Silverfort

Silverfort: frequently asked questions

How much does Silverfort cost?

Silverfort publishes no prices on its own site (checked 2026-11-05). Its pricing page says pricing is based on the size of the organization, across four packages: Core, Plus, Advanced and Enterprise, with AI Agent Security as an add-on. Its AWS Marketplace listing does carry a figure: $15,000 for 12 months, with 24 and 36 month terms available but unpriced, metered by Number of Employees, defined as the number of employees in the organization. On Silverfort's own pricing page, Standard support is included, Premier adds 10% of licence cost and Diamond adds 20%.

How does Silverfort's agentless architecture actually work?

Silverfort calls it Runtime Access Protection, operating inside the existing identity infrastructure rather than as a proxy or endpoint agent. The documented flow is that the identity provider forwards an authentication request to Silverfort, Silverfort performs risk analysis, and the identity provider then grants or denies. For Active Directory it analyses every authentication request and pushes MFA where policy requires it. Worth knowing before you buy: Silverfort's public documentation does not specify the protocol-level mechanics, whether anything is installed on domain controllers, or where the product sits on the network. Third-party claims of inline Kerberos, NTLM and LDAP inspection are not confirmed by a Silverfort source. Ask for an architecture document during evaluation.

What has Silverfort acquired?

Two companies. Rezonate, announced 13 November 2024, added identity threat detection and posture management; terms were not disclosed, though press reported a value in the tens of millions. Fabrix Security, announced 28 April 2026, also on undisclosed terms, brought a team from Run:ai, Orca Security, Microsoft Entra and Microsoft Defender for Cloud; Fabrix had raised 8 million dollars. Silverfort said the majority of joint Fabrix capabilities would land in the second half of 2026.

Does Silverfort have known vulnerabilities?

No CVEs are assigned to Silverfort in the National Vulnerability Database, and no Silverfort product appears in the CISA KEV catalog. Read that carefully: for a privately held, closed-source product with no published advisory feed, a zero-CVE record is weak positive evidence rather than proof of security. Separately, Silverfort's research team has published vulnerabilities it found in Microsoft Active Directory, including a domain controller crash issue and an NTLM group policy bypass. Those are flaws in Microsoft's product, not Silverfort's, and should not be read as either.

Is Silverfort SOC 2 or ISO 27001 certified?

Silverfort's trust centre is login-gated and its public security pages return 404, so we could not verify any certification from a primary source. Third-party summaries claim SOC 2 Type II and ISO 27001, and the AWS Marketplace listing references a trust centre, but no certificate or attestation is publicly enumerated. No FedRAMP listing was found, though the FedRAMP API changed in 2026 so treat that as unverified rather than a confirmed negative. Ask for attestations directly.

Who owns Silverfort in 2026?

Silverfort is private and venture-backed. Its last disclosed round was a $116 million Series D announced on 23 January 2024, led by Brighton Park Capital with Acrew Capital, Greenfield Partners, Citi Ventures, General Motors Ventures, Maor Investments, Vintage Investment Partners and Singtel Innov8, taking total funding to $222 million. TechCrunch reported a $1 billion valuation, a figure Silverfort did not state. Its newsroom shows no funding round since; its 2026 moves were the Fabrix Security acquisition in April and partnerships with SentinelOne and Microsoft Copilot Studio.

What does Silverfort actually cover?

Current modules are identity security posture management, Universal MFA, non-human identity security, AI agent security, an authentication firewall, ITDR, access intelligence, privileged access security and an identity graph. The strongest use case remains the original one: extending MFA to systems that cannot support it natively, such as legacy applications, Active Directory authentication, command-line tools and service accounts.

What should I check in a Silverfort ITDR evaluation?

Ask for an architecture document first, because public docs do not explain where Silverfort sits relative to domain controllers or how it sees Kerberos and NTLM traffic. Then test the use case that justifies it: MFA on a legacy app, a command-line admin tool and a service account, with policy set to block rather than alert. Confirm which package holds ITDR and the authentication firewall (Advanced) versus privileged access security (Enterprise), price it against your employee headcount, and request SOC 2 or ISO 27001 attestations directly.

What are the best Silverfort alternatives?

For the legacy and Active Directory MFA problem specifically there is no exact like-for-like, which is much of Silverfort's value. For broader ITDR, compare CrowdStrike Falcon Identity Protection and Microsoft Defender for Identity. For service account and non-human identity discovery, Token Security competes directly; Astrix Security did too until Cisco acquired it in June 2026 and ended standalone sales. For privileged access, Silverfort's PAS module is lighter than a full platform from CyberArk, Delinea or BeyondTrust.