Identity Security was built around the front door. Verify who is logging in, grant access, and trust policy to hold from there. That worked when only people logged in. It stops working once service accounts and AI agents authenticate alongside them.
We built Silverfort around that problem. We believe it is why we have been named a Leader in the IDC MarketScape: Worldwide Augmented Identity Security Solutions 2026 Vendor Assessment (doc# US54116526, November 2026).
What changed in Identity Security
An AI agent can use one identity or session to make hundreds of tool calls: pulling records, calling APIs, moving data. In the environments we work in, how many agents exist, and what each one is allowed to do, is often an open question.
The IDC MarketScape describes the shift in the report’s market definition:
“The breach does not occur when access is granted. It occurs when control fails to follow what happens next.”
What does the IDC MarketScape evaluate?
IDC MarketScape positions vendors into four categories: Participants, Contenders, Major Players, and Leaders. For this study, IDC analyst Emmanuel Figueroa evaluated 18 identity security vendors, including Silverfort.
The report defines the category, the five capability areas IDC assessed, and how each vendor was evaluated. The five areas are:
- Identity Coverage
- Continuous Risk Scoring
- Automated Enforcement
- Bidirectional Interoperability
- Identity Observability and Delegation Governance
What does enforcement at every access request look like?
Silverfort’s Runtime Access Protection (RAP) operates from within the identity infrastructure, where it sees each authentication. When someone or something requests access, the identity system forwards the request to Silverfort. Silverfort assesses the risk, applies inline controls such as MFA or a block if needed, and returns a verdict. The identity system then grants or denies access. It covers workforce and privileged users, third parties, non-human identities, and it needs no proxies, app changes, or changes to user workflows.
In Active Directory, that means visibility into Kerberos, NTLM, and LDAP authentications in real time, without rewrites or architectural changes.
We also extended our runtime protection to include AI agents. Agents are protected not at the authentication layer, but in the tool call process—each tool call is checked against policy before it runs.
What does IDC MarketScape say about Silverfort?
On how Silverfort works, IDC MarketScape notes:
“Silverfort enforces at the authentication layer, so domain controllers and identity providers become policy points, and legacy protocols such as NTLM, Kerberos, LDAP, and RADIUS receive step-up MFA, access blocks, and service-account fencing without endpoint agents or application changes. In IDC’s view, that is a practical answer to a long-standing hole in the identity stack.”
IDC MarketScape also comments on enforcement:
“Silverfort names automated enforcement as its primary strength, and IDC agrees: it acts before access is granted, not after someone reads a log.”
The IDC MarketScape profile also covers when buyers should consider Silverfort. You can read that in the vendor excerpt.
Where we go from here
We started a few years ago by bringing MFA to systems that had always been out of reach. Since then, we’ve evolved into a complete Identity Security Platform that secures every identity across every environment. Our acquisition of Fabrix Security, which was announced in April 2026, adds an AI decisioning engine and an Identity Knowledge Graph that analyzes access activity, organizational context, and intent—laying the foundation for our autonomous Runtime Identity Security Platform.
Four questions we think are worth asking
These are our questions, not IDC’s. They reflect how we think about Identity Security.
- Does it enforce, or only alert? Enforcement decides at the moment of access. An alert tells you what already happened.
- Does it cover Active Directory and legacy protocols? These are where attackers look, and they are often the hardest systems to change.
- Does it treat AI agents as identities? An AI agent can make hundreds of tool calls during a single session, all under the same identity. Each request—not just the initial sign-in—should be evaluated against policy.
- Does it re-evaluate risk on every access request? Risk can change between one request and the next. The decision should change with it.
Thank you
Thank you to the customers, partners, and Silverfort team members who made this possible.
Next steps
- Read the Silverfort vendor excerpt for the IDC MarketScape
- See a real AI attack, then see it stopped. Book a session in our AI Attack Lab.
FAQ
What is an IDC MarketScape?
The IDC MarketScape is a vendor assessment model for a technology market. IDC’s own description of the methodology appears under the graphic at the top of this post.
What is augmented identity security?
It is the category name IDC uses in this IDC MarketScape. IDC’s definition is in the full report. In our view, it means Identity Security that keeps enforcing after the login, not only at it.
What is Runtime Access Protection?
Runtime Access Protection (RAP) is Silverfort’s patented technology. It operates from within the identity infrastructure, sees each authentication, and enforces a decision at the moment access is requested.
Which identities does Silverfort protect?
Workforce users, privileged users, third parties, non-human and machine identities, and AI agents, across on-premises, hybrid, and cloud environments.
What is the AI Attack Lab?
It is a session with a Silverfort Identity Security specialist, about 30 minutes, that shows a real AI attack and how inline identity controls can stop it.
Where can I read the report?
Silverfort’s vendor excerpt is linked in this post.
Sources
“IDC MarketScape: Worldwide Augmented Identity Security Solutions 2026 Vendor Assessment,” doc #US54116526, November 2026.
