Obsidian Security

Overview

Obsidian Security protects the identities that live inside SaaS applications: user accounts, sessions, OAuth integrations, browser extensions and, increasingly, AI agents acting in Microsoft 365, Salesforce, Workday, GitHub, Snowflake and similar platforms. Founded in 2017 by alumni of Cylance and Carbon Black, it is privately held. In August 2026 it raised an 85 million dollar Series D at a 1.1 billion dollar valuation, led by Crescent Cove with Greylock and Menlo Ventures participating, and it now pitches itself as much on AI agent security as on ITDR. It remains independent while much of the adjacent non-human identity market has been bought; see the identity consolidation report.

What it is good at

Post-authentication threat detection in SaaS. Most identity attacks that matter now succeed after MFA: adversary-in-the-middle phishing, session hijacking, and stolen OAuth tokens. Obsidian builds activity baselines per user and per app and flags token use from atypical places, which is the gap an IdP alone does not cover. Its ITDR module adds a browser extension that blocks credential submission to phishing pages and inventories the extensions and AI tools people actually use.

Third-party and agent risk is the second strength. Obsidian maps app-to-app OAuth grants, service accounts and agent connections, then flags excessive or unowned access, which is the attack path behind the 2025 wave of SaaS supply chain breaches through connected apps. Integrations to Microsoft Sentinel and other SIEM and SOAR tools make it usable by an existing SOC rather than another console.

Where it falls short

Scope stops at SaaS and the browser. There is no coverage of domain controllers, Kerberos or on-premises Active Directory, so it complements Semperis, Microsoft Defender for Identity or CrowdStrike Falcon Identity rather than replacing them. Depth varies by application: the large platforms get rich telemetry, long-tail apps get posture checks at best. The browser extension needs managed-browser rollout, which is an endpoint project in its own right. Remediation mostly runs through the source app or your SOAR, not natively.

Pricing

Partly published. The pricing page lists a Free tier for up to 1,000 users (shadow SaaS and AI discovery plus spear phishing detection); the Foundations and Advanced tiers are quote-only, with no unit stated. Compare its position in the Identity Pricing Transparency Index.

Best for, and who should look elsewhere

Obsidian fits SaaS-heavy enterprises whose SOC needs detections for token theft and account takeover inside Microsoft 365, Salesforce and peers. Deployment is API-based and quick for the core apps (days, not months); the browser extension is what takes planning. Teams that mainly want posture and remediation workflows with business-user involvement should compare Valence Security; browser-first shadow SaaS discovery buyers should also look at Push Security and Grip Security. See the ITDR rankings.

Bottom line

One of the strongest options for detecting identity attacks that land after login inside SaaS. Pair it with a directory-focused ITDR tool if you still run Active Directory.