Orchid Security Uses Data at Speed and Scale to Protect Thousands of Client Applications
With Snowflake, Orchid Security gains visibility into complex security landscapes, simplifies identity management and quickly gives clients the insights to keep app access in the right hands.
80%Faster analysis keeps clients ahead of evolving vulnerabilities
1M+Number of user identities analyzed to reduce security risks
Industry
TechnologyLocation
Tel Aviv, IsraelProviding the cornerstone of cybersecurity for enterprises worldwide
Data is a valuable asset to any modern organization, but if sensitive data gets into the wrong hands it can have major repercussions. Those looking to protect their data know that compromised credentials present a significant security risk, leading to data breaches, noncompliance and financial loss. That’s why robust identity security is integral to protecting what matters most. At the same time, in a world where AI agents are being introduced at a rapid rate, keeping application access verified and authorized is only growing harder.
For many organizations, gaining visibility of who has access to what is a significant challenge, and one that often requires specialist support. Orchid Security solves that challenge, making identity behavior transparent to its clients, detecting risk, presenting results in intuitive dashboards and enforcing policies to automate remediation. The result is full visibility of any identities across any applications, and a much simpler way of keeping access in the right hands.
While the end result is simplicity for its customers, achieving it is extremely complicated. The company works with large enterprises, each with millions of accounts across human and agent users and thousands of applications. To manage this massive amount of data, Orchid Security uses Snowflake’s AI Data Cloud.
Using Snowflake, the company can ingest data at any scale, incorporate AI workflows to automate and accelerate analysis, and quickly surface insights to provide a near real-time view of potential risk.
Story highlights
Analyzing millions of users and thousands of applications: With Snowflake, Orchid Security ingests customer data at scale and speed to ensure identity security for its clients.
Accelerating data analysis from hours to minutes with AI: Using LLMs to automate exploration processes and Dynamic Tables to orchestrate data pipelines, the company has shaved hours off the time it takes to analyze customer applications.
Presenting the insights that matter, exactly when they’re needed: Through Snowflake dashboards, Orchid Security can present vital information to its clients, incorporating AI capabilities so they can explore findings in natural language.
Developing an all-encompassing approach to identity security
The difficulty with identity security is that it’s easy to identify as a problem but complicated to solve. Most organizations’ security stacks are made up of a patchwork of tools, including those responsible for authentication, user provisioning, reporting and governance. But every application within an organization must be manually onboarded to each of those tools, a process that takes vast amounts of time and money. In organizations with hundreds of apps, this often leads to gaps and oversights.
“Identity doesn’t live in the directory. It lives inside the applications as local accounts, embedded credentials and service accounts nobody provisioned,” says Roy Katmor, CEO and Co-Founder at Orchid Security. “In the environments we assess, anywhere from 30% to over 60% of identities aren’t managed by the stack that’s supposed to manage them. And the half you can’t see is the half that gets used.”
To remediate this, Orchid Security takes an entirely different approach to identity management, using an automated observability tool to find all applications with remote login capability as a starting point. It then collects information about authorized accounts, authentication flows, groups and permissions to provide complete risk visibility.
Providing this service requires a platform capable of hosting substantial amounts of data. Today, the company uses Snowflake on AWS to ingest and store all of its client application and user data, using dbt (data build tool) to transform it before delivering insights through intuitive Snowflake dashboards. These dashboards, which can be explored by customers in natural language using LLMs, deliver insight into vital criteria such as overall security coverage, the number of unsecured apps and which applications present the biggest risk.
Counting identities is the easy part. Mapping how they connect is the problem, with hundreds of millions of accounts, each reaching resources through nested roles and groups. You’re not running a query, you’re recomputing a graph, continuously. That’s the workload we needed Snowflake for.”
Or Gaizer
Head of Infrastructure and Integration, Orchid Security
Driving new data efficiencies to provide timely, actionable security insights
Speed to insight is vital for organizations that need to protect IT environments against emerging threats, and Orchid Security has unlocked a wealth of efficiencies through Snowflake that help its clients protect their estates before vulnerabilities cause harm.
One of the major benefits is the speed at which Orchid can now ingest and explore data. With Snowflake’s Dynamic Tables, scheduling and background updates are automated and data is surfaced through predefined parameters, resulting in far more efficient data pipelines. As a result, Orchid Security can ingest data every 30 minutes to provide the timely view of application security its customers need.
The company also uses LLMs that directly integrate with its Snowflake data to transform the analysis of applications. While it previously took around four hours to analyze the security vulnerabilities of a single app, the process now only takes 42 minutes, resulting in lower infrastructure costs and faster insight delivery and remediative action for end customers.
Orchid Security’s ability to rapidly produce insights translates to significant benefits for those end customers, who range from major retailers to energy companies. This is especially relevant when it comes to drilling into the specifics of their identity environments, each of which has its own nuances and complexities. “I probably get bespoke customer requests for new security insights every hour,” says Sagi Rika, Head of Data and Applications at Orchid Security. “Snowflake makes it very easy to serve those requests. It allows me to look at my data structure and really quickly understand how to turn that data into actionable insight.”
Other cybersecurity companies working at this data volume pointed us to Snowflake. I brought it in as a data warehouse — that’s all I wanted it for. But after we started working with it, it turned into the engine the analysis actually runs on.”
Sagi Rika
Head of Data and Applications, Orchid Security
Combining speed with simplicity for seamless workflows
When solving complex problems for customers, few things are more important than having simple workflows. With Snowflake, Orchid Security has a fully managed service that saves hours of engineering time, which can be redirected to building new products and features.
“We have a complicated system, so our engineers before Snowflake spent a lot of time debugging data flows and understanding why we saw certain results,” says Rika. “With Snowflake we can forget all of that. We have great visibility of what’s going on and can focus on developing our product instead of untangling things.”
Orchid’s team also uses various Snowflake features to make data exploration and analysis simpler. Through Snowpark, it applies Python code directly to data within Snowflake, removing the effort and risk of moving data to a separate environment — something that had previously caused memory issues. Internal business users can also take advantage of Snowflake’s integration with Metabase, a platform that enables nontechnical staff to build their own dashboards using natural language prompts. This dramatically reduces the number of requests required from engineers to provide business insights, as well as the time it takes to surface them.
“I used to spend a long time pulling this data manually into CSVs to serve marketing teams and the C-level,” says Rika. “Now, our users can configure almost everything they need themselves.”
Before Snowpark, we were frequently hitting memory limits – that was the cost of moving data out to process it. Now, almost everything runs through Snowpark or dbt, where the data already sits. One place, one source of truth.”
Sagi Rika
Head of Data and Applications, Orchid Security
Embracing cost control, clarity and a foundation for the future of application security
In Snowflake, Orchid Security has found a platform that can ingest the vast amounts of data needed to keep access to applications safe, visible and controlled for its clients. It’s also a platform that helps the company better control its own costs and security.
Granular visibility into use and automated alerts to finance teams mean that spend stays transparent and controlled, while Snowflake’s built-in security and governance controls help keep the company’s own identity management in check.
“We have around 20 different roles here, so one of the reasons we chose Snowflake is that we can separate permissions at a really granular level, both for agent accounts and humans,” says Rika.
Going forward, the company plans to explore the role Snowflake Cortex AI can play in delivering new AI capabilities, so it can consolidate more of its data and AI estate with Snowflake, and quickly roll out new features and products to customers.
“We ship new capabilities every month because our engineers aren’t spending their days moving data around,” says Katmor. “That matters right now, because nonhuman and agentic identities are arriving in our customers’ environments faster than anyone planned for, and we have to keep up with them.”
