Vision
Identity is the control surface. Nobody built the system of record.
This is an argument, not an About page. If you disagree with it, we are probably not the right vendor for you — which is useful information for both of us.
The thesis
Authentication got solved. Authorisation did not.
The last fifteen years of identity investment went into the front door — single sign-on, multi-factor, conditional access, passwordless. That work succeeded. Proving who someone is, is close to a solved problem for a company with a modern stack.
What nobody built is the record of what they can do once they are in. Entitlements live inside each application, in that application’s own vocabulary, governed by whoever administers it. There is no system that holds all of it, which means there is no system that can answer the only question that matters at 3am: what could this compromised identity reach?
Legacy identity governance tried, and priced itself into the Fortune 500 — six-figure licences, deployment measured in quarters, professional services attached. The mid-market got told to buy a smaller version of a thing that did not work, or to keep using spreadsheets. Most kept using spreadsheets.
The opening
Consolidation is closing the independent options.
Through 2025 and 2026 the interesting independent identity-security companies have been getting acquired by platforms. When a point tool becomes a suite checkbox, three things follow: the roadmap starts serving the platform’s priorities, the price gets bundled into a negotiation the buyer did not want, and the depth that made the tool worth buying stops being the thing that is invested in.
That is the opening. Every acquisition removes an independent option from a market whose buyers still have the problem — and the mid-market buyer, who was never the acquirer’s target, is left with fewer choices than before.
We are deliberately not printing a deal-by-deal timeline here. Several widely-repeated dates and pairings in this wave do not survive checking, and getting one wrong on a public page is the cheapest possible way to lose credibility with the exact person we want reading it. If you want to go through it in detail, ask us and we will walk you through what we can actually source.
The buyer
Why the mid-market specifically.
Big enough to have the problem
Around 500 employees, the estate stops fitting in one person’s head. There are enough applications, contractors, service accounts and cloud environments that nobody can enumerate them, and the first SOC 2 or cyber-insurance renewal makes that everyone’s problem at once.
Between roughly 500 and 5,000 employees — and up to 10,000 where the stack is modern — the problem is identical in shape to the enterprise problem and nothing like it in budget.
Too small to be sold to
This buyer has no identity team. They have an IAM lead who also owns three other things, a CISO who reports to the CTO, and no appetite whatsoever for a deployment project.
So the product has to deploy itself. That constraint is upstream of everything else we build: no professional services, no tuning, no console anyone has to be trained on. It is why the free tier can exist at all.
The roadmap
Three acts, honestly labelled.
We are shipping Act 1. Acts 2 and 3 are where this goes, and naming them is not the same as selling them.
-
Act 1
Shipping nowSee it, fix it, prove it
The wedge, done deeply. Every identity type inventoried across SaaS and on-prem, ranked findings with verified remediation, and access reviews that produce evidence an auditor accepts. One thing, done properly.
-
Act 2
NextThe system of record
Once the graph is complete and trusted, it becomes the place other systems ask. Joiner–mover–leaver driven from real entitlements rather than role templates; access requests that know what they are granting; privilege that expires because nothing renewed it.
-
Act 3
LaterContinuous, not quarterly
Governance that runs at the speed the estate changes, not the speed the audit calendar allows. Access that adjusts as roles and behaviour change, with the evidence trail generated as a by-product rather than as an exercise.
Who is building it
A small team, on purpose.
Amberlock is early. We are building the first version with a small team and a deliberately narrow scope, because the failure mode in this category is a platform that does forty things adequately and nothing well enough to displace a spreadsheet.
Being early is also the offer. Design partners get earlier access, real influence over the roadmap, direct engagement with the people building it, and consideration on pricing — in exchange for a real environment, a couple of hours of feedback a month, and permission to learn from anonymised findings.
If you have this problem and an opinion about how it should be solved, that is the conversation we want.
Find out what is in your amber.
Register for early access. Connect one system read-only, and see your first findings within the hour — the accounts nobody owns, the privilege nobody granted, the access that was never actually removed.
Scorpion — the service account. Ancient, over-privileged, still venomous. Real scorpions turn up in real amber, which makes this the most literally accurate specimen in the set.