Akeyless

• CyberArk, which acquired Venafi's machine-identity business, could bundle vaultless secrets and certificate lifecycle into the privileged-access suites enterprises already buy, eroding the standalone budget line Akeyless depends on.
• The cloud providers ship native workload identity federation and key management at no extra license cost, so a buyer standardizing on one cloud could absorb much of Akeyless's function without a third-party purchase.
• The AI-agent identity positioning depends on reusing the existing engine, and Akeyless has disclosed no named customer deploying it for autonomous agents, so the agent-era pull stays unproven against pure-play rivals racing the same buyers.
• Thales co-leads the same secrets-management category and also resells an Akeyless-powered vault inside CipherTrust, so Thales could build or buy a replacement and turn its largest distribution partner into a direct rival.
• Public revenue is undisclosed and no priced round has closed since the 2024 Deutsche Bank strategic investment, so a better-capitalized incumbent could outspend Akeyless on enterprise sales.
• HashiCorp Vault, now owned by IBM, anchors the open-source secrets habit Akeyless sells against, and a renewed Vault SaaS push could slow the rip-and-replace motion that drives Akeyless's clearest wins.

Akeyless sells against credential and secret sprawl, the pain it calls a top cause of breaches. The buyer is the security and DevOps leader accountable for the credentials, certificates, and keys flowing through multi-cloud and hybrid estates, where machine identities far outnumber human ones. Oded Hareven frames the fragmentation concretely, telling Finextra that enterprises run more than 12 tools across 15 categories and 75 vendors for secrets and machine-identity management.

The agent era sharpens the same problem rather than replacing it. Akeyless argues that AI agents run autonomously around the clock across clouds and on-premises systems, so traditional human IAM cannot scale to thousands of ephemeral service instances that spin up and down within seconds. That reframes secrets management as the trust layer an autonomous agent needs before it can authenticate to enterprise systems.

Independent coverage treats the category as established. KuppingerCole's enterprise secrets management research frames secrets sprawl, hardcoded credentials, and non-human identity growth as the market problem, and Gartner Peer Insights tracks workload identity management as a market, third-party evidence that buyers organize budget around the sprawl Akeyless sells against. [s7, s13, s12]

The Akeyless platform unifies several secrets and identity functions on one SaaS control plane rather than a single point tool. Its documentation describes a single cloud-based control plane covering application-to-application authentication, X.509 and SSH certificate issuance, privileged access, encryption and key management, and short-lived credentials, and the platform now folds AI-agent security into the same control plane. The breadth lets a buyer consolidate tools a typical enterprise runs separately.

The architecture is the stated differentiator. Akeyless uses patented Distributed Fragments Cryptography, which splits encryption keys across regions and providers so that, the company says, no single party including Akeyless can access them, paired with hybrid post-quantum encryption. That zero-knowledge design underpins the vaultless SaaS model the company contrasts with self-hosted vaults customers must run and scale themselves.

Public technical depth now has an external validation point it previously lacked. The Akeyless cryptographic module holds an independent NIST CMVP FIPS 140-3 certificate, an accredited-laboratory validation of the cryptography rather than a vendor claim, and KuppingerCole's evaluation of the platform is a second outside assessment alongside the documentation portal a buyer can inspect. [s15, s3, s1]

Akeyless competes on two fronts that share an engine. In conventional secrets management it runs rip-and-replace plays against HashiCorp Vault for enterprises tired of operating self-hosted vaults, and lines up against CyberArk, Thales, Delinea, and the cloud providers' native key and identity services. In the emerging non-human identity space it competes with pure-play startups extending discovery and governance to AI agents.

The company's stated edge is consolidation on patented cryptography, and the market now places it among the leaders. KuppingerCole names Akeyless an Overall Leader in enterprise secrets management alongside BeyondTrust, CyberArk, Delinea, SSH, and Thales, and the Thales CipherTrust OEM shows the underlying technology is strong enough that a security major embeds it. That standing is a genuine differentiator against point tools.

The structural pressure comes from incumbents with the same buyers. CyberArk's purchase of Venafi gave a privileged-access leader a machine-identity portfolio, the cloud providers ship workload identity and key management natively, and Thales is at once Akeyless's largest distribution partner and a category co-leader, so Akeyless must keep proving that a dedicated vaultless platform beats coverage bundled into suites enterprises already pay for. [s13, s8, s1]

Akeyless can point to a named customer that switched from a rival. SiliconANGLE quoted Cimpress's information-security manager saying the platform made it easy to rip and replace the company's existing secrets management solution, an independently reported reference rather than a vendor-curated logo, and Finextra reports Fortune 100 use. The Thales CipherTrust OEM, which embeds an Akeyless-powered vault inside a major vendor's platform, is the clearest partnership proof.

The funding and analyst signals add commercial standing. SecurityWeek reported a 2022 Series B that brought total funding to 80 million dollars led by NGP Capital with Team8 and JVP, Finextra reported a 2024 strategic investment from Deutsche Bank's corporate venture arm, and KuppingerCole's Overall Leader placement is independent recognition a younger vendor cannot manufacture.

What the public record still lacks is agent-era proof. No named customer is cited deploying Akeyless specifically for autonomous AI agents, no current revenue or customer count is disclosed, and the clearest traction evidence belongs to the conventional secrets business rather than the identity-for-AI positioning the homepage now leads with. [s10, s13, s12]

The founding team pairs identity-security operating experience with deep cryptography. Co-founder and CEO Oded Hareven is a veteran of Israel's IDF cyber unit who specializes in identity and access management and held product roles at CA Technologies and at Moovit before its acquisition by Intel, and he is the quoted voice in the company's funding and platform announcements.

The entrepreneurial and technical bench reinforces the pedigree. Co-founder and President Shai Onn previously founded Fireglass, acquired by Symantec, a prior security exit that CTech corroborates and that lifts the team above peers with no founder exit on record, and co-founder and CTO Refael Angel is credited with the company's zero-trust split-key encryption and two submitted patents.

The investor signal adds standing. Akeyless drew NGP Capital, Team8, and JVP across its rounds and later Deutsche Bank, backers with security and enterprise track records, and brought in Mike Christenson, a former New Relic and CA Technologies president, as a board member. What is absent is a sustained public research or publication record of the kind that lifts the strongest teams in this category. [s6, s11, s10]

Akeyless leads its trust story with architecture that limits its own access to customer data. The Distributed Fragments Cryptography design splits key fragments so that, the company states, no single party including Akeyless can reconstruct customer keys. For a tool that holds an enterprise's credentials, that zero-knowledge posture is the core readiness claim a regulated security review opens with.

The compliance posture is unusually deep for a company this size, and now externally verifiable. The Akeyless cryptographic module holds an independent NIST CMVP FIPS 140-3 certificate, and the trust center lists FIPS 140-3, SOC 2 Type II, and ISO 27001 alongside PCI DSS compliance and alignment to the European DORA regulation, a span that lowers the diligence burden for a regulated buyer.

Independent assurance beyond those attestations is lighter. Gartner Peer Insights carries customer reviews across privileged access and workload identity management, and third-party profiling notes Fortune 100 adoption, but the trust center does not publish a downloadable penetration-test report, the next evidence a security team is likely to request before deployment. [s5, s15, s14]

Add analyzed competitors to compare them side by side with Akeyless.

Akeyless targets the enterprise drowning in credential and secret sprawl across multi-cloud and hybrid estates, where machine identities far outnumber human ones. The buyer is the security and DevOps leader accountable for the credentials, certificates, and keys flowing through pipelines and production systems, and Oded Hareven sizes the fragmentation for Finextra at more than 12 tools across 15 categories and 75 vendors for secrets and machine-identity management.

The segment skews to the regulated upper enterprise, with a self-serve entry below it. Finextra reports Akeyless is used by Fortune 100 companies, Gartner Peer Insights tracks the product under privileged access management and workload identity management, recognized budget lines buyers already fund, and KuppingerCole frames non-human identity growth as a driver of the market. At the same time the pricing page offers a free starter tier and a per-client SaaS motion, so the addressable set blends a large regulated account with a smaller team that can adopt without a sales call.

The agent era sharpens the same segmentation rather than replacing it. Akeyless argues that AI agents run autonomously around the clock across clouds and on-premises systems, so traditional human IAM cannot scale to thousands of ephemeral service instances, which reframes the secrets buyer as the same leader now accountable for non-human and agent identity.

The platform unifies several secrets and identity functions on one SaaS control plane rather than a single point tool. The documentation describes a single cloud-based control plane covering application-to-application authentication, X.509 and SSH certificate issuance, privileged access, encryption and key management, and short-lived credentials, with AI-agent security folded into the same control plane. The breadth lets a buyer consolidate tools a typical enterprise runs separately.

The architecture is the stated differentiator. Akeyless uses its Distributed Fragments Cryptography design, which splits encryption keys across regions and providers so that, the company says, no single party including Akeyless can access them, paired with hybrid post-quantum encryption. That zero-knowledge design underpins the vaultless SaaS model the company contrasts with self-hosted vaults customers must run and scale themselves.

The AI advantage is engine reuse, not a proprietary model. The same just-in-time credential mechanism that serves applications issues short-lived tokens to AI agents, where an agent requests a minutes-long credential, uses it once, and discards it, so a compromised token has already expired. The durable depth here is distributed cryptography and real-time credential exchange, now corroborated by an independent NIST FIPS 140-3 validation of the cryptographic module, rather than any accumulated data asset.

Go-to-market combines named enterprise references with a self-serve on-ramp. SiliconANGLE reported a customer testimonial in which Cimpress's information-security manager said Akeyless made it easy to rip and replace the company's existing secrets management solution, a named reference a trade outlet published rather than an independently verified deployment. SiliconANGLE also relayed Akeyless's own customer names, such as Wix, Cimpress, Outbrain, and Stash Financial. The Thales CipherTrust OEM, which embeds an Akeyless-powered vault inside a security major's platform, is the strongest partnership proof, and Finextra notes Fortune 100 use.

The investor base and analyst recognition signal commercial standing beyond a typical startup. The 2022 Series B brought total funding to 80 million dollars led by NGP Capital with Team8 and JVP, Finextra reports a 2024 strategic investment from Deutsche Bank's corporate venture arm, and KuppingerCole names Akeyless an Overall Leader in enterprise secrets management alongside BeyondTrust, CyberArk, Delinea, SSH, and Thales, third-party recognition a younger vendor cannot manufacture.

What the public record still lacks is agent-era proof. No named customer is cited deploying Akeyless specifically for autonomous AI agents, no current revenue or customer count is disclosed, and the clearest traction evidence belongs to the conventional secrets business rather than the recent identity-for-AI positioning.

Akeyless publishes a pricing page in a category where most rivals hide one, and the model offers two deployment shapes against a single objection. Pure SaaS is fully cloud-managed for rapid deployment, while Hybrid SaaS adds on-premise gateways and zero-knowledge encryption so a buyer can keep secrets and identity data inside private infrastructure while meeting compliance requirements, letting the customer trade convenience for control.

For Secrets Management the metered unit is the client, not the secret. Akeyless defines clients as human users, applications, or servers that initiate a session, counts multiple instances of one application as a single client, and tracks the distinct total at month end with overage invoiced against an annual quota. Other modules meter their own units, including connectors for multi-vault governance, managed certificates for certificate lifecycle management, transactions and KMIP or TDE applications for encryption and key management, and named users for the password manager. The client unit ties cost to the size of the identity estate under management rather than to seats, which fits the enterprise buyer but offers no forecastable per-unit benchmark to an outside reader.

A free starter tier opens the funnel below the enterprise threshold. Published material stops short of dollar figures for paid tiers, so a smaller team faces a quota-shaped quote that is hard to budget against a fast-growing client count, while a large account folds Akeyless into a negotiated enterprise agreement.

Akeyless delivers as a cloud-native control plane that operates across public cloud, hybrid and multi-cloud, on-premises, and Kubernetes environments. The pure SaaS shape removes infrastructure maintenance entirely, while the hybrid shape places on-premise gateways inside customer boundaries, so the operational burden the customer carries scales with how much control it wants over where secrets live.

The operational core is just-in-time issuance rather than long-lived storage. The platform creates, retrieves, issues, rotates, and enforces policy on secrets, dynamic credentials, certificates, and keys, replacing long-lived credentials with short-lived ones and logging every secret request. That model reduces the standing-credential blast radius a buyer worries about and gives security teams a per-access record.

The heavier operational question is availability in the authentication path. Because Akeyless can sit in the credential-issuance path, a slow or unavailable control plane delays the credentials workloads need to authenticate, so a buyer diligences latency and failover closely. The trust center documents the compliance posture, but the reviewed pages do not publish the explicit uptime and recovery commitments a careful security review will request before deployment.

Akeyless leads its trust story with architecture that limits its own access to customer data. The Distributed Fragments Cryptography design splits key fragments so that, the company states, no single party including Akeyless can reconstruct customer keys, and the hybrid shape lets a buyer keep secrets inside private infrastructure. For a tool that holds an enterprise's credentials, that zero-knowledge posture is the core readiness claim a regulated security review opens with.

The compliance posture is documented and now externally verifiable. The Akeyless cryptographic module holds an independent NIST CMVP FIPS 140-3 certificate, an accredited-laboratory validation rather than a vendor claim, and the trust center lists FIPS 140-3, SOC 2 Type II, and ISO 27001 alongside PCI DSS compliance and alignment to the European DORA regulation, a span that lowers the diligence burden for a regulated buyer.

Independent assurance beyond those attestations is lighter. Gartner Peer Insights carries customer reviews across privileged access and workload identity management, but the trust center does not publish a downloadable penetration-test report, the next evidence a security team is likely to ask for before deployment.

Akeyless positions itself as a single control plane other applications and workloads depend on to authenticate, not a feature inside one cloud's identity service. The documentation frames it as a cloud-based control plane spanning application-to-application authentication, certificate issuance, privileged access, and automated identity workflows across hybrid and multi-cloud environments, so the platform sits underneath the systems that consume its credentials.

The breadth was assembled into one unified offering, and the engine extends outward. The same mechanism that issues short-lived credentials to applications is extended to AI and ML workloads and agents, and the Thales CipherTrust OEM shows the platform is strong enough to run inside a security major's own product rather than only as a standalone service.

Outward ecosystem reach is real but thinly documented in the reviewed pages. The platform integrates across AWS, Azure, GCP, Kubernetes, and on-premises data centers, but no developer marketplace, partner-built integration catalog, or third-party network effect appeared in the pages reviewed, so the platform claim rests on internal consolidation and integration breadth rather than an external builder ecosystem.

The founding team pairs identity-security operating experience with deep cryptography. Co-founder and chief executive Oded Hareven is a veteran of Israel's IDF cyber unit who specializes in identity and access management and held product roles at CA Technologies and at Moovit before its acquisition by Intel, and he is the quoted voice in the company's funding and platform announcements.

The entrepreneurial bench reinforces the pedigree. Co-founder and president Shai Onn previously founded Fireglass, acquired by Symantec, a prior security exit that CTech corroborates and that lifts the team above peers with no founder exit on record, and co-founder and chief technology officer Refael Angel is credited with the company's zero-trust split-key encryption and two submitted patents.

The investor signal adds standing. Akeyless drew NGP Capital, Team8, and JVP across its rounds and later Deutsche Bank, backers with security and enterprise track records, and Mike Christenson, a former New Relic and CA Technologies president, joined as a board member at the Series B. What is absent from the reviewed pages is a sustained public research or publication record of the kind that lifts the strongest teams in this category.