Twine Security

• Identity governance vendors could add the same agentic automation to the platforms Alex works on top of, since Twine's own use-case pages position Alex as optimizing those platforms rather than replacing them.
• No independently reported deployment, customer count or revenue figure appears in the reviewed sources, so adoption could be thinner than the named endorsements imply.
• Because Alex executes access changes rather than only recommending them, one wrong automated change at a customer could set back trust in the digital employee model.
• The AWS Marketplace prices of $35,000 and $95,000 per 1,000 identities give competitors a public number to undercut.

Twine Security sells to enterprise security and identity teams that cannot keep up with identity and access management work. The company frames access reviews, least-privilege enforcement, stale-account cleanup and application onboarding as the tasks a short-staffed team lets slip, and it names those tasks on its own site. SecurityWeek ties the pitch to the cybersecurity skills shortage that Twine says its technology addresses.

Twine and SecurityWeek frame the problem the same way, and the numbers behind it come from Twine. Its homepage reports a 41% ticket-load reduction within 180 days at an unnamed Fortune 500 food and beverage company and 5,731 hours saved last quarter across its customers, which are the company's own measurements. Independent reporting repeats the talent-shortage driver without sizing the identity backlog Alex takes on.

Twine reframes the pitch from tooling to labor. It sells a worker that executes the tasks rather than another console for a short-staffed team, so the buyer's decision turns on how much authority to hand an agent that changes access. Twine's own how-it-works page describes that as a trust ladder, saying the more a customer trusts a digital employee the more work it can delegate with fewer manager approvals. [s1, s3, s5]

Alex is Twine's first digital employee, an AI worker for identity and access management, and Twine presents it as one of a planned line. The site names the identity tasks Alex handles, among them user access reviews, least-privilege enforcement, stale-account cleanup, entitlement optimization, retrospective access audits and identity lifecycle management. A separate page covers onboarding new applications onto an identity governance platform a customer already runs, which Twine describes as a scalable, no-code, AI-driven application module.

The technical surface is thinner than the feature surface. Twine's how-it-works page says its digital employees leverage large language models alongside a library of expert skills, and that they implement a separation of duty architecture between the AI and the execution layer. That page does not name the model provider, and the reviewed sources include no documentation portal, no open-source code and no third-party technical evaluation, so a reader cannot check how accurately Alex acts.

Twine describes what Alex builds up as per-customer tailoring. Its pages say the digital employees learn a customer's environment, processes and technologies to create a tailor-made solution, and the AWS Marketplace listing prices Alex by how many of those tasks it has been trained on. The cited pages name no dataset or corpus that accrues to Twine across customers, so the engineering rather than an accumulated asset is what would separate Alex from a rival building the same agent. [s1, s9, s5, s11, s12]

Twine sells into the identity governance work established platforms already handle. Alex's own use-case pages describe it optimizing an existing identity governance and administration platform rather than replacing one, so Twine sells alongside those platforms rather than against them. AWS Marketplace lists Okta Workforce and Accenture's identity platform among products similar to Twine's listing.

Twine's own framing puts the difference in delivery rather than domain. Its pages sell an agent that does the work instead of software a team operates. Twine's newsroom reports a 2025 Gartner Cool Vendor citation in identity-first security, which places the company inside an analyst-named category.

Twine's own pages say the digital employees leverage large language models alongside a library of expert skills. Those pages do not say who supplies the models or which parts of the reasoning are Twine's own, so the reviewed record does not settle how much of Alex a rival could reproduce. Twine's lead depends on execution the record documents rather than on a capability the record shows a competitor cannot obtain. [s9, s11, s7, s5, s12]

Twine now sells Alex through AWS Marketplace at a published price. The listing, sold by Twine Security and delivered as software as a service on AWS, charges $35,000 for twelve months per 1,000 identities for a version trained on three use cases and $95,000 for one trained across all of them. It carries no customer reviews.

The named demand is endorsement-shaped and vendor-displayed. Twine's homepage states that Deloitte and Twine partner to secure IAM, and carries testimonials from security leaders at Nestlé, Telit Cinterion and Qualtrics, plus a Wiz co-founder whose fellow founders backed the seed round. Only the ICTS Europe security chief describes using the product, saying it cut costs significantly and that Alex's first day was worth three and a half full-time employees. The outcome figures beside those quotes, a 41% ticket-load reduction and a 76% entitlement reduction at unnamed Fortune 500 companies, are Twine's own measurements.

The independent record is recognition rather than adoption. RSAC named Twine one of ten Innovation Sandbox finalists for 2025 out of more than 200 applicants, and its release says each finalist was awarded a $5 million investment. Twine's newsroom adds the 2025 Gartner citation, a Forbes Cloud 100 Rising Star spot, a Black Hat USA Startup Spotlight finalist place and selection for a CrowdStrike and AWS accelerator. No revenue figure, customer count or independently reported deployment appears in the reviewed sources. [s11, s1, s12, s13, s7, s3]

All four of Twine's founders came from Claroty. Benny Porat co-founded it, which CTech calls a cyber unicorn and Twine's own page describes as a multi-billion dollar valued leader in cyber-physical systems, and his background includes leading a research team in Israel's Unit 8200 and a PhD in computer science from Bar-Ilan University. SecurityWeek and CTech both report that shared history.

The bench is credentialed in the same field. Nadav Erez, the chief technology officer, was vice president of data and analytics at Claroty. Omri Green was a general partner at the venture firms DTC and Grove Ventures, worked at Claroty and co-founded ICS2. Justin Woody ran innovation and market research at Claroty after time at Mandiant and Google.

Independent reporting ties these founders to Claroty and to no other prior company. Green's ICS2 appears only on Twine's own page with no outcome recorded, and the reviewed record names no exit for any of them. Investor conviction fills part of that gap, with Ten Eleven Ventures and Dell Technologies Capital co-leading the seed and the founders of Wiz joining as angels. [s2, s3, s4]

The homepage markup carries AICPA SOC, GDPR, ISO 27001:2022 and ISO 42001 badge images, and the how-it-works page lists SOC2, GDPR, CCPA and AWS security best practices under a heading reading Secure. ISO 42001, the management standard for AI systems, is a relevant marker for a product whose value is an autonomous agent acting on identity data.

The badges are self-displayed and no inspectable portal backs them. No public trust center or downloadable report appears on the probed surfaces, so nothing corroborates the seals. Twine's how-it-works page answers a security question by saying more information is provided upon request.

The collateral matters because Alex needs privileged reach into a customer's identity estate. Automating access reviews and access changes means Twine acts on sensitive identity data, and no attestation beyond the badges appears in the reviewed sources. A funded rival can earn the same certifications, so they ease procurement without blocking a substitute. [s1, s5]

Add analyzed competitors to compare them side by side with Twine Security.

Twine sells to enterprise security and identity teams that cannot keep up with identity and access management work. The company frames access reviews, identity cleanup and lifecycle chores as the tasks a short-staffed team lets slip, and SecurityWeek ties the pitch to the cybersecurity skills shortage. The buyer is the security or identity function that owns access governance.

The AWS Marketplace listing gives that segment a unit and a size. Twine bills by identity in blocks of 1,000, and its listing defines an identity as a user account with access to corporate systems, applications and services. One block costs $35,000 a year for a version trained on three use cases, which is the smallest published commitment on the listing.

Named demand is early and endorsement-shaped. Twine's homepage states that Deloitte and Twine partner to secure IAM, and carries testimonials from security leaders, of which only the ICTS Europe quote describes usage while the Nestlé, Telit Cinterion and Qualtrics quotes praise the approach. Whether the pitch pulls a distinct budget line or competes for existing identity governance spend is not visible in the reviewed record.

Alex is an AI worker for identity and access management, presented as one of a planned line of digital cybersecurity employees. Twine's site names the identity tasks Alex handles, among them user access reviews, least-privilege enforcement, stale-account cleanup, entitlement optimization and identity lifecycle management. Twine frames the delivery model as the difference, an autonomous worker that does the job rather than a console a team operates.

Twine now describes some of the machinery. Its how-it-works page says the digital employees leverage large language models alongside a library of expert skills, and that they implement a separation of duty architecture between the AI and the execution layer. The product page adds that Alex cleans, completes and corrects data sets with Twine's own AI engine before acting.

Outside verification does not appear in the reviewed sources. Twine does not name the model provider, and the reviewed sources include no documentation portal, no open-source code and no third-party technical evaluation, so how accurately Alex acts cannot be checked from outside. Twine's own pages describe that learning as per-customer tailoring, and the cited record evidences no corpus that accrues to Twine across customers.

Twine runs a demo-gated enterprise motion alongside a priced marketplace listing. Its pricing page publishes no prices and asks for a custom quote, while the AWS Marketplace listing charges $35,000 for twelve months per 1,000 identities for a version trained on three use cases and $95,000 for one trained across all of them. That listing carries no customer reviews.

The public traction is Twine's own reporting plus recognition. The homepage states that Deloitte and Twine partner to secure IAM, carries testimonials from security leaders, and reports outcome figures the company measures itself: a 41% ticket-load reduction and a 76% entitlement reduction at unnamed Fortune 500 companies, and 5,731 hours saved last quarter across its customers. Only ICTS Europe's security chief describes using the product, saying it cut costs significantly and that Alex's first day was worth three and a half full-time employees.

The independent signals are selections rather than deployments. RSAC named Twine one of ten Innovation Sandbox finalists for 2025 from more than 200 applicants, and its release says each finalist was awarded a $5 million investment. SecurityWeek and CTech both report a $12 million seed co-led by Ten Eleven Ventures and Dell Technologies Capital. Revenue, customer counts and pipeline do not appear in the reviewed record.

Twine now publishes list prices, on AWS rather than on its own site. The marketplace listing prices Alex per 1,000 identities under a contract, at $35,000 for twelve months for the Essentials tier trained on three use cases and $95,000 for the Enterprise tier trained across all of them. Twine's own pricing page still routes to a custom quote and says the model depends on factors specific to a customer's environment.

The meter is identities and the differentiator is training scope. Twine's listing defines an identity as a user account with access to corporate systems, applications and services, and says cost scales with the number of 1,000-identity blocks a customer buys. The tier a buyer picks turns on how many identity tasks Alex has been trained to handle.

Charging by identity prices Alex like software rather than like the labor it replaces. Twine pitches Alex as a digital employee and quotes a customer valuing its first day at three and a half full-time staff, so a buyer weighing the two has to convert an identity count into person-hours, which the listing does not do. The listing also records that fees are non-cancellable and non-refundable except as required by law.

Twine presents Alex as software delivered as a service rather than a staffed engagement. The AWS Marketplace listing records the delivery method as software as a service deployed on AWS, and the reviewed pages describe no Twine-run operating model in which its own analysts work the identity queue on a buyer's behalf.

The record does describe an onboarding period. Twine says its digital employees require onboarding, skills development and training until they demonstrate the ability to perform basic tasks, and that a customer grants more access as confidence grows. Twine also says its engineers can help build specific integrations when a customer's environment needs them.

Because Alex executes access changes, delivery maturity is a live question. Twine names a separation of duty architecture between the AI and the execution layer as its safety measure, and lists full audit tracing for identity data among Alex's use cases. The reviewed pages do not describe how that tracing works, nor rollback, nor what follows a mistaken automated change. Published uptime commitments and support service-level agreements do not appear in the record.

The homepage markup carries AICPA SOC, GDPR, ISO 27001:2022 and ISO 42001 badge images, and the how-it-works page lists SOC2, GDPR, CCPA and AWS security best practices under a heading reading Secure. ISO 42001, the management standard for AI systems, is a relevant marker for a product whose value is an agent acting on identity data.

No inspectable portal backs the badges. No public trust center or downloadable report appears on the probed surfaces, so nothing corroborates the seals. Twine's own page answers a question about security measures by saying more information is provided upon request.

The collateral matters because Alex needs privileged reach into a customer's identity estate. Automating access reviews and access changes means Twine acts on sensitive identity data, and no attestation beyond the badges appears in the reviewed sources. A funded rival can earn the same certifications, so they ease procurement without blocking a substitute.

Twine says identity security is just the beginning and asks visitors to register for updates about future product releases, which places Alex first in a line rather than alone. The company calls Alex its first digital employee and its pages speak of digital cybersecurity employees in the plural. Nothing in the reviewed record names a second agent, so the line is an intention rather than a shipped set of products.

Alex sits on top of the identity systems a customer already runs. Twine's product page says Alex optimizes existing identity and access management tools and integrates with them, and a use-case page describes onboarding applications onto a governance platform the customer already owns. Twine works above that infrastructure rather than being infrastructure others depend on.

Two adjacent platform owners show up in the record. Twine's how-it-works page says the digital employees leverage large language models without naming a provider, so who supplies that capability is not on the record. AWS both hosts the deployment and takes the marketplace transaction, so a change in either the hosting relationship or the marketplace terms would reach Twine's route to market as well as its delivery.

Twine's four founders all came from Claroty. Benny Porat co-founded it, which CTech calls a cyber unicorn and Twine's own page describes as a multi-billion dollar valued leader in cyber-physical systems, and his background includes leading a research team in Israel's Unit 8200 and a PhD in computer science from Bar-Ilan University. SecurityWeek and CTech both report the shared history.

The bench is credentialed in the same field. Nadav Erez, the chief technology officer, was vice president of data and analytics at Claroty. Omri Green was a general partner at the venture firms DTC and Grove Ventures, worked at Claroty and co-founded ICS2. Justin Woody ran innovation and market research at Claroty after time at Mandiant and Google, and Twine's blog names a head of AI holding a PhD.

Independent reporting ties these founders to Claroty and to no other prior company. Green's ICS2 appears only on Twine's own page with no outcome recorded, and the reviewed record names no exit for any of them. Ten Eleven Ventures and Dell Technologies Capital co-led the seed and the founders of Wiz joined as angels, which backs the team where disclosed traction is still thin.