Best Identity Security Posture Management (ISPM) Tools in 2026: Access Held vs Access Used
Six tools that map human, machine, and agent identities to who owns them and what they actually use.
Rig says its correlation engine matches accounts to the right person with more than 96.8% accuracy, resolving an Okta login, an AWS IAM user, a GitHub handle, a Snowflake role, and an AI agent to one engineer. That is a vendor figure, but the problem behind it is real: when an agent runs inside a developer’s session, most identity tools only see the developer.
Identity security posture management (ISPM) finds the risky state before an attacker does: stale admin rights, service accounts with no owner, MFA gaps, and access that was granted and never used. It sits between governance, which decides who should have access, and identity threat detection, which catches abuse in progress.
Silverfort and CrowdStrike add posture to inline enforcement and ITDR. Cyera Identity, formerly Oasis Security, ties identity risk to the data each identity can reach. The newer entrants, Rig, Oak, and NewCore, build a graph of held versus used access across people, NHIs, and agents. They are listed after the established vendors because they came out of stealth in 2026 and their capabilities are stated rather than independently demonstrated.
How we evaluated
We read each vendor’s product pages, launch announcements, pricing pages, and public documentation on 14 Oct 2026, and checked each one against the same questions: which identity types it covers, whether it maps an owner to every NHI and agent, whether it compares granted with used access, and whether it can enforce as well as report. Where public material does not cover a question, we write “not documented”.
| Tool | Best for | What to check |
|---|---|---|
| Silverfort | Posture plus inline MFA across AD, legacy, and OT | AWS Marketplace: USD 15,000 per 12 months, priced on employee headcount |
| CrowdStrike Falcon Next-Gen Identity Security | Posture and ITDR on the Falcon platform | Licensed per active identity · quote |
| Cyera Identity | NHI and agent access tied to sensitive data | Ex-Oasis · quote |
| Rig Security | Resolving every account, key, and agent to one human owner | Launched Sep 2026 · quote |
| Oak | Held versus used access on a live identity graph | Launched Jul 2026 · quote |
| NewCore | Identity Discovery graph inside a security-first IdP | Launched Jun 2026 · quote |
Silverfort
CrowdStrike
Cyera Identity
Rig
Oak
NewCore
Technical matrix: the ISPM capability itself
Each row covers the posture capability only, separated from the other modules each platform sells (ITDR, MFA, IdP, DSPM, and governance), so you compare like with like.
| Identity correlation | Agent discovery | Privilege reduction | Integrations | Remediation | |
|---|---|---|---|---|---|
| Silverfort | Maps each AI agent to a human owner | AI Agent Security discovers agents, from the Plus package | Real-time access policy for agents | AD, cloud, legacy systems, and OT, inline on authentication | Policy enforcement inline |
| CrowdStrike Falcon | Discovers, correlates, and enriches human, non-human, and AI identities | AI identities included in discovery | Exposes overprivileged access; just-in-time privileged access | AD, cloud, and SaaS | Revoke sessions, require MFA, or block lateral movement |
| Cyera Identity | Ownership for NHIs and AI agents | NHI and AI agent discovery | Agentic access management | not documented | Risk ranked by sensitive data reach; remediation workflow not documented |
| Rig | RICE engine resolves accounts, keys, and agents to a human (vendor says 96.8%+ accuracy) | Yes, AI agents included in correlation | Least-privilege recommendations from usage | Cloud, SaaS, code, and endpoints; connector list not documented | Gatewatch blocks agent commands (launch claim) |
| Oak | Live graph of human, machine, and AI-agent identities | Yes, part of the graph | Held versus used access | AI connector framework for new apps | Platform agents remediate at the root cause (launch claim) |
| NewCore | Identity Discovery live graph | Agents as first-class identities | Trust scores per agent; reduction workflow not documented | Coverage outside NewCore’s IdP not documented | Policy change in the same IdP (launch claim) |
Cells summarize the vendor documentation and launch material cited in each entry. Launch claims are marked.
Silverfort
Best for hybrid estates with Active Directory, legacy systems, and OT
Silverfort sits inline on authentication across Active Directory, cloud, legacy systems, and OT without changes to those systems. Its platform covers ISPM, Universal MFA, an authentication firewall, ITDR, NHI security, and privileged access.
AI Agent Security, included from the Plus package up, discovers agents, applies real-time access policy, and maps each agent to a human owner.
Key features:
- ISPM and ITDR on one platform
- Universal MFA for systems other MFA cannot reach
- Authentication firewall for service accounts
- AI Agent Security with owner mapping
Why we like it:
It can act on a posture finding at authentication time, including on legacy and OT systems most tools only report on.
Limits:
Strongest on AD-centric estates. SaaS-only companies may get less from the inline layer.
License or pricing: Core, Plus, Advanced, and Enterprise packages are quote-based. AWS Marketplace lists USD 15,000 for a 12-month contract, priced on the number of employees.
CrowdStrike Falcon Next-Gen Identity Security
Best for Falcon customers adding identity posture and ITDR to the same console
CrowdStrike discovers, correlates, and enriches human, non-human, and AI identities, and exposes overprivileged access, misconfigurations, and attack paths. Detection is tied to enforcement: it can revoke sessions, require phishing-resistant MFA with FalconID, or block lateral movement.
At Fal.Con 2026 it added an Agentic Identity Provider that gives AI agents verifiable identities with short-lived, scoped access.
A named customer quote published by CrowdStrike, so read it as a vendor-selected reference. It speaks to the posture side of the product, not ITDR.
Key features:
- Identity posture across AD, cloud, and SaaS
- ITDR with real-time enforcement
- Just-in-time privileged access
- Agentic Identity Provider for AI agents
Why we like it:
Endpoint and identity signals in one console shorten investigations, and enforcement is built in.
Limits:
Strongest inside the Falcon platform. Module packaging and prices are not documented.
License or pricing: Licensed per active identity (accounts that authenticated in the last 90 days), per CrowdStrike pricing. No public rate.
Cyera Identity
Best for ranking NHI and agent risk by the data they can reach
Cyera completed its acquisition of Oasis Security on 3 Sep 2026. The Oasis non-human identity and agentic access platform now runs as Cyera Identity, joined to Cyera’s data security posture product.
The pitch is one view of what humans, machines, and AI agents can access and do, ranked by the sensitivity of the data behind that access.
Key features:
- NHI and AI agent discovery and ownership
- Agentic access management
- Risk ranked by sensitive data reach
- Shared platform with Cyera DSPM
Why we like it:
An over-privileged service account matters more when it can read customer records, and Cyera is the only option here that knows which records those are.
Limits:
The integration is weeks old. Which Oasis features carried over unchanged is not documented.
License or pricing: Commercial. No public pricing.
Rig Security
Best for tying every account, token, and agent back to a person
Rig came out of stealth in September 2026 with a USD 12M seed co-led by Ten Eleven Ventures and Brightmind Partners, with the CrowdStrike Falcon Fund participating. RICE, its correlation engine, resolves accounts, keys, service identities, and AI agents across cloud, SaaS, code, and endpoints to the human behind them.
On top sit attack-path posture, least-privilege recommendations, threat detection, and Gatewatch, which blocks an agent’s command on a laptop, server, or cluster without blocking the employee.
Key features:
- RICE identity correlation with owner inference
- Least-privilege recommendations from usage
- Correlated identity threat detection
- Gatewatch enforcement on agent commands
Why we like it:
It answers the question every incident starts with, whose is this, across agents and service accounts as well as people.
Limits:
Launch-stage. The 96.8% accuracy figure is Rig’s own. Supported connectors are not documented.
License or pricing: Commercial. No public pricing.
Oak
Best for posture and governance from one evidence graph
Oak’s posture signal is the gap between held and used access: its live graph of human, machine, and AI-agent identities shows which permissions are never exercised.
Built-in agents then remediate at the root cause, and the same graph drives Oak’s governance product. Its founders include Shai Morag, who previously founded Ermetic.
Key features:
- Held versus used access across identity types
- AI connector framework for new apps
- Root-cause remediation by platform agents
- Shared graph with Oak’s governance
Why we like it:
A finding is only useful if someone can fix it, and Oak puts the fix in the same product.
Limits:
Launch-stage. Detection of active identity attacks is not documented.
License or pricing: Commercial. No public pricing.
NewCore
Best when posture should come from the identity provider itself
NewCore launched in June 2026 with USD 66M.
As a posture tool, its difference is where a finding lands: Identity Discovery maps identities and access paths in a live graph, and because NewCore is also the IdP, a risky path can be closed with a policy change in the same product.
Key features:
- Identity Discovery live graph
- Agents as first-class identities with trust scores
- Split-key token signing
- One policy and audit trail for people and agents
Why we like it:
Identity Discovery maps access paths in a live graph, and because NewCore is also the IdP, a risky path is closed with a policy change in the same product.
Limits:
Launch-stage. Posture coverage for identities outside NewCore’s own IdP is not documented.
License or pricing: Commercial. No public pricing.
How to choose an ISPM tool
- List your identity sources. AD, cloud IAM, SaaS, code platforms, and agents. Check each vendor’s connectors against the list.
- Decide whether you need enforcement. Silverfort, CrowdStrike, and Rig can block. The others find and remediate.
- Test owner inference. Give each vendor ten real service accounts and score how many owners it gets right.
- Pilot the launch-stage tools. Rig, Oak, and NewCore should prove accuracy on your data before signing.
What we left out
- Okta Identity Security Posture Management and Microsoft Entra ID Protection: posture features inside the IdP, strongest if you already run that IdP. See Okta alternatives for the IdPs themselves.
- Standalone NHI tools such as Astrix: Cisco announced its intent to acquire Astrix in May 2026.
- Veza: a well-known access-graph option, now part of ServiceNow after an acquisition that closed on 2 Mar 2026, left out to keep the list to six.
What the internet thinks about identity posture
Live threads, quoted for the argument, not the score.
Hacker News · April 2026
“The agent didn’t delete the database, someone gave the agent write access to production. The culprit is in the IAM policy, not the prompt.”
A top reply to a viral post about an agent wiping a database. Others pushed back that agents need some write access to be useful, which is the case for tools that compare granted with used access.
Hacker News · June 2026
“Sandboxing is a solved problem, there are dozens of providers of firecracker instances to run your agent in. The problem to be solved is how do you define task-specific least privilege versions of your coding agent.”
From a thread on a still-open request to exclude sensitive files from OpenAI Codex. It names the gap posture tools target: knowing what access an agent actually needs, not only isolating where it runs.
Choose Silverfort for AD, legacy, and OT estates that need inline MFA. Choose CrowdStrike if Falcon is already your endpoint platform. Choose Cyera Identity when data sensitivity should drive identity priorities. Choose Rig when you cannot say who owns half your accounts and agents, and you can pilot a launch-stage vendor first. Choose Oak when posture and governance should share one graph and you can pilot a launch-stage vendor first. Choose NewCore when the IdP is being replaced and you can pilot it first.
FAQs
What is ISPM?
Identity security posture management: finding risky identity configurations, unused access, missing MFA, and unowned accounts across identity systems before they are abused.
How is ISPM different from ITDR?
ISPM fixes risky state ahead of time. ITDR detects identity attacks in progress. Silverfort and CrowdStrike sell both.
