Rising Star Opal Security

Short Summary

Opal Security is a Series B-funded identity and access governance (IGA) vendor founded in 2020 and headquartered in San Francisco. After beginning to sell in 2022, it built a single, API-first, headless governance platform that manages access for human employees, non-human identities (service accounts), and AI agents under one set of policies. The platform is designed to eliminate standing privilege via just-in-time (JIT) access, reduce approval fatigue with AI-guided decisioning, and encode governance as policy-as-code so access workflows fit developer-led, cloud-native environments.

A core differentiator is programmability: Opal offers one of the first Terraform providers for access governance and a native Model Context Protocol (MCP) server so both developers and agents can request access through existing workflows (app catalog, Slack, CLI, MCP) without relying on standing API keys. The platform auto-discovers and classifies resources and identities, assigns ownership in a unified graph, flags risks such as unowned or over-scoped grants, and supports plain-language access questions with traceable access paths back to grants and nested groups.

In September 2026, Opal introduced Opal Zero to govern AI agents end-to-end across lifecycle stages: inventory and ownership, risk detection, context-based request decisions (Paladin), usage-driven policy recommendations (Policy Insights), and enforcement via Gateway Sync into the customer’s existing MCP gateway. Paladin is positioned as Opal’s key innovation, drawing context from systems like Jira, Slack, PagerDuty, and Linear to explain decisions and support quarterly reviews, starting in advisory mode and optionally expanding to routine autonomous approvals.

Opal’s strongest fit is among technically sophisticated, developer-led organizations facing agent sprawl. It reports roughly 1.5 million JIT requests processed year to date, but broader recognition beyond North America and customer comfort with agent autonomy remain major constraints to durable leadership.

Interesting Facts

• Opal Security was founded in 2020 and is headquartered in San Francisco, California.
• The company is Series B-funded and began selling its product in 2022.
• Opal has raised $59 million in venture funding led by Greylock Partners, Battery Ventures, Box Group, SVCI, and Cambium Capital.
• The platform governs human employees, non-human identities, and AI agents under a single set of policies.
• Opal launched Opal Zero in September 2026 to govern AI agents across their lifecycle.
• Employees can request access through an app catalog, Slack, a CLI, or MCP with JIT durations and ITSM ticket linkage.
• OpalQuery supports plain-language questions about who can access what, with access-path tracing to grants or nested groups.
• Paladin pulls context from systems including Jira, Slack, PagerDuty, and Linear to evaluate access requests and entitlements.
• Opal reports processing roughly 1.5 million JIT access requests across its customer base year to date.
• Opal is SOC 2 Type 2 certified and supports self-hosted or on-premises deployment, with annual independent penetration testing and monthly vulnerability scans.

Notable Quotes

• “Rubber-stamped approvals stop being a nuisance and become the dominant failure mode of the program.”
• “Identity governance is being pulled in two directions at once: toward unifying human and non-human identities under one governance policy model, and toward a scale and speed of access decisions with which human reviewers can no longer keep pace.”
• “Governance should be layered on top of existing identity providers and cloud platforms, not replace them.”
• “This assumption is breaking down.”
• “Opal's most important innovation is Paladin, Opal's AI access agent that pulls context from Jira, Slack, PagerDuty, Linear, and other systems of record to evaluate every access request and every entitlement as part of a quarterly access review.”
• “Rather than returning a simple approve or deny decision, Paladin provides the reasoning behind it: requester risk, resource sensitivity, exposure window, whether a cited ticket actually exists and is assigned to the requester, and lower-privilege alternatives the approver could grant instead.”
• “Paladin runs as an advisor by default, where it recommends and a human decides, and customers can widen its authority to approve routine, lower-stakes requests and escalate the rest.”
• “Its unique selling proposition (USP) is programmability.”
• “When access shifts from a grant renewed every seven or thirty days for a human to a single, narrowly scoped entitlement for each agent task, the volume of decisions an organization must manage will climb by orders of magnitude.”
• “Vendors that combine unified identity coverage, programmatic access for agents, and actionable remediation decisions, not another dashboard, are best positioned to serve this expanding and increasingly important segment of the identity market.”