WideField Security

What WideField Security does

WideField Security is a Santa Clara, California-based cybersecurity company founded in 2023 that builds an AI-driven identity security platform protecting human, non-human, and AI-agent identities across SaaS, cloud, and on-premises environments. The platform ingests API-based telemetry from identity sources such as Microsoft Entra ID, Google Workspace, Salesforce, Slack, GitHub, Snowflake, OpenAI, and Anthropic, and applies machine learning for behavioral baselining, OAuth application drift detection (using Isolation Forest, DBSCAN, and Holt-Winters models), authentication event analysis, and post-authentication session monitoring. Two US patents granted on June 2, 2026 cover the company's live session graph analysis and meta session stitching technology. The product is organized into persona-aligned capabilities for IAM teams, SOC teams, and CISOs, including a Daily Identity Risk Assessment that aggregates 60+ signals and a March 2026-launched AI Agent Identity Monitoring extension.

The company operates a subscription-based SaaS model with annual billing, quote-based pricing through a direct enterprise field-sales motion (Request a Demo), and targets large enterprise security organizations. Named reference customers include AMEX Global Business Travel and NOV, with CISO-level testimonials. In October 2025, WideField raised an $11.3 million Series A led by Crosspoint Capital Partners with Engineering Capital participating; Cisco Investments joined the round in March 2026. On June 18, 2026, Cisco announced its intent to acquire WideField to integrate its identity and session intelligence into Splunk's Agentic Security Operations Center — the company's third cybersecurity acquisition of 2026 following Galileo Technologies and Astrix Security. Financial terms of the acquisition were not disclosed. The founding team includes CEO Abhay Kulkarni and co-founders Kartik Kumar and Ron Zalkind, with board representation from Crosspoint (Zach Sivertson) and Optiv (John Hurley).

Name

WideField Security

Legal name

WideField Security Inc

Website

https://widefield.ai

Company type

Private

Founded year

2023

Operating status

Acquired

Headcount range

11–50 employees

Short description

WideField Security is a Santa Clara-based identity security startup that uses AI and machine learning to detect threats across human, non-human, and AI-agent identities in SaaS, cloud, and on-premises environments, serving enterprise CISOs, IAM, and SOC teams via a subscription SaaS platform.

Ownership category

akta.pro rank

Product category

Identity Security

NAICS

Software Publishers (5132)

SIC

Services-Computer Programming, Data Processing, Etc. (7370)

akta.pro primary industry

Secrets Management & Machine Identity (API keys, certificates, workload identity) (HDAEAJAJ)

akta.pro secondary industries

Identity Orchestration & Policy (Zero Trust Access, Conditional Access) (HDADAAAL), Responsible AI, Security & Privacy Platforms (Safety, Guardrails, PII) (HDAEANAG), User Lifecycle Provisioning & SCIM Automation (HDAEAJAK)

Keywords

• Identity security
• Identity threat detection
• Identity governance
• Cloud security platform
• Non-human identity monitoring

Headquarters

HQ city

Santa Clara

HQ country

United States

HQ region

North America

Offices1 record

Markets served

GTM type

B2B

Offering type

Software

Cost components

Personnel, Technology or R&D, Marketing or Sales, Operations, Infrastructure

Revenue model

1. SaaS Subscription: WideField Security is offered as a subscription to businesses per the Terms of Service. Subscription-based SaaS model with recurring revenue. All purchases are non-refundable, and subscription cancellation takes effect at the end of the current paid term. Payment terms indicate recurring charges to payment method on file.

Pricing tiers

Go-to-market motion3 records

Distribution channels1 record

Marketing channels5 records

Core offering

WideField Security sells a SaaS-delivered AI-driven identity security platform that protects human, non-human, and AI agent identities across their full lifecycle (at rest, in motion, and in use) in SaaS, cloud, and on-premises environments. The platform ingests identity telemetry via API from systems such as Microsoft Entra ID, Google Workspace, Salesforce, Slack, GitHub, Snowflake, OpenAI, and Claude, and applies machine learning and behavioral analytics to detect authentication misconfigurations, post-authentication session misuse, OAuth application drift, and policy escapes, with policy-based automated remediation. Customers subscribe annually through a quote-based enterprise sales motion.

Product overview

WideField offers a single, unified SaaS identity security platform — the WideField Identity Security Platform — that protects identities across their full lifecycle (at rest, in motion, and in use) across SaaS, cloud, and on-premises environments, spanning comprehensive visibility, threat detection, and response for both human and non-human identities. The platform is organized into three audience-aligned capability layers: IAM modules (Discover Local and Privileged Human and Non-Human Identities, Secure Account and Credential Lifecycle, Run Posture Scans and Monitor for Identity in Motion, and Monitor Non-Human Access and Geo-Fence Service Accounts), SOC modules (Investigate a Finding and Perform Ad-Hoc Remediation, Policy-Based Automatic Remediation, and Investigate Any Identity — From Posture to Activity), and a CISO-level Daily Identity Risk Assessment Report. In March 2026, WideField launched the AI Agent Identity Monitoring extension to monitor, behaviorally model, and detect threats from autonomous AI agents as a new identity class. In June 2026, Cisco announced its intent to acquire WideField to integrate the platform's identity and session intelligence into Splunk's Agentic SOC.

Differentiator

Problem solved

Functional benefit

Products and services

• WideField Identity Security Platform Unified SaaS-delivered identity security platform that protects identities across their full lifecycle (at rest, in motion, and in use) across SaaS, cloud, and on-premises environments. Provides comprehensive visibility, AI/ML-based threat detection, and policy-based response for human, non-human, and AI-agent identities. Deploys in minutes via API-based telemetry collection from IAM, SaaS, and Cloud systems without agents, and produces a daily CISO-level identity risk score aggregating 60+ signals across five categories. Sold via annual subscription to enterprise IAM, SOC, and CISO buyers.
• AI Agent Identity Monitoring Extension of the WideField Identity Security Platform, launched in March 2026, that monitors, behaviorally models, and detects threats from autonomous AI agents as a new identity class. Provides continuous monitoring and threat detection for AI agents operating with broad permissions and limited IT visibility, complementing existing coverage of human and non-human identities.

Quantifiable outcome

• Aggregates 60+ signals across five categories for daily identity risk reporting
• +3 more outcomes

Named customers2 records

Segments4 records

Ideal customer profiles3 records

Technology focussed Yes

API detail

Has API

Yes

API docs

API detail

Core technology

AI maturity

App detail

Integration9 records

AI capability9 records

Feature8 records

Partnerships

Twelve partnerships are on record, tiered flagship and core.

• CiscoflagshipStrategic or Co-development PartnerCisco announced intent to acquire WideField Security on June 18, 2026, with plans to integrate its technology into Splunk to enhance Agentic Security Operations Center capabilities. WideField's technology will combine with signals from Cisco Identity Intelligence. Financial terms not disclosed. Marks Cisco's third cybersecurity-related acquisition of 2026, following Galileo and Astrix Security.
• SplunkflagshipTechnology or IntegrationWideField's core technology will integrate with Splunk (Cisco's big data observability suite) to provide deeper context for monitoring AI agent activity within Splunk's Agentic Security Operations Center. Integration enables correlation of identity, session, and activity telemetry across human, non-human, and AI-agent activity.
• MicrosoftcoreTechnology or IntegrationWideField ingests telemetry from Microsoft identity systems (Entra ID, M365) via API integrations to discover identities, monitor authentication, and analyze session activity. Used as a primary signal source for Microsoft 365 / Entra ID OAuth and identity telemetry.
• GooglecoreTechnology or IntegrationWideField ingests telemetry from Google Workspace identity systems via API integrations, analyzing OAuth client registrations, token grants, and Workspace API activity for identity threat detection.
• SalesforcecoreTechnology or IntegrationWideField ingests telemetry from Salesforce via API integrations to monitor connected apps, OAuth token usage, and identity activity within the CRM environment.
• GitHubcoreTechnology or IntegrationWideField ingests GitHub audit logs and OAuth app telemetry via API to detect anomalous activity by OAuth apps and non-human identities within development environments.
• SlackcoreTechnology or IntegrationWideField ingests Slack telemetry via API integrations to monitor OAuth app installations, scopes, and identity activity within Slack workspaces for identity threat detection.
• SnowflakecoreTechnology or IntegrationWideField ingests Snowflake identity telemetry via API integrations to monitor non-human access, service account behavior, and identity-related risks in cloud data environments.
• OpenAIcoreTechnology or IntegrationWideField ingests OpenAI identity telemetry via API integrations to monitor AI agent activity, token usage, and identity-related behaviors in environments using OpenAI services.
• Anthropic (Claude)coreTechnology or IntegrationWideField ingests Claude (Anthropic) identity telemetry via API integrations to monitor AI agent activity, token usage, and identity-related behaviors in environments using Anthropic services.
• John Hurley (CRO, Optiv)coreStrategic or Co-development PartnerAppointed to WideField's Board of Directors in March 2026 as part of the company's Series A expansion and AI agent identity monitoring launch. Brings enterprise security services distribution expertise from Optiv.
• Zach SivertsoncoreStrategic or Co-development PartnerBoard Member of WideField Security; associated with lead investor Crosspoint Capital Partners. Provides strategic oversight on behalf of the lead investor.

Scale indicators5 records

Recent moves6 records

Expansion highlights6 records

Direct peers

• BeyondTrust: BeyondTrust's Identity Security Insights product (acquired from Entitle) provides identity governance and threat detection across cloud and SaaS — overlapping with WideField's identity posture, lifecycle, and privilege misuse detection capabilities.
• Astrix Security: Astrix Security is the closest direct peer — focused specifically on securing non-human identities and OAuth integrations. Astrix was acquired by Cisco in 2024, making it a near-perfect comparator to WideField both in product and in exit trajectory.
• Silverfort: Silverfort provides unified identity threat detection and response across on-prem and cloud, including AD, Entra ID, and SaaS — closely aligned with WideField's holistic identity threat detection and posture management positioning.
• CrowdStrike: CrowdStrike Falcon Identity Threat Protection is a direct ITDR competitor covering cross-domain identity attack detection, posture, and response — overlapping with WideField's identity threat detection and non-human identity monitoring across cloud and SaaS environments.
• CyberArk: CyberArk's Identity Security Platform focuses heavily on privileged access, machine identity, and secrets management — a direct adjacent to WideField's non-human identity and credential lifecycle focus, now part of Palo Alto Networks.

Emerging players

• Oligo Security: Oligo focuses on runtime application and identity security, including detection of compromised third-party libraries and services — an emerging player with overlapping visibility into identity misuse in cloud-native environments.
• GitGuardian: GitGuardian specializes in secrets detection and machine identity hygiene across code, CI/CD, and developer environments — a complementary emerging player in the machine/non-human identity security space WideField addresses.
• Push Security: Push Security delivers browser-based identity threat detection and SaaS app posture — an emerging ITDR competitor targeting the same SaaS and cloud identity attack surface as WideField.

Broad incumbents

• Okta: Okta is the dominant identity provider with growing identity threat detection capabilities (via Okta AI and Identity Threat Protection) — a broad incumbent serving the same enterprise IAM buyer that WideField targets, particularly around authentication policy and lifecycle.
• Microsoft Entra ID Protection: Microsoft's identity protection stack inside Entra addresses identity risk detection, conditional access, and threat response as part of a much broader identity and access platform. It is a key incumbent alternative for the same enterprise IAM/SOC buyers WideField targets.

Market position

Strengths5 records

Weaknesses5 records

Competitive moat6 records

Key risks5 records

Key highlights6 records

Customer concentration

• LinkedInlinkedin.com/company/widefield

Compliance3 records

Revenue estimate

Valuation estimate

Number of profiles

Profiles8 records

Funding overview

Funding rounds2 records

Investors3 records

Funding detail is available on the Subscription and Enterprise plan.Contact sales →

M&A

Investments

M&A and investment is available on the Subscription and Enterprise plan.Contact sales →

Frequently asked questions about WideField Security