Obsidian provides a connected view of SaaS identity, permissions and activity, while Falcon Shield extends endpoint DNA into SaaS and leaves teams stitching together fragmented signals without the connected view required to secure complex, interconnected environments.
Obsidian collects and normalizes data directly from SaaS applications into our Knowledge Graph, no SIEM dependencies, no fragmented signals. This keeps the relationships between identity, permissions, and activity intact from the start, giving security teams the complete context they need to investigate threats accurately and respond fast.
Our Knowledge Graph is enriched with intelligence from 500+ incident response engagements. This means our detections reflect actual attacker behavior in SaaS environments, not generic rules. Teams get visibility into emerging threats as they happen, with the context to understand real impact in their environment.
While static inventories show what's configured, Obsidian reveals how identities, permissions, and integrations are actually being exploited across applications. Our continuously updated model connects user activity to configuration, so teams can see complete attack chains and detect when legitimate access turns malicious.
Falcon Shield is positioned as an AI native extension of CrowdStrike’s endpoint and identity platform. It brings SaaS posture checks, configuration views and OAuth app inventories into the Falcon console. While appealing to organizations already invested in Falcon, this approach tends to extend endpoint and identity concepts into SaaS through settings, policy checks and point-in-time snapshots.
Because Falcon Shield is centered on configuration status rather than cross application behavior, teams may find it harder to understand how identities, tokens and integrations relate to each other across systems or how access paths evolve over time. Behavioral and relationship context often depends on external processors or SIEM workflows.
Organizations often choose Obsidian because the architecture keeps identity, permissions, token relationships and SaaS activity connected in one place. Rather than routing events through data processors or treating posture, access and activity as separate workflows, Obsidian collects and normalizes primary data directly, keeping those relationships intact.
This connected foundation helps teams understand how access is granted, how privileges chain across applications and where integrations may create unintentional reach. Unlike platforms that rely on static inventories and isolated logs, Obsidian maintains a continuously updated model that surfaces how identities and access evolve across apps.
Teams also value that Obsidian links posture, identity and activity as part of one system. When configurations change, approvals are bypassed, permissions drift or integrations gain new reach, the context is visible immediately. This helps teams prioritize the issues that matter and understand their environment with greater certainty.
The result is a clearer picture of how SaaS and AI systems interact, how privileges propagate and where access paths may create risk. This level of connected insight is what many organizations expect from a modern SaaS security platform.
Mario Duarte, Vice President of Security, Snowflake
Heather Akuiyibo, VP Go-To-Market, Databricks
Øyvind Berget, Chief Technical Officer, Norma Cyber
See what gives Obsidian the edge over others
.svg%201.svg){kind=logo}
