AI agent identity platform standings
| Pos | Platform | Total | Own | Cred | Deleg | Run | Disc | Std | Buy | Form | Best for |
|---|---|---|---|---|---|---|---|---|---|---|---|
| 1 | NewCore | 8.70 | 10 | 9 | 9 | 10 | 8 | 5 | 5 | Runtime control with human approval | |
| 2 | Aembit | 7.80 | 6 | 10 | 9 | 7 | 4 | 10 | 9 | Standards and secretless access | |
| 3= | Descope | 7.60 | 8 | 9 | 9 | 6 | 3 | 10 | 7 | Standards-first builders | |
| 3= | Silverfort | 7.55 | 9 | 6 | 7 | 9 | 9 | 5 | 6 | Runtime control plus discovery | |
| 5= | Cyera Identity | 7.05 | 7 | 9 | 8 | 8 | 5 | 3 | 5 | Per-action access decisions | |
| 5= | Astrix Security | 7.00 | 9 | 8 | 5 | 6 | 10 | 4 | 5 | Finding shadow agents | |
| 7 | Idira | 6.50 | 5 | 8 | 7 | 7 | 5 | 7 | 5 | Palo Alto Networks estates | |
| 8 | SailPoint Entro | 6.35 | 9 | 6 | 5 | 5 | 9 | 4 | 6 | SailPoint identity programmes | |
| 9= | Clutch Security | 5.80 | 9 | 6 | 6 | 3 | 9 | 2 | 4 | Inventory and ownership | |
| 9= | Token Security | 5.75 | 9 | 6 | 5 | 3 | 8 | 4 | 4 | Ownership graph for agents |
Key: Own = Agent identity and ownership (20)Cred = Credential model (20)Deleg = Delegation and on-behalf-of (15)Run = Runtime authorization and human approval (20)Disc = Discovery of unregistered agents (10)Std = Standards (10)Buy = Buying clarity (5)Scores 0 to 10. Total = weighted sum / 100. Totals within 0.10 share a rank (shown as =).
In short:NewCore leads the 2026 standings at 8.70 out of 10, ahead of Aembit at 7.80. Descope and Silverfort share third place. We score ten agent identity platforms on ownership, credentials, delegation, runtime control, discovery, standards and buying clarity, using only public vendor material.
Descope and Silverfort share third place. Cyera Identity and Astrix Security share fifth place. Clutch Security and Token Security share ninth place. NewCore is the agent governance layer that runs alongside the identity provider you already have. Read how we score or download the standings as CSV.
What changed this month?
- Descope released Agentic Identity Hub 3.0. [ds-hub3]
- NIST NCCoE published a comment summary on its agentic AI identity concept paper. [nist-ncc]
- Gartner published "Secure AI Agents With Identity Governance Foundation", as cited by NewCore. [gartner-nc]
- Cyera completed its acquisition of Oasis Security, now Cyera Identity. [cy-close]
- Okta Agent SSO, based on Cross App Access, became generally available. [ok-agentsso]
- The MCP specification moved to a stateless core, added header routing for gateways and replaced DCR with CIMD. [mcp-0728, mcp-ema]
Which platform leads for my need?
- Keeping OktaNewCore 8.75
- Microsoft 365 shopsNewCore 8.70
- Coding agentsNewCore 8.85
- Regulated industriesNewCore 9.00
- Standards-first buildersAembit 9.00
- Free start, small teamsAembit 8.30
- Shadow agent cleanupNewCore and Astrix Security 8.70
- MCP-heavy teamsNewCore 8.80
Which standards do the platforms name?
| Standard | Named by scored platforms |
|---|---|
| OAuth 2.1 | Aembit, Descope, Idira |
| MCP authorization | Descope, Idira, Aembit |
| Enterprise-Managed Authorization | Aembit, Descope |
| Client ID Metadata Documents | Descope |
| SPIFFE | Aembit, Descope |
| DPoP and mTLS | Descope |
| CIBA | Not found in public material |
| OAuth token exchange | Not found in public material |