Orchid Security Raises $36M to Take On Identity Management

An identity-first security orchestration startup led by the former CEO of enSilo raised $36 million to develop identity infrastructure that enhances compliance and defense.

See Also: AI Surge Drives a 40-1 Ratio of Machine-to-Human Identities

New York-based Orchid Security will use seed funding from Team8 and Intel Capital to enable seamless identity consumption for enterprises by taking on regulatory issues in identity management, according to co-founder and CEO Roy Katmor. He said Orchid will address organizational challenges around compliance, identity standards and application onboarding in verticals with high regulatory burdens.

“We were waiting to get a big problem that we were confident that we can actually solve,” Katmor told Information Security Media Group. “It’s not easy, especially not in the in the security space. Once we felt that we do have the significant pain that was verified by more than 300 different CISOs out of the Team8 village, we knew that we had something solid in hand.”

Orchid Security, founded in 2023, employs 40 people, and has been led since inception by Katmor, who founded endpoint detection and response startup enSilo in 2014 and sold it to platform security player Fortinet for $15.8 million. Following the acquisition, Katmor ran Fortinet’s endpoint security business for more than three years (see: Microsoft, Ping, Okta Dominate Access Management Gartner MQ).

Why Existing Identity Management Solutions Fall Short

Katmor said Orchid spent a lot of time validating the existence of a critical pain point before committing to a solution, with identity management flagged due to high levels of concern from global enterprises but low levels of satisfaction with existing solutions. Orchid has positioned itself as an infrastructure provider that helps organizations maximize their existing security and compliance investments.

“I’m not coming to replace any solution in identity,” Katmor said. “We are an infrastructure that helps to consume identity to the adherence of compliance.”

Existing identity solutions often introduce complexity by requiring applications to adapt to them rather than the other way around. This creates friction and limits the effectiveness of identity investments, especially for organizations in regulated settings. Orchid addresses this gap by offering an infrastructure that simplifies application onboarding and ensures compliance without disrupting existing workflows.

“Identity solutions do not adjust themselves to the environment,” Katmor said. “The other way around is the truth. So, you’re getting complexity by design. How do you know which applications you have? How do you know which compliances and what controls they’re actually enforcing? And if that wasn’t enough, it’s dynamic. Applications will change. The audit and regulatory requirements will change.”

Orchid has created a scalable tool to simplify the onboarding and management of diverse applications, Katmor said. The company uses LLMs to analyze the instructions applications send to operate, derive context, and understand application behavior without modifying the applications themselves. The LLMs not only process application instructions but also provide detailed explanations of their outputs, he said.

“LLMs now give you explainability,” Katmor said. “So, if you want to make sure that you are coherent with what the LLM is claiming it’s seeing, you can now get evidence that those pieces of telemetry were collected. Basically, it can give you the thought process for the LLM, and then you can actually know how confident it is with what it actually says.”

Why Large Enterprises Are Drawn to Orchid Security

Fortune 500 companies were among the early adopters of Orchid, with 40 design partners signing up within 30 days of outreach and high-profile organizations like Costco and Repsol becoming customers before the product was even launched widely, he said. Another early adopter of Orchid’s technology was Intel, which Katmor said provided critical validation of the technology’s scalability and relevance.

“We said, ‘There’s a magic box, and the magic box allows you to take the mess that you currently have, take the regulatory frameworks that you’re subject to, and on the other side of it, basically make everything utilized to the best of identity standards and compliances out of the box with no change of code,'” Katmor said.

Orchid focuses on highly regulated industries like banking, financial services, insurance, manufacturing, utilities, retail and healthcare, Katmor said. These sectors face heightened compliance challenges and rely on self-hosted applications, making them ideal candidates. Orchid has integrated its solution with existing identity stacks to offer customers accelerated value without replacing their current systems.

“To some degree, application vendors have the motivation to add those type of feature sets,” Katmor said. “But when you host your own, you’re completely on your own, so you’re accountable, and therefore your problem is bigger. And as a bigger problem, we want to make sure that we are addressing not just the pain, but the right verticals that suffer the most.”

Orchid tracks customer acquisitions, deal size and cost-efficiency ratios to ensure scalability, Katmor said. He stressed the importance of balancing growth with operational efficiency, particularly given the resource-intensive nature of LLM-based solutions. With an average annual deal size of $250,000 and six Fortune 500 customers onboarded within the first 12 months, he said Orchid has shown early success.

“Topline revenue is the king still, and so you need to show growth,” Katmor said. “We raised a lot of money. Our valuation is significantly high. So, the tracking should be, ‘Can we really align and stand and show that our valuation is really justified?’ I think we’re showing a very strong path towards that.”