An identity governance platform that extended into non-human identity management through its acquisition of Zilla Security, approaching machine identity from an access review and governance angle.
SailPoint is an IGA (Identity Governance and Administration) platform that acquired Zilla Security to extend its governance model to non-human identities, covering service accounts, API keys, and machine identities through access review workflows, certification campaigns, and visibility dashboards. The scope is governance and visibility: what non-human identities exist, what they have access to, and whether that access has been reviewed. Aembit operates at the runtime layer: it attests workload identity cryptographically at the moment of access, enforces conditional access policies, and issues short-lived credentials without any stored secret. The two tools address different parts of the non-human identity problem and can exist in the same environment for different purposes.
Aembit does not replace SailPoint. SailPoint governs identity lifecycle, access reviews, and certification workflows, a problem Aembit was not designed to solve.
—————-
SailPoint and Aembit address non-human identity from different angles and at different points in the lifecycle.
SailPoint (via Zilla) provides governance and visibility: discovering service accounts, API keys, and machine identities across the environment, running access review campaigns, flagging over-privileged or orphaned non-human accounts, and producing audit evidence that access has been certified. The model is asynchronous and human-reviewed: a person certifies that a given machine identity should have the access it has, on a scheduled or triggered cadence.
Aembit operates at the point of access: when a workload makes an authentication request, Aembit attests its identity cryptographically using runtime signals (Kubernetes service account, AWS metadata, GitHub Actions OIDC token, and so on), evaluates the request against an access policy, and issues a short-lived credential if the policy is satisfied. There is no stored credential to discover, no static access to review, and no manual certification step. The credential exists for the duration of the request and is never held by the workload.
The two tools are complementary rather than overlapping. Environments where service accounts and API keys have accumulated over time benefit from SailPoint’s governance model to understand what exists and remediate over-privileged identities. New workloads and AI agents can be governed through Aembit from the start, eliminating the service account accumulation problem before it reaches the state that governance tooling has to clean up.
Get started in minutes, with no sales calls required. Our free- forever tier is just a click away.
