# opal-security

Source: https://startwithidentity.com/vendors/iga/opal-security/
Last updated: 2026-11-05
License: content by Start with Identity. Cite the source URL.

---

## Overview

Opal Security is an [access governance](https://startwithidentity.com/guides/fundamentals/what-is-iga/) platform built around [just-in-time access](https://startwithidentity.com/glossary/jit-access/): engineers and employees request time-bound access, resource owners approve it, and Opal provisions and revokes it through each target system's API. It now [describes itself](https://www.opal.dev/about) as "an AI-native access platform for managing every identity, from employees to AI agents." Founded in 2020, it is independent and venture-backed. [TechCrunch reported](https://techcrunch.com/2023/12/07/opal-security-which-helps-companies-manage-access-and-identities-raises-22m) a 22 million dollar Series B led by Battery Ventures in December 2023, and on 4 June 2026 Opal [announced 23 million dollars](https://www.opal.dev/media-press/opal-security-raises-23m-new-leadership) led by Greylock and Battery Ventures, for 59 million raised in total, with a new leadership team under CEO Howard Ting.

## What it is good at

JIT at engineering scale. Opal says Databricks runs 86,000 just-in-time requests through it, and it names Notion, Cloudflare and Scale AI among customers. Requests and reviewer notifications flow through [Slack](https://docs.opal.dev/integrations/slack), with approvers set per resource owner, and a [Terraform provider](https://docs.opal.dev/docs/use-terraform-with-opal.md) manages request configuration as code. Integrations span Okta, Entra ID, AWS, Google Cloud, Azure, GitHub, Snowflake, Databricks, Salesforce and ServiceNow.

Governance sits on the same data. AI-guided access reviews give reviewers explainable recommendations, an access graph shows standing versus time-bound access, and OpalQuery answers questions about over-provisioning and separation-of-duties conflicts in plain English. Coverage extends to [non-human identities](https://startwithidentity.com/glossary/nhi/) such as service accounts, CI/CD pipelines and API tokens, and to AI agents, where its Paladin agent approves low-risk requests and escalates the rest. It also runs in your own environment, on a VM, Kubernetes or on premises, which few SaaS-first governance tools offer.

## Where it falls short

Opal is not a vault. It does not record privileged sessions or rotate credentials for legacy admin accounts, so regulated estates still need [PAM](https://startwithidentity.com/guides/fundamentals/what-is-pam/) alongside it. Connector depth favors cloud and SaaS over older on-premises applications, and its analyst footprint is shorter than the incumbents'. The leadership change in 2026 is recent; ask about roadmap continuity.

## Pricing

Quote-based. Opal publishes no prices: its [pricing page](https://www.opal.dev/pricing) is a demo request form with no plan names or rates (checked 2026-11-05). Model a multi-year cost with the [TCO calculator](https://startwithidentity.com/tools/tco-calculator/).

## Best for, and who should look elsewhere

Choose Opal when the goal is removing standing access across cloud and SaaS, with reviews that use the same request history. For JIT with deeper cloud entitlement analysis, see [Britive](https://startwithidentity.com/vendors/ciem/britive/) or [Apono](https://startwithidentity.com/vendors/pam/apono/), now part of 1Password. For the closest governance-led peer, see [C1 (formerly ConductorOne)](https://startwithidentity.com/vendors/iga/conductorone/), which Workday agreed to acquire in October 2026; for suite IGA, [SailPoint](https://startwithidentity.com/vendors/iga/sailpoint/).

## Bottom line

A strong independent choice for cloud-native companies that want just-in-time access and access reviews from one platform, including for service accounts and AI agents.