Seed rounds in cybersecurity are usually a story about a product idea finding a market. Clutch Security’s $8.5 million seed tells a slightly different story. The company went to market with a deliberate framing: a universal platform for non-human identity, covering cloud, SaaS, and on-premises estates through a single lens. That framing is the interesting part. It is a direct challenge to the assumption that NHI security can be delivered as a feature of the surrounding infrastructure.
The fragmentation problem
Non-human identities accumulate where work happens. Cloud workloads hold roles and instance profiles. SaaS applications hold OAuth grants and API keys. On-premises systems hold service accounts that predate the cloud and will outlive it. Each environment has its own native controls, and each native control sees only its own slice.
The consequence is predictable. An organisation can have excellent secrets hygiene inside one cloud provider and complete blindness to the credential sprawl in a marketing tool, a data pipeline, and an acquired business unit. Risk scoring inside a silo produces false comfort, because the dangerous identity is usually the one that spans silos.
What universal coverage requires
Discovery that assumes nothing
The starting point is agentless or lightly agented discovery that reaches SaaS APIs, cloud control planes, and directory services without requiring a permanent footprint on every host. Coverage beats depth in the first phase, because an identity you have not found cannot be governed.
Ownership resolution as a core capability
Every discovered identity needs a human or team attached to it, or the platform produces an inventory nobody can act on. The hard engineering is not the scan. It is inferring ownership from creation logs, deployment metadata, and usage patterns when no explicit record exists.
Lifecycle, not just posture
Visibility without action is a report. The value arrives when the platform can rotate a credential, revoke an unused grant, and decommission a stale identity through automation, with the change recorded against a stable identity record.
A crowded field with a governance gap
The NHI category now includes secrets management incumbents extending upward, identity governance vendors extending sideways, and a cohort of specialists built specifically for the problem. Differentiation is rarely about discovery any more. It is about whether the platform can express policy in terms the business accepts, and whether it can prove that policy was enforced.
That is where the universal claim earns or loses its credibility. A platform that covers every environment but cannot demonstrate to an auditor that a given credential was rotated within policy on a given date has solved a visibility problem and left the governance one untouched.
What buyers should test
For CISOs evaluating this wave of funding, the practical test is straightforward. Ask for the inventory of identities the platform found in a pilot environment that the internal team did not know about. Ask how long it takes to revoke one safely, including every dependent service. Ask what the audit evidence looks like a year later. Machine identity budgets are moving now because regulators and insurers are asking the same questions, and a seed round is a signal of intent rather than a guarantee of coverage.