Security Independently confirmed 2 publishers 3 min read Published Sep 10, 2026, 4:19 PM PDT

Orchid ships drift detection and a kill switch for agents that inherit unmanaged identity

The new controls compare an agent's runtime behaviour against its authorized scope and can revoke the credentials underneath it. The 57% unmanaged-identity figure behind the pitch is Orchid's own, and neither publisher gives the method.

The Watch · Security desk

Send a correction

What happened

Orchid Security added identity drift detection and application-level kill switches to its Identity Control Plane, so a team can revoke an agent's authority when its behaviour leaves approved parameters.
The mechanism Orchid describes is inheritance: agents locate hard-coded credentials, orphaned accounts, unmanaged authentication paths and excessive permissions, and exceed intended scope without breaking a control.
The platform now tags applications, identities and access paths with an AI readiness status, flags risky accounts, and monitors agent behaviour continuously for drift.

Why it matters

What it limits constraint Containment work moves out of the directory and into individual applications: if only about a third of nonhuman accounts are visible to standard IAM, the other two thirds are revoked by whoever owns the app.
Who's exposed exposure The accounts at issue are reachable today by anyone who already holds that access. Agent programmes change how fast the route gets used, not whether it exists.
What doesn't add up contradiction Two publishers carry the same vendor survey in different words, one as a percentage and one as a ratio, and neither gives sample or method, so a buyer cannot check the size of the gap being priced.
Who has to decide decision With boards asking how fast AI can scale, what a security team is deciding is sequencing: the account inventory has to come first, because the kill switch needs something enumerated to cut.

Next story · Security · Sep 29

Palo Alto Networks runs AI-agent network policy on NVIDIA BlueField processors

Confirmed2 publishers

No CVE and no incident, and nothing here carries a patch deadline. What the announcement describes is a mechanism, and the mechanism is old: hard-coded credentials, orphaned accounts, unmanaged authentication paths and excessive permissions ^[19]. Anyone who has run an access review has met those accounts, and an agent is a new consumer of them.

The figure carrying the pitch is the vendor's own. Orchid's Identity Gap 2026 report puts 57% of enterprise identity as unseen and unmanaged ^[3]. SC World, citing Silicon Angle, reports the same survey finding that invisible identities outnumber visible ones, with two-thirds of nonhuman accounts provisioned inside applications and beyond the reach of standard identity and access management tools ^[4]. At 57% unseen against 43% managed, that is roughly 1.3 unmanaged identities for every managed one ^[11]. Neither publisher gives a sample size, a sector split, or how "unseen" was counted.

The two-thirds number is the operationally useful one. If two-thirds of nonhuman accounts live inside applications, about one third sits where a directory-level revocation can reach it ^[13]. That is the gap the application-level kill switch is aimed at ^[1].

Orchid says agents can turn unmanaged identity into an active path to elevated access in seconds to minutes, faster than periodic governance reviews can detect or contain it ^[20], and that agents can complete authorized objectives beyond their initial privilege level within seconds ^[18]. Neither source cites telemetry, logs, or a case behind those intervals ^[16].

"AI transformation is exciting. Identity hygiene is not," said Roy Katmor, CEO of Orchid Security ^[12]. Enterprises, he said, need to "observe how agents act, understand when they drift, and govern them immediately, including terminating the authority through which they operate" ^[14].

The regulatory hooks in the announcement are general. NIST's draft Cyber AI Profile says that "regardless of where organizations are on their AI journey, their cybersecurity programs need risk management approaches that support and integrate the realities of advancements in AI" ^[7]. On Europe, the announcement's reading of DORA is that financial entities must demonstrate control over ICT access and third-party dependencies, and that the obligation does not pause when the actor is an agent ^[8].

Orchid's own precondition list is the part a defender can act on without buying anything: every orphaned, dormant, local and over-privileged account identified and assigned a readiness status before autonomous agents are deployed at scale ^[9]. That is an access review. It has to exist before a kill switch has anything to cut.

The response actions Orchid lists run from reducing permissions and revoking credentials to disconnecting tools and suspending workflows, with the application-level kill switch as the terminal option ^[5]. Integrations with Palo Alto Networks' Idira and Splunk Enterprise Security are available, according to SC World ^[6]. The capabilities follow agentic enhancements Orchid made to its Identity Control Plane in May ^[17].

What to watch

Whether Orchid publishes the Identity Gap 2026 methodology: sample size, sector split, and how an identity was counted as unseen.
A documented case, with logs, of an AI agent using an orphaned or application-local account to escalate, filed by a responder.
Whether NIST's Cyber AI Profile leaves draft with agent-specific identity requirements, and whether DORA supervisors start asking financial entities for agent delegation chains.

Clarity's read

What the record supports and how the coverage leans. The claims behind it follow.

Reality

Evidence28
Adoption14
Hype gap+38
Incentives88
Confidence62

Why these scores

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[1]
Orchid Security has announced identity drift detection and application-level kill switches for AI agents.
Reported SupportedView cited source
[2]
Orchid Security has enhanced its Identity Control Plane with identity drift detection and application-level kill switches intended to let security teams quickly revoke an agent's authority if its behaviour deviates from approved parameters, according to a Silicon Angle report cited by SC World.
Reported SupportedView cited source
[3]
Orchid's Identity Gap 2026 report found that 57% of enterprise identity is unseen and unmanaged.
Reported SupportedView cited source
[4]
Orchid's "The Identity Gap: 2026 Snapshot" report said invisible identities outnumber visible ones, with two-thirds of nonhuman accounts provisioned within applications, beyond the reach of standard identity and access management tools.
Reported SupportedView cited source
[5]
Response actions can include reducing permissions, revoking credentials, disconnecting tools, suspending workflows or activating Orchid's application-level kill switch.
Reported SupportedView cited source
[6]
Integrations with Palo Alto Networks' Idira and Splunk Enterprise Security are also available.
Reported SupportedView cited source
[7]
NIST's draft Cyber AI Profile notes that "regardless of where organizations are on their AI journey, their cybersecurity programs need risk management approaches that support and integrate the realities of advancements in AI."
Reported Supported Source: NIST draft Cyber AI Profile, quoted in Orchid's announcementView cited source
[8]
Orchid's announcement states that in Europe, DORA obliges financial entities to demonstrate control over ICT access and third-party dependencies, an obligation that does not pause because the entity acting is an agent rather than a person.
Reported SupportedView cited source
[9]
Orchid says that before autonomous agents are deployed at scale, every orphaned, dormant, local and over-privileged account should be identified and assigned a readiness status.
Reported SupportedView cited source
[10]
The updated platform tags applications, identities and access paths with an AI readiness status, identifies risky accounts, and continuously monitors agent behaviour for drift.
Reported SupportedView cited source
[11]
If 57% of enterprise identity is unseen and unmanaged, the remaining 43% is managed, so unmanaged identities outnumber managed ones by roughly 1.3 to 1.
Derived Supported
[12]
"AI transformation is exciting. Identity hygiene is not," said Roy Katmor, CEO of Orchid Security.
Reported Supported Source: Roy Katmor, CEO, Orchid SecurityView cited source
[13]
If two-thirds of nonhuman accounts are provisioned inside applications and beyond standard IAM tooling, about one third remain where directory-level identity tooling can reach them.
Derived Supported
[14]
Katmor said enterprises need to "observe how agents act, understand when they drift, and govern them immediately, including terminating the authority through which they operate."
Reported Supported Source: Roy Katmor, CEO, Orchid SecurityView cited source
[15]
Orchid generates an audit trail linking each agent action to the identity used, delegation chain, access path, business context, detected drift and resulting governance response.
Reported SupportedView cited source
[16]
Neither published account of the announcement reports an incident, a CVE, or exploitation telemetry supporting the stated escalation intervals.
Derived Supported
[17]
The new capabilities follow agentic enhancements to Orchid's Identity Control Plane in May.
Reported SupportedView cited source
[18]
AI agents can complete authorized objectives beyond their initial privilege level within seconds, and do not need to break security controls or workflow guardrails to do so.
Reported InsufficientView cited source
[19]
AI agents can find and use the identity debt already embedded across the enterprise: hard-coded credentials, orphaned accounts, unmanaged authentication paths and excessive permissions.
Reported InsufficientView cited source
[20]
Orchid says agents can turn unseen identity into an active path to elevated access in seconds to minutes, far faster than periodic governance reviews can detect or contain it.
Reported InsufficientView cited source
[21]
Boards have moved from asking whether their companies should adopt AI to asking how quickly they can scale it, and Orchid says resisting is no longer a viable security posture.
Reported InsufficientView cited source

Sources

2 independent publishers whose own reporting we read for this story.

helpnetsecurity.com
1 article · September 9, 2026
Orchid Security targets AI agent risk with drift detection and kill switches
scworld.com
1 article · September 9, 2026
Orchid Security adds AI agent controls to identity platform

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

Builder

Only Help Net Security carries the mechanism, and it is Orchid's own description: capture what an agent actually does, compare it against the agent's original purpose and authorised scope, then act through the identity and security tooling the customer already runs. What counts as drift is never defined. There is no threshold, no detection interval, and no word on how an application-level kill switch reaches a credential hard-coded inside the application it is meant to cut off. The two integrations are the most concrete engineering detail on offer: Idira discovery of privileged accounts it did not already know about, and identity telemetry streamed into Splunk Enterprise Security for correlation and investigation.

Operator

The release reads as a control checklist and Help Net Security prints it: every orphaned, dormant, local and over-privileged account assigned a readiness status, a response ladder that ends in terminating the authority a drifting agent runs on, and an audit trail tying each action to identity, delegation chain, access path and business context. For anyone who has to answer a DORA examiner about ICT access, that mapping is the usable part. The evidence for urgency is another matter. The seconds-to-minutes escalation window and the 57% unmanaged share both come from Orchid, and Findlay Automotive's Shannon Wilkinson is quoted on the pressure of adopting agents, not on running this product: "The challenge is how to enable the business to move faster and realize the productivity that AI agents bring, but it honestly terrifies a lot of us."

Investor

Nothing here prices the company. No funding, no headcount, no customer count, no list price for the new controls, no indication of how many of the accounts in question a deployment typically finds. The market claim is Orchid's own research: 57% of enterprise identity unseen and unmanaged, two-thirds of non-human accounts provisioned inside applications where directory tooling cannot see them. On those same numbers, about a third of non-human accounts remain within its reach. The May agentic update and this September one are the only visible product cadence, and the certified Palo Alto Networks integration is the only third-party validation in either account.