Use Case Intelligence RSS Search use cases Search
Snowflake Software / SaaS Tel Aviv, Israel

Orchid Security

Security and Compliance

analyze identity access across huge enterprise application estates fast enough to expose unmanaged accounts, support remediation, and keep pace with AI-driven identity complexity.

Read the original story Explore all use cases
1M+ Number of user identities analyzed to reduce security risks
80% Faster analysis keeps clients ahead of evolving vulnerabilities
anywhere from 30% to over 60% of identities aren’t managed
ingest data every 30 minutes

Reported impact

Business outcome

Orchid Security accelerated analysis by 80%, examined more than 1 million user identities, and gave customers a near-real-time view of identity risk across thousands of applications.

  • Productivity Improvement
  • Risk Reduction
  • Scalability

Solution

Orchid Security uses Snowflake, dbt, Dynamic Tables, Snowpark, and Metabase to analyze identity risk across huge enterprise application estates. Customer application data, authorized accounts, authentication flows, groups, and permissions are ingested into Snowflake at high frequency, where dbt models, Dynamic Tables, and Snowpark-based analysis keep pipelines refreshed and let the team compute complex identity graphs without moving data to separate environments. The platform feeds dashboards and Metabase-style self-service views that expose security coverage, unsecured applications, and the riskiest identities, while natural-language exploration helps both customers and internal users investigate findings quickly. By keeping computation close to hundreds of millions of accounts and thousands of applications, Orchid shortened analysis cycles from hours to minutes and gave customers a near-real-time picture of identity risk.

Data flow

Application, identity, and access data is ingested into Snowflake, modeled with dbt, and kept current with Dynamic Tables. Snowpark performs deeper graph-style analysis in place, and the resulting risk views are delivered through dashboards and Metabase to both Orchid teams and customers.

Solution architecture

5 components · 4 layers
  1. Compute
    • dbt Transforms ingested identity and application data into modeled risk datasets.
    • Snowpark Runs Python-based analysis directly on identity graph data without exporting it elsewhere.
  2. Storage
    • Snowflake Stores and serves Orchid Security’s client application, identity, and access datasets at large scale.
  3. Serving
    • Metabase Gives internal users a natural-language-friendly dashboard layer for business insight and investigation.
  4. Orchestration
    • Dynamic Tables Automates scheduled refreshes so identity-analysis pipelines stay current.

Architecture clues

  • Dynamic Tables automate background updates so customers can receive refreshed security views every 30 minutes.
  • Snowpark keeps graph-style identity analysis inside Snowflake and avoids previous memory-limit issues.
  • The platform spans millions of accounts and thousands of applications for large enterprise customers.

Evidence from the source

1M+ Number of user identities analyzed to reduce security risks
80% Faster analysis keeps clients ahead of evolving vulnerabilities
anywhere from 30% to over 60% of identities aren’t managed by the stack that’s supposed to manage them
ingest data every 30 minutes
Transparency Evidence & methodology 100/100 reference value · 79% confidence · 1 source

Review how this reference was scored and trace each normalized claim back to its documented source.

01

Scoring methodology

How scores are calculated

Customer Reference Value measures usefulness as a customer reference. Evidence Confidence measures the quality and traceability of available evidence, not independent verification.

Customer reference value100/100
  • Problem clarity20/20
    Measures whether the customer's operational problem is specific enough to compare.
  • Implementation depth25/25
    Rewards named components, data flow, integrations, and architecture detail.
  • Outcome specificity20/20
    Measures whether the reported benefit is concrete rather than a generic claim.
  • Quantified impact25/25
    4 metrics describe measurable impact.
  • Deployment scale10/10
    Rewards evidence of a live or scaled deployment and meaningful integration scope.
Evidence confidence79%
  • Source authority20/25
    The main evidence is an official vendor-published customer story.
  • Claim traceability21/25
    10 of 12 key fields link to a named source.
  • Direct evidence20/20
    4 direct source quotes retained.
  • Date provenance0/10
    The publication date has no documented provenance.
  • Source transparency8/10
    1 source reference document publisher, URL, authority, retrieval, and supported fields.
  • Implementation specificity10/10
    Rewards source-backed components, data flow, quantified impact, and a specific outcome.
02

Traceability

Sources & provenance

Field coverage shows which facts each source supports. Dates are shown only when documented by the source.

  1. Snowflake

    Orchid Security customer story

    First-party
    https://www.snowflake.com/en/customers/all-customers/case-study/orchid-security/
    Source type
    Vendor-published customer story
    Supports
    • Customer
    • Business problem
    • Solution
    • Products
    • Solution components
    • Data flow
    • Integrations
    • technical area
    • use case category
    • Business outcome
    • outcome category
    • Metrics
    • Architecture
    • evidence quotes

Date evidence

  • Sitemap last modified Oct 9, 2026 · Snowflake · Publisher metadata Publisher-reported modification timestamp; not a publication date.
    Open date source
  • Unverified extracted date Oct 9, 2026 · Snowflake · Unknown Legacy extracted date without source-page confirmation.
    Open date source
Not separately sourced Industry, Region, Company size. Treat these normalized attributes as lower-confidence until a dedicated source is added.

Related

Similar use cases

See all like this
Snowflake Archived · Jan 16, 2025 Vulcan Cyber Software / SaaS Tel Aviv-Yafo, Israel prioritize cyber risk across many security tools and threat feeds fast enough to give customers clear remediation guidance and scalable automation. 1 day to build a new AI summarization model Security and Compliance ExposureOS · Snowflake OpenAI Oct 14, 2026 SentinelOne Software / SaaS North America SentinelOne needed to reverse engineer sophisticated malware far faster than specialist researchers could do manually so it could investigate more samples, spot relationships across threats, and extend scarce cyber… 8 hours to reverse-engineer malware, down from 4–6 weeks Risk ManagementSecurity and Compliance OpenAI Daybreak · OpenAI models Google Cloud Archived · Oct 9, 2026 Midnight Foundation Software / SaaS Australia Public blockchains, however, can inherently expose transaction data, creating privacy barriers for enterprise adoption and regulatory compliance such as GDPR. And generating zero-knowledge (ZK) cryptographic proofs… Developer onboarding cut to <1 min through a custom AI coding assistant built with Gemini API Confidential… Security and Compliance Confidential Space · Google Kubernetes Engine (GKE)