Warden
Scheduled Sep 10, 2026Access reviews that finish, on data you can audit.
Replaces
- SailPoint Identity Security Cloud · SailPoint Technologies, Inc. — no published list price
- Saviynt Identity Cloud · Saviynt, Inc. — no published list price
Rented, per year
Not published
These vendors quote privately. We use your contract, not a guess.
Owned, per year
$14,160
AWS infrastructure only. Azure is $15,180.
Build
18 weeks
3 engineers. To parity on the ten core features above, including aggregation from eight named sources, migration of existing role definitions and SoD rules, and one full certification campaign run in parallel with the incumbent before cutover.
Difficulty
5/5
Among the hardest in Techtons. Read the parity table closely.
Reference organisation: 12,000 identities, 40 connected applications, ~900,000 entitlement assignments, quarterly campaigns, single region, prod + non-prod. 3-year Compute Savings Plan on Fargate, 3-year reservation on Container Apps and PostgreSQL Flexible Server. Athena and Synapse serverless costed at campaign-quarter query volume, which is spiky. Seven-year evidence retention on S3 Object Lock / immutable blob included. Excludes vendor support plans and LLM gateway token spend. Figures are infrastructure only and exclude the build.
What it is
Warden is identity governance: an aggregated view of who has access to what, request-and-approve workflows, scheduled access certification campaigns, segregation-of-duties policy with preventive and detective checks, and role mining over real entitlement data. It is for regulated organisations of 3,000 to 40,000 identities that run quarterly access reviews for SOX, DORA or ISO 27001 and currently spend more on the IGA licence and its integrator than on the team doing the reviewing. Warden keeps the entitlement warehouse in your own Postgres, where your auditors can query it directly.
Why this one stops making sense
- Neither SailPoint nor Saviynt publishes a list price. Every renewal is negotiated against a number you have no independent way to benchmark.
- IGA programmes fail on connector coverage, not on features, and the connectors you need are always the three internal systems no vendor supports.
- Certification campaigns are the deliverable, and reviewers rubber-stamp because the UI shows them 400 rows with no context. That is a product problem, and it is fixable when you own the product.
- Your entitlement warehouse is the cleanest map of privilege in the company. It should be a table your auditors and your detection engineers can join against, not an export you request.
- Implementation cost dwarfs licence cost. A typical SailPoint rollout is a multi-year systems-integration project, and at the end of it the platform is still rented.
What ships
- Identity warehouse aggregating accounts and entitlements from every connected source
- Correlation of accounts to identities with confidence scoring and an orphan-account queue
- Access request catalog with multi-stage approval, delegation and time-bound grants
- Certification campaigns: manager, application-owner, role and entitlement-scoped, with reminders and auto-revoke on expiry
- Reviewer context inline — last used, peer coverage, risk score, prior decision — on every row
- Segregation-of-duties policy with preventive checks at request time and detective scans on a schedule
- Role mining over actual entitlement assignments, with candidate roles proposed and diffed before adoption
- Revocation orchestration with per-connector receipts and a verified-removed state
- Immutable evidence pack per campaign: who reviewed what, when, and what changed as a result
- Connectors for Entra ID, Okta, Active Directory, Workday, Salesforce, AWS IAM Identity Center, GitHub and generic SCIM/JDBC/CSV
Data model
Stack
- frontend
- Next.js 15 App Router + Tailwind + TanStack Query, with a virtualised certification grid that stays responsive at 50,000 rows
- backend
- NestJS on Node 22 — REST, plus an aggregation engine and a policy evaluator as separate workers
- database
- PostgreSQL 16 with Row Level Security, an append-only decision ledger and hash-chained audit records
- cache
- Redis 7 for campaign progress counters, permission caches and connector rate limiting
- queue
- BullMQ for source aggregation, revocation orchestration, campaign generation and reminder cadence
- auth
- OIDC against the customer IdP, with step-up authentication required for any revocation or policy change
- search
- PostgreSQL tsvector across identities, entitlements and applications
- ai
- Optional entitlement description generation and peer-group anomaly flagging through an LLM gateway, on your data only
Parity, honestly
What we match, and what we do not.
The rows marked No are the important ones. If one of them is the reason you bought SailPoint Identity Security Cloud, keep buying it — and we will tell you that on the first call rather than the fifth month.
| Capability | SailPoint Identity Security Cloud | Ours | Note |
|---|---|---|---|
| Identity and entitlement aggregation across sources | Yes | Yes | — |
| Access request and approval workflows | Yes | Yes | — |
| Scheduled certification campaigns with auto-revoke | Yes | Yes | — |
| Segregation-of-duties policy, preventive and detective | Yes | Yes | Policies are SQL predicates under version control, so an auditor can read the rule, not a screenshot of it. |
| Role mining and role lifecycle | Yes | Yes | Candidate roles are proposed from clustering over real assignments and must be diffed and approved before they take effect. |
| Reviewer context on every certification row | Partial | Yes | Last-used and peer-coverage data are the difference between review and rubber-stamp. |
| Time-bound and just-in-time access grants | Yes | Yes | — |
| Library of 200+ pre-built application connectors | Yes | No | SailPoint and Saviynt ship connectors for SAP GRC, Epic, Guidewire, mainframe RACF and hundreds more, each maintained against vendor API changes for years. Warden ships eight connectors plus SCIM, JDBC and CSV. If your estate is thirty legacy applications with proprietary APIs, that connector library is exactly what you are paying for and you should keep paying for it. |
| Vendor-run SOC 2 Type II, ISO 27001 and FedRAMP authorisation | Yes | No | An IGA platform is scrutinised harder than most software. Warden inherits your own cloud compliance posture and nothing more. If your regulator or your external auditor expects a third-party attestation naming the software vendor, that is a legitimate reason to keep buying. |
| AI-driven access recommendations trained across customers | Yes | Partial | Warden's recommendations come from your own peer-group data only. That is more defensible and less powerful on day one. |
| Non-employee and machine-identity governance | Yes | Partial | Contractors and service accounts are first-class identity types. A full third-party lifecycle portal with sponsor attestation is a separate scope. |
| Auditors querying the entitlement warehouse directly | No | Yes | Read-only Postgres credentials scoped to the warehouse schema. No export request, no vendor ticket. |
| Separation between the system being reviewed and the reviewer of record | Yes | Yes | Certification decisions are written to an append-only ledger with a hash chain. |
Reference architecture
Built twice, on purpose.
Every application in Techtons ships with a production architecture for AWS and one for Azure, using the same diagram grammar so you can read them side by side. Your cloud, your account, your bill.
Amazon Web Services
- Compute
- ECS Fargate services (api, aggregator, policy, worker) behind an ALB
- Data
- Aurora PostgreSQL with a reader for campaign analytics, ElastiCache Redis
- Storage and edge
- S3 with Object Lock in compliance mode for evidence packs, Athena over Parquet campaign snapshots
- Identity
- Cognito federated to the customer IdP, with step-up via the IdP's own ACR values
- Observability
- OpenTelemetry to CloudWatch and X-Ray, with campaign completion rate as a business metric
- Infrastructure as code
- Terraform, one module per environment, remote state in S3 with a DynamoDB lock
Services
The decision worth arguing about
The non-obvious decision is splitting the certification campaign across two stores. A campaign for 12,000 identities against 40 applications generates two to four million review rows, and the reviewer UI mostly asks aggregate questions — how many rows remain for this manager, what is the revoke rate by application, which reviewers have not started. Running those counts against the same Aurora tables that reviewers are actively writing decisions into turns every dashboard refresh into a seq scan that competes with the writes. Warden freezes an immutable snapshot of the campaign to S3 as Parquet at generation time and answers all aggregate and reporting queries with Athena, while row-level decisions stay transactional in Aurora. The trade is two stores and a visible staleness window: the progress dashboard is refreshed on a 60-second cycle, so a reviewer who certifies 200 rows and immediately checks the leaderboard sees an old number. We put the timestamp next to the count rather than pretending it is live.
Microsoft Azure
- Compute
- Azure Container Apps (api, aggregator, policy, worker) with KEDA scaling on Service Bus depth
- Data
- Azure Database for PostgreSQL Flexible Server with a read replica, Azure Cache for Redis
- Storage and edge
- ADLS Gen2 with immutable blob policy for evidence, Synapse serverless SQL over the campaign Parquet
- Identity
- Microsoft Entra ID, with Conditional Access enforcing step-up on revocation actions
- Observability
- Azure Monitor with Application Insights and Log Analytics retention set to the audit retention period
- Infrastructure as code
- Bicep in an azd-compatible layout
Services
The decision worth arguing about
On Azure the temptation is to let Entra ID Governance own the joiner-mover-leaver side and have Warden govern only the non-Microsoft estate. We deliberately do not split it, and the reason is the SoD engine. Segregation-of-duties rules are cross-application by definition — the classic ones pair an SAP role against an Entra group against a payments-system entitlement — and a policy engine that can only see two thirds of the estate produces violations it cannot prove and misses the ones that matter. So Warden aggregates Entra as a source like any other, through Graph, and evaluates every policy in one place. The trade is duplication: Entra P2 already computes its own access reviews, and customers on P2 are paying for a capability Warden supersedes. That is worth naming in the business case rather than discovering at renewal — for many customers the honest answer is to drop from P2 to P1 once Warden is live, which changes the maths considerably.
Sources
Every price on this page, with the page we read it from and the date we read it.
| Product | Plan | List price | Checked | Source |
|---|---|---|---|---|
| SailPoint Identity Security Cloud | Identity Security Cloud — Business Plus | Not published | 2026-09-05 | aws.amazon.com/marketplace/pp/prodview-pz66r SailPoint publishes no list price anywhere, including on its own AWS Marketplace listing, which states that pricing is available only by requesting a private offer. |
| Saviynt Identity Cloud | Identity Cloud | Not published | 2026-09-05 | aws.amazon.com/marketplace/pp/prodview-tial4 Saviynt publishes no list price; its AWS Marketplace listing carries no rate card and directs buyers to request a private offer for a custom quote. |
Should you still be paying for SailPoint Identity Security Cloud?
Two weeks, fixed price. We audit what you actually use, map it against Warden, cost the replacement on your own AWS or Azure account, and give you a delivery plan. If the honest answer is to keep the licence, that is what the report will say.