Grip Security

• SaaS posture platforms or identity providers could bundle SaaS discovery and automated offboarding, absorbing Grip's original entry point into an adjacent product the buyer already owns.
• The newest disclosed funding is the August 2023 Series B, so if growth slowed since then the team-and-bookings proof points would be stale without a public correction.
• Grip's ITDR 2.0 enters a contested identity threat detection category where dedicated ITDR and identity vendors already compete, so the detection layer may not differentiate on its own.
• Public technical validation is thin, so capability claims rest on vendor pages and case studies that a competitor could match with marketing rather than verified depth.

Grip targets a pain that grew faster than the tools meant to govern it: employees adopt SaaS and AI apps faster than IT can discover or control them, leaving identities and accounts outside the IAM program. The company frames this as SaaS identity risk and pitches the enterprise CISO directly.

The pain is specific and corroborated, not a marketing generality. PDS Health, a 14,000-employee healthcare provider, describes a mature IAM program that still lacked visibility of SaaS outside its IAM software, and credits Grip with finding the gap. That named-buyer corroboration is what separates a clear problem from a plausible one.

Identity has become a primary attack vector as SaaS adoption climbs, which gives the discovery problem a security urgency beyond hygiene, a shift SecurityWeek echoed in covering Grip's 2026 analysis of 23,000 SaaS environments where embedded AI was universal. Grip leans on that shift to argue the control point is the identity, not the network perimeter that older CASB tools defended. [s2, s3, s5, s4, s16]

The SaaS Security Control Plane discovers and classifies SaaS and web apps, surfaces the risky identities and accounts using them, prioritizes access controls, and automates SaaS offboarding. That offboarding automation is the capability customers cite first: PDS Health automated its offboarding workflow and saved roughly 400 hours in single sign-on identification.

Grip ITDR 2.0 adds a detection-and-response layer aimed at identity threats that bypass preventive controls. It monitors unmanaged SaaS for threats from malicious OAuth grants, browser extensions, and privilege escalation, and offers one-click and automated responses, which extends Grip from a discovery and governance tool toward active threat response.

The public evidence is concrete on what the product does but thin on independent technical validation. Most depth comes from vendor platform pages and customer case studies rather than third-party evaluations or open documentation that a buyer could test against. [s3, s5, s4, s2]

Grip first positioned against legacy CASB, arguing those tools took months to deploy and interfered with SaaS adoption. That framing won early customers but the space has since crowded with vendors attacking the same unmanaged-app population from different angles.

Cerby automates identity for apps an identity provider cannot reach, Unixi sells universal single sign-on with no SAML integration work, and Push Security hardens workforce identities in the browser. Grip overlaps all three on SaaS discovery and identity risk visibility, so its differentiation now rests on enterprise breadth and the ITDR detection layer rather than a single unique mechanism.

The structural risk is absorption. Discovery and offboarding are exactly the capabilities SaaS posture platforms and identity providers keep adding, so Grip's durability depends on whether the detection layer and accumulated SaaS-app intelligence become a moat the larger platforms cannot quickly copy. [s6, s2, s4]

The traction evidence is real but concentrated around the 2023 Series B. At that point Grip reported bookings up over 400 percent year over year and a client roster including multiple Fortune 500 companies, and at Series A it reported a tenfold quarter-over-quarter increase in new users.

Independent corroboration has grown on use even as named logos stayed flat. Gartner Peer Insights carries 22 end-user reviews of the platform averaging 4.9 across two recognized markets, SecurityWeek independently reported the 66 million dollar Series B, and PDS Health and NFP appear as on-record customers, with PDS Health's CISO speaking publicly about the deployment.

The gap is recency of named scale. The freshest named traction still traces to 2023 rather than a new wave of logos or a fresh round, so the 2021 to 2023 growth rate cannot be confirmed from public sources. [s8, s6, s5, s12, s15, s17]

The three co-founders, Lior Yaari, Idan Fast, and Alon Shenkler, met during Israeli military intelligence service and were named to Forbes' 30 Under 30 list, a verifiable recognition rather than a self-asserted background.

The investor and advisor signal reinforces the team's standing. The seed round drew named operator angels including CrowdStrike CEO George Kurtz, former Akamai CSO Andy Ellis, and former Zscaler CISO Michael Sutton, the institutional rounds were led by Intel Capital and Third Point Ventures, and SecurityWeek independently reported the Series B.

What the public record does not yet show is a prior exit in the same category, so the credibility comes from pedigree and recognition rather than a demonstrated build-and-sell cycle in SaaS security. [s11, s9, s6, s7, s17]

Grip's footer states ISO 27001 Certified and SOC 2 Type II Certified as trust badges in its homepage footer, which signal attention to compliance but are self-displayed claims rather than an inspectable trust portal or published report. The cited footer shows the certified marks but does not link to the SOC 2 report or ISO certificate behind them.

Treated as table-stakes posture, these badges show baseline security hygiene appropriate for selling into Fortune 500 buyers, consistent with the enterprise references the company names.

A buyer evaluating Grip would need to request the underlying SOC 2 report and ISO certificate directly, since the public footprint shows the certified claims but not the artifacts behind them. [s13, s5]

Add analyzed competitors to compare them side by side with Grip Security.

Grip targets enterprise security teams drowning in SaaS and AI sprawl, the buyers whose IAM programs cannot see apps adopted outside IT, the population SecurityWeek's coverage of Grip's 23,000-environment analysis put at universal embedded-AI exposure. Its references skew large: PDS Health runs 14,000-plus employees across more than 1,000 locations, and the Series B press names multiple Fortune 500 clients.

The segmentation logic is identity-first. Grip treats the identity accessing an app, not the network path, as the control point, which lets it address the shadow SaaS and shadow AI that perimeter-era CASB tools missed.

The narrowing risk is that Grip serves a broad horizontal pain rather than a defensible niche. Any enterprise with SaaS sprawl is a prospect, which is a large market but also one every adjacent platform wants.

Grip's core capability is discovery and governance: it finds and classifies SaaS and web apps, surfaces the risky identities using them, prioritizes which apps need single sign-on and multi-factor authentication, and automates SaaS offboarding. PDS Health credits that automation with roughly 400 saved hours in single sign-on identification.

Grip ITDR 2.0 extends the platform into identity threat detection and response, monitoring unmanaged SaaS for threats from malicious OAuth grants, browser extensions, and privilege escalation, with automated responses. This moves Grip from passive visibility toward active enforcement.

The advantage is breadth across the SaaS identity lifecycle rather than a singular technical edge. The mechanisms are concrete, but the public record offers little independent validation, so the depth claim rests on vendor descriptions and customer outcomes.

Grip sells into enterprise security teams and leans on named references and recognition for credibility. The Series B reported bookings up over 400 percent year over year and a client roster including multiple Fortune 500 companies, and Series A reported a tenfold quarter-over-quarter increase in new users.

The motion is supported by a seasoned investor and advisor network. YL Ventures led the seed, Intel Capital the Series A, and Third Point Ventures the Series B, with operator angels including CrowdStrike CEO George Kurtz lending early credibility.

The weakness is recency of named proof. The headline growth figures trace to 2023, and the cited record shows no fresh named-logo wave or announced financing since, though SecurityWeek independently reported the round and Gartner Peer Insights now carries 22 end-user reviews averaging 4.9. Named-logo growth past 2023 stays unconfirmed in the public record.

The cited homepage and platform page show no price figures and route buyers toward a demo. The absence of public prices points to a sales-led motion, and the cited pages do not disclose how deals are sized.

Without a published unit of charge, it is unclear whether Grip bills by users, applications, or estate size. That hidden pricing limits a buyer's ability to compare against adjacent SaaS posture or identity tools without entering a sales process.

For the analysis this means pricing cannot be scored as a positioning signal from public evidence, only inferred from the enterprise, demo-led motion.

Grip delivers as software the customer configures and operates, an identity-based control plane that connects to the SaaS estate and runs discovery, governance, and now detection. PDS Health's outcomes, automated offboarding and prioritized single sign-on, describe a tool the customer's own team drives.

The operational value is time saved on manual identity work, the roughly 400 hours PDS Health cites, rather than a managed service that takes accountability for outcomes.

Because the customer runs the platform, the delivery model is standard enterprise software, which shapes both the value-delivery and switching analysis below: the product is the automation output, not an outsourced operation.

Grip's footer states ISO 27001 Certified and SOC 2 Type II Certified as trust badges in its homepage footer. These are self-displayed claims rather than an inspectable trust portal or a published report behind the marks.

Grip displays the certified claims, and the reviewed public evidence does not expose the SOC 2 report or ISO certificate behind them.

Treated as table-stakes posture, the trust signal is adequate for the enterprise motion but confers no compliance-driven moat, since the marks reflect baseline hygiene rather than a mandate that blocks replacement.

Grip positions as a control plane that spans the SaaS estate, which inherently depends on integrating with the apps and identity tools an enterprise already runs. The PDS Health case describes Grip layering over a mature existing IAM program rather than replacing it.

The ecosystem stance is complementary to identity providers rather than competitive with them, which broadens reach and also leaves Grip exposed if the identity platforms it extends add the same coverage, an absorption risk rather than a documented move.

Public materials do not quantify a marketplace presence or integration count that a well-funded copycat could not match, so the ecosystem is a distribution surface rather than a measured moat.

The three co-founders, Lior Yaari, Idan Fast, and Alon Shenkler, met during Israeli military intelligence service and were named to Forbes' 30 Under 30, a verifiable recognition that anchors the team's credibility.

The founders attracted an unusually senior angel and advisor base for a seed-stage company, including CrowdStrike CEO George Kurtz, former Akamai CSO Andy Ellis, and former Zscaler CISO Michael Sutton, which signals security-industry trust in the team, and SecurityWeek independently reported the Series B that institutional investors led.

The gap is a demonstrated prior exit in the same category. The credibility comes from recognition and pedigree rather than a completed build-and-sell cycle in SaaS security, which leaves execution-at-scale unproven from public evidence.