Cerby

Name: Cerby
Brand: Cerby
Rating: 4.5 (29 reviews)

AI Native

Cerby is an access management and identity security automation platform that extends lifecycle management, MFA/2FA enforcement, and credential governance to applications that lack standard federation (SAML/OIDC) or provisioning (SCIM) interfaces, using orchestration and UI automation where required.

Est 2020|Valuation $162.7M|Raised $86.5M|35 Ref Customers

LinkedIn 17K|Website|FTEs 126|HQ Alameda, California, US

MarketsIdentity Governance & Administration (IGA)

Published Oct 15, 2026

01Common complaints

- Company sizes or stages where this product is overkill or insufficient - Very small organizations (for example, fewer than 100 employees) with small application inventories may be better served by enforcing SSO for critical apps, rationalizing applications, or using password management and process controls. - Industries or use cases where competitors are clearly superior - If the primary requirement is SaaS discovery and spend optimization, vendors focused on continuous discovery and spend management may provide a better fit. - Technical requirements that this product cannot meet - Environments that forbid any form of stored/shared credentials or automation-based login orchestration may not be able to accept the vendor's automation model. - If deterministic, purely API-based provisioning is a hard requirement, UI automation approaches may be inappropriate. - Budget constraints that make alternatives more appropriate - Organizations that cannot justify incremental spending beyond their current IdP/IGA stacks should prioritize app rationalization and standards adoption. - Specific workflows or integrations where the product falls short - Social media account onboarding and MFA changes can be operationally risky; vendors document precautions to avoid lockouts. - Red flags in the buying process - Lack of public pricing transparency and absence of published security attestations are procurement risks; require clear pricing definitions and security documentation during evaluation. - Current limitations acknowledged by the vendor - Vendor documentation warns that onboarding social media accounts and changing MFA settings can result in account lockouts if recommended procedures are not followed. - Features on the roadmap (not yet available) - note estimated dates if available - Press coverage has referenced planned use of AI/LLMs to enhance detection and guidance; this was discussed as a forward-looking intention without a public delivery date. - Scale limitations (at what volume/size does it break down?) - Scale and performance constraints were not quantified in the accessible public sources; buyers should request architecture and scalability benchmarks for large-scale use cases. - Security or compliance gaps - Public documentation of SOC 2/ISO certifications or detailed compliance posture was not found in the accessible sources; this is a procurement risk until clarified and documented by the vendor. - API limitations or integration constraints - The vendor provides a developer portal and RBAC-based API access; comprehensive API limits, quotas, and coverage were not included in the accessible sources and should be obtained from the vendor.

Deal disqualifiers: what makes a poor fit

Organizations that can feasibly replace nonstandard applications with alternatives that natively support SAML/OIDC and SCIM, removing the need for a bridging solution.
Organizations that require publicly documented SOC 2/ISO certifications as a gating procurement requirement and the vendor cannot provide those attestations.

Why some customers left for competitors (churn reasons)

No direct, sourced narratives of customer churn to specific competitors were found in the accessible sources. Potential churn drivers to investigate in reference conversations include UI automation fragility, limited transparency about credential orchestration, and commercial/administrative friction.

02Why they buy

- Competitive advantages validated by customer feedback (not just vendor claims) - Documentation and self-service materials have been cited by some reviewers as helpful and sufficient to reduce dependency on vendor support in certain deployments. - Unique features and capabilities competitors lack (vendor-positioned) - An access orchestration approach designed to enable lifecycle actions and MFA enforcement for applications lacking standard APIs or federation. This capability is described in vendor materials and should be validated in pilot deployments. - Differentiation from competitors based on reviews - Public review volume is limited; differentiation is primarily supported by product positioning and integration ecosystem signals rather than extensive peer-review evidence. - Areas where competitors clearly have advantages (be balanced) - Pricing transparency and straightforward cost models are strengths for some competitors focused on discovery/governance. - Standards-first IdP ecosystems provide lower-fragility, API-based provisioning where applications support SAML/OIDC/SCIM.

Why customers chose this product over alternatives (evidence-based)

Drivers suggested in reviews and community discussions include:
- Governance of shared accounts (for example, social media) without direct password sharing.
- Extending lifecycle management from IdPs to applications that lack programmatic provisioning or federation.
- Perceived limitations of IdP SWA/manual approaches for certain nonstandard applications.

03Field reports

Review platform availability snapshot

Peer review platforms indicate limited public review volume in accessible excerpts; a market review platform showed a mid-range rating based on a small number of ratings in the accessible snapshot. Other review sites have product pages but public review content and detailed ratings were not captured in the accessible excerpts summarized here.

Examples of positive sentiment (quotes from reviews)

Examples of positive feedback include references to clear documentation and statements that implementation was straightforward in some deployments.
Some reviewers cited reliability and ease of setup for specific use cases such as social media account management across teams.

Examples of critical sentiment (quotes from reviews)

Some reviewers called out pricing transparency and administrative processes (for example, seat updates) as sources of commercial friction.

Community/social discussions – examples (anecdotal)

Community threads and forum posts discuss Cerby as one option for managing non-SSO/non-SCIM applications and advise caution for business-critical or high-risk applications unless standards-based federation/provisioning can be obtained from the application vendor.
Anecdotal comments from community forums compare Cerby with other bridging approaches and indicate a range of experiences; these are not controlled comparisons and should be treated as qualitative input.

Specific outcomes customers achieved (with metrics when available)

Vendor-published case studies exist for several customers; accessible excerpts did not include independent validation of numerical ROI claims. Any vendor-published metrics should be validated through procurement reference checks and methodology review.

Customer pain points and frustrations mentioned in reviews

Pricing transparency and administrative updates surfaced as critiques in at least some reviews.
Vendor documentation highlights unique operational risks when onboarding social media accounts, including potential account lockouts if recommended steps are not followed carefully.

Deal-breakers and reasons customers didn't purchase

Not directly documented in public reviews; likely deal-breakers include lack of published security attestations and concerns about automation-based credential handling.

Case Studies

- Available vendor-published case studies (examples found) - Published customer case studies and success stories exist for organizations such as Crunchyroll, OpenSesame, ClickUp, Productiv, and MiSalud. These artifacts are vendor-published and contain vendor-reported outcomes. - Critical evaluation of case-study evidence quality - Case studies are vendor-published and should be treated as directional. Buyers should request methodological details (baseline metrics, measurement period, attribution) and corroborate claims via reference calls. - Example "known-hard" area highlighted by vendor docs (mixed results risk) - Onboarding social media accounts is called out by vendor documentation as operationally challenging; recommended processes must be followed to avoid lockouts. This is a known operational risk area for governance projects targeting social platforms.

04Best fit

Company sizes

Inferred best fit:
- Mid-market to enterprise organizations with formal IAM or security teams responsible for offboarding, audits, and identity governance.
Evidence for enterprise use in press and case materials suggests applicability to organizations with formal procurement and security review processes.

Industries and verticals where adoption is strongest

Organizations that manage brand-sensitive or externally facing accounts (for example, social media) where governance of shared accounts is a priority.
Regulated industries such as healthcare may be potential customers, but buyers must complete compliance due diligence and request documentation.

Roles and personas: decision makers AND end users

Decision makers
- Head of IAM / IAM architect
- CISO / security engineering leadership
- IT operations leadership
End users
- Application owners in marketing, sales operations, finance operations
- IT administrators responsible for onboarding/offboarding and access reviews

Pain points and challenges the product addresses

Lack of federation and programmatic provisioning for long-tail applications.
Manual offboarding and access changes that generate audit findings or residual access risk.
Shared credentials for team-owned accounts.

Qualification criteria: what makes a suitable fit

Organizations that operate Okta, Entra, SailPoint, or similar upstream identity infrastructure and need to extend lifecycle and governance coverage to disconnected applications.
Organizations that face recurring audit and compliance pain related to access reviews and leaver processes for nonstandard applications.

05The pitch

What the product does (core value proposition in objective terms)

- Cerby is an access management and identity security automation platform focused on applications that do not support common enterprise identity standards (e.g., SAML/OIDC) or provisioning standards (e.g., SCIM) and often lack robust admin APIs. The product is designed to extend single sign-on (SSO)-like controls and lifecycle management (joiner/mover/leaver), plus MFA/2FA enforcement and credential governance, to these hard-to-integrate applications via orchestration, including UI automation where required. - The platform provides credential sharing and mechanisms intended to reduce reliance on enterprise password managers for applications that require usernames and passwords; vendor materials describe this as enabling passwordless outcomes for some nonstandard apps, which should be validated in pilots.

Target market and market positioning

- Primary buyers are IAM, IT, and security teams seeking to reduce risk and operational burden from shadow IT and disconnected applications that impede governance, auditability, and offboarding. - The product is positioned as a complement to core identity provider (IdP) and identity governance and administration (IGA) stacks (for example, Okta, Microsoft Entra ID/Azure AD, SailPoint), providing additional signals and enforcement for applications that cannot be integrated via standard protocols.

Get a comprehensive analysis of Cerby including market position, competitive landscape, adoption trends, and peer benchmarks.

Download full report →