Defakto
Defakto (formerly SPIRL, rebranded in 2026) is a non-human identity and access management platform built on the SPIFFE standard. It issues dynamic, cryptographically verifiable identities for services, workloads, CI/CD pipelines, and AI agents in place of static credentials and service accounts.
Quick answer
What is Defakto?
Short answer
Defakto (formerly SPIRL, rebranded in 2026) is a non-human identity and access management platform built on the SPIFFE standard. It issues dynamic, cryptographically verifiable identities for services, workloads, CI/CD pipelines, and AI agents in place of static credentials and service accounts.
- Best for
- Platform engineering and infrastructure security teams at cloud-native organizations that want to eliminate static secrets and service-account sprawl using SPIFFE-style workload identity.
- When to choose
- Choose Defakto if you want to standardize on SPIFFE-style short-lived workload identities and systematically retire static secrets across clouds, clusters, and pipelines.
- When not to choose
- Look elsewhere if you mainly need a vault to store and rotate existing secrets, or a lightweight tool for a small, mostly SaaS-based environment.
Common use cases
- Replacing static API keys and long-lived tokens with short-lived workload identities
- Eliminating hardcoded credentials from CI/CD pipelines
- Discovery and governance of non-human identities across multi-cloud environments
- Reducing overprivileged Active Directory and cloud service accounts
- Issuing dynamic, policy-bound identities to AI agents and LLM-driven automation
- Zero-trust service-to-service authentication (mTLS/JWT via SPIFFE SVIDs)
Strengths
- Built on the SPIFFE open standard by a team with large-scale SPIFFE deployment experience, avoiding a fully proprietary identity format
- Modular platform covering discovery (Ledger), issuance (Mint), CI/CD (Ship), least-privilege remediation (Trim), and AI agents (Mind) under one console
- Addresses the root cause of secrets sprawl by removing static credentials rather than just vaulting them
- $30.75M Series B (October 2025) led by XYZ Venture Capital, with backers including J.P. Morgan and Bloomberg Beta
- Named a Rising Star in KuppingerCole's non-human identity and workload identity coverage
Limitations & considerations
- Recent rebrand from SPIRL means brand and some documentation are still transitioning; verify current product naming with the vendor
- No published pricing; budgeting requires a sales conversation
- SPIFFE-based workload identity assumes engineering investment and works best in cloud-native environments; legacy estates may need more effort
- AI-agent module (Mind) is newer than the core workload identity product; verify maturity for your use case
Pricing model summary
Contact Defakto for current pricing.
Integrations
Fit
Alternatives & comparisons
Astrix Security discovers and secures non-human identities, AI agents, and MCP servers, and provisions secure-by-design agents through its Agent Control Plane with short-lived credentials and just-in-time access. Following its acquisition by Cisco, its capabilities are being integrated into Cisco's identity and zero-trust portfolio.
Compare Defakto vs Astrix Security →Oasis Security is a non-human identity management platform covering inventory, ownership, posture, lifecycle, and secret rotation for machine identities, with AI-SPM and intent-aware access controls for AI agents. In July 2026, data-security company Cyera agreed to acquire Oasis for approximately $1 billion, with closing expected later in the year.
Compare Defakto vs Oasis Security →Akeyless is an established identity security platform delivering secrets management, certificate lifecycle management, encryption/KMS, and secure remote access from a unified SaaS, using patented Distributed Fragments Cryptography (DFC) instead of a self-managed vault. In 2025–2026 it extended the platform to AI-agent identity with ephemeral, task-scoped access.
Compare Defakto vs Akeyless →Aembit is a workload identity and access management platform that manages how workloads, services, and AI agents authenticate and access downstream APIs and services — without static credentials.
Compare Defakto vs Aembit →Defakto and its logo are trademarks of their respective owner. IDSync is an independent buyer resource and does not imply endorsement unless explicitly stated.