities.
Also in 02 · 03 · 04
CyberArk's machine identity portfolio spans privileged access management, secrets management, and certificate lifecycle management under one vendor. Conjur provides enterprise secrets management with native integration into CyberArk's broader identity platform. Workload Identity Manager, built from the 2024 acquisition of Venafi, provides SPIFFE-based ephemeral workload identity and certificate lifecycle management. Password Safe and related PAM tooling cover service account discovery and credential rotation within environments already under CyberArk management. The Secure Workload Access Solution, announced in 2025, is intended to unify these components into a single view for multi-cloud machine identity governance; integration across the components is ongoing.
Best fit: Organizations with existing CyberArk PAM investment, or those needing certificate lifecycle management, secrets management, and service account governance from a single vendor. Each product layer, Conjur, Workload Identity Manager, and Password Safe, should be evaluated against its specific use case rather than assumed to operate as a single unified platform today.
PAM platform with service account management and privileged credential governance through Password Safe, covering automated discovery and rotation for service accounts and application credentials within environments already under BeyondTrust PAM management. Does not cover SaaS OAuth tokens, cloud-native workload identity, certificate lifecycle, or AI agent credentials.
Best fit: Organizations already running BeyondTrust PAM that need service account and application credential governance within that environment.
Cloud-native identity governance and administration (IGA) platform, extended in 2025 to cover non-human identities, including workloads, bots, and service credentials, under the same governance model used for human identity. The NHI capabilities were added more recently than the platform's core IGA functionality.
Best fit: Organizations already using or evaluating Saviynt for IGA that want non-human identity governance within the same platform.
Microsoft's identity platform, extended in 2025 with Entra Agent ID, which assigns individual identities to AI agents with conditional access, lifecycle management, and monitoring. Also covers service accounts, managed identities, and workload identity federation for Azure workloads. Coverage is concentrated within the Microsoft ecosystem (Azure, Microsoft 365, Entra ID) and limited outside it.
Best fit: Organizations whose NHI exposure is concentrated in Azure workloads, Entra ID service accounts, and Microsoft 365 integrations.
Where to go next
The landscape overview explains the trade-offs between vendor categories. The comparisons cover the most frequently co-evaluated pairs. The guides go deeper on operational problems: NHI discovery in environments without an existing inventory, when secrets management is structurally insufficient, and what AI agent identity governance requires in practice.