Defakto, formerly SPIRL, vs Aembit: trust-domain SPIFFE ops vs access policy and target integrations
SPIRL (now Defakto) when the gap is SPIFFE trust-domain management and non-human identity lifecycle. Aembit when the gap is attested access policy plus managed SVID generation and secretless credentials to SaaS, cloud, and MCP targets.
SPIFFE and SPIRE already proved one hard fact: a short-lived X.509 or JWT SVID can attest which workload is talking in a cluster you control. That lineage is public, code-backed, and what platform engineers mean when they say workload identity instead of another vault rotation ticket.
SPIRL commercialized SPIFFE operationalization and, in October 2025, rebranded as Defakto without changing that foundation. Aembit’s first-party proof looks different on the surface: a published Free tier, Teams at $20 per workload or agent per month, an MCP identity gateway with OAuth 2.1, and blended human-plus-agent identity on the access decision. Same NHI keyword. Different Monday queue.
Both sides can put SPIFFE-shaped credentials in play. Aembit docs describe JWT-SVID generation and X.509-SVID issuance as managed identity (an alternative to self-run SPIRE). Defakto centers trust-domain management, attestation into Mint, discovery/right-sizing, and NHI lifecycle across mesh and CI. Aembit centers Trust Provider attestation, access policy and context, then delivery of short-lived credentials (including SVIDs and other providers) to the target services workloads and agents need. Match the queue you still fail: operating SPIFFE trust domains and identity lifecycle, or enforcing access policy with integrations to SaaS, cloud, and MCP.
| Job | Commercial SPIFFE trust-domain ops and NHI lifecycle: Mint SVIDs, Ledger discovery, Trim right-sizing, Ship for CI/CD, Mind for AI agents | Workload and agent identity control plane: attest, enforce access policy and context, deliver secretless short-lived credentials (including managed JWT-SVID / X.509-SVID) to target services |
|---|---|---|
| How a bad day closes | A workload or job gets a short-lived verifiable identity at runtime instead of a static key; orphaned or overprivileged service accounts shrink under Trim/Ledger | Access is denied or scoped by policy before a long-lived secret is needed; short-lived credentials (SVID or other providers) are delivered; revoke and audit against the workload or blended agent identity |
| Day-to-day workflow | Trust domains, cluster attestation, identity issuance health, discovery of unmanaged NHIs, CI jobs still carrying hardcoded credentials | Access policies, agent and MCP authorization, conditional-access posture signals, event logs of who (workload/agent/user blend) reached what |
| Deploy | Cloud, on-prem, hybrid; Kubernetes and service mesh (Istio/Linkerd), CI systems, multi-cloud IAM; Console plus agents/CLI (spirlctl / defakto CLI lineage) | SaaS identity control plane across cloud, SaaS, and on-prem targets; OIDC, OAuth 2.1, SPIFFE SVID providers, MCP gateway; no proprietary SDK required per first-party FAQ |
| License/pricing | Sales-quoted; no public dollar SKU on defakto.security (checked 30 Sep 2026) | Workloads: Free (10), Teams $20/workload/mo, Enterprise custom. Agents: Free (3), Teams $20/agent/mo, Enterprise custom (checked 30 Sep 2026) |
| Who operates it | Platform / IAM / security engineering owning SPIFFE trust domains and NHI lifecycle | Platform, DevSecOps, and identity owning runtime access policy for workloads and AI agents |
We reviewed Defakto (formerly SPIRL) product and rebrand pages, Aembit homepage FAQ and pricing, Aembit’s MCP/OAuth guidance, and live community threads the same day (30 Sep 2026). We did not run either product in a paid tenant, so this is not a hands-on benchmark. SPIRL is a rebrand to Defakto, not an acquisition. Aembit still ships independently on aembit.io.
SPIRL (Defakto)
Aembit
Aembit documents MCP authorization with OAuth 2.1 and PKCE as part of how agents reach tools without parking long-lived secrets in client configs. Defakto’s published modules (Mint, Ledger, Ship, Trim, Mind) stay centered on trust-domain SPIFFE ops and NHI lifecycle.
Editions and pricing
Aembit posts self-serve Free and Teams packs for workloads and for AI agents. Defakto (SPIRL) keeps dollars on the quote. Model the invoice against whether you need a published card this week or an enterprise SPIFFE rollout next quarter.
| How you buy it now | Demo / sales on defakto.security; brand is Defakto after the Oct 2025 SPIRL rebrand | Self-serve Free and Teams on aembit.io/pricing, Enterprise custom |
|---|---|---|
| Public units (30 Sep 2026) | No public dollar table verified on first-party pages | Workloads Free: 10 workloads, 10 policies, 24h logs. Teams: $20/workload/mo (grow to 50). Agents Free: 3 agents, 1 MCP gateway, 5 MCP auth policies. Teams: $20/agent/mo (grow to 500). Enterprise: unlimited + conditional access |
| What the invoice covers | Enterprise NHI platform scope: identity issuance, discovery/governance, CI/CD and AI modules, hybrid footprint | Workload count and/or AI agent count, access policies / MCP authorization policies, log retention, support tier |
| Self-serve start | Demo-led; no public freemium checkout on the marketing site | Free forever starter for small workload or agent projects; upgrade path without a sales call for Teams |
If finance needs a published card this week, Aembit’s Free and Teams meters are usable inputs. If the RFP is multi-cloud SPIFFE operationalization with discovery and right-sizing of service accounts, expect Defakto (and usually Aembit Enterprise) to land on custom terms.
How credentials are issued
| Issuance center | Mint issues short-lived, purpose-bound SPIFFE SVIDs after attestation and policy checks inside trust domains you operate | Credential Providers can generate SPIFFE JWT-SVID tokens and issue X.509-SVIDs (managed identity) after Trust Provider attestation and access-policy evaluation; also brokers other short-lived credentials to approved targets |
|---|---|---|
| Attestation / standards | Built on SPIFFE (and WIMSE messaging); cluster and CI attestation into Mint; Istio/Envoy SDS-compatible paths in docs; trust-domain operations are the product center | Trust Provider attestation feeds access decisions; OIDC, OAuth 2.1, SPIFFE JWT-SVID and X.509-SVID Credential Providers, workload identity federation, Cross App Access / ID-JAG on first-party pages |
| CI/CD and AI angle | Ship replaces hardcoded pipeline credentials with dynamic identities; Mind extends the same model to AI agents and LLMs | Federated CI/CD secretless paths; MCP gateway and blended identity for agents acting with or without a human initiator |
| Discovery and right-size | Ledger discovers and catalogs NHIs; Trim reduces overprivileged service accounts; identity lifecycle is explicit product surface | Stronger on access enforcement, audit, and target-service credential delivery than on SPIFFE discovery/right-sizing modules; managed SVID issuance does not replace Defakto-style Ledger/Trim lifecycle |
That Feb 2026 note is why this pair splits on operating model, not on whether either side can mint an SVID. SPIRL/Defakto leans into trust-domain management and NHI lifecycle for environments you operate. Aembit leans into attested access policy and integrations when agents and workloads reach SaaS, MCP servers, and services where the weekly failure is standing credentials and missing attribution across targets.
What gates access
| Runtime gate shape | Identity issuance policy before Mint creates the short-lived identity; no standing privilege by design on the product narrative | Policy engine + conditional access (posture, geography, time) before short-lived credential delivery; instant revocation language on first-party pages |
|---|---|---|
| MCP / agent gate | Mind scopes what AI systems can access with dynamic identities; less published as an MCP OAuth gateway product | MCP Identity Gateway with OAuth 2.1 for MCP clients; blended identity joins agent and human IdP context on one decision |
| Audit unit | Actions attributed to issued non-human identities across Console/Ledger reporting | Fully attributed logs per verified workload or blended agent identity, including agent vs human-initiated distinction in customer stories |
| Who writes the next step | Platform owns trust domains and cluster registration; security owns discovery and Trim policy; eng consumes identities without storing secrets | Security/identity owns access policies and conditional rules; eng consumes secretless access without auth code or vault tickets for each hop |
RFPs that only say “NHI platform” still get two credible responses. Ask whether Monday’s ticket is still operating SPIFFE trust domains and shrinking service-account sprawl, or enforcing access policy so workloads and agents stop holding standing credentials to Snowflake, Vault, Claude, or MCP servers.
Where they overlap
Both sell secretless, short-lived access for non-human actors. Both can issue or deliver SPIFFE-shaped credentials (Defakto via Mint in trust domains you operate; Aembit via managed JWT-SVID / X.509-SVID Credential Providers). Both extend the story to AI agents. The overlap is real. The useful split is attestation and trust-domain / identity-lifecycle operations versus access policy, blended agent attribution, and target-service integrations (SaaS, MCP, cloud). Match whether you still fail at running SPIFFE ops and shrinking NHI sprawl, or at policy-scoped access to the systems those identities need.
Broader NHI shortlists sit on non-human identity tools. Other workload-access compares live under Compare.
When to use both
Running SPIRL/Defakto and Aembit as two full NHI platforms on the same trust domain is often waste, but a stacked pattern can be real: Defakto (or open SPIRE) owns trust-domain SPIFFE ops and NHI lifecycle in Kubernetes and CI, while Aembit owns access policy and credential delivery to SaaS, MCP, and multi-cloud targets (including cases where Aembit itself generates SVIDs). They are not always 1:1 substitutes. If one team owns both queues, pick the layer that matches the trust-domain work you already staff.
Choose Defakto (formerly SPIRL) when you need SPIFFE trust-domain operations, discovery, and right-sizing for workloads and CI. Choose Aembit when you need attested access policy with published self-serve pricing, managed SVID options, MCP controls, and blended agent attribution to target services.
FAQs
Was SPIRL acquired?
No. In October 2025 SPIRL rebranded to Defakto while remaining the same company. spirl.com redirects to defakto.security. Aembit was not acquired during research on 30 Sep 2026 and still ships independently on aembit.io. Reconfirm ownership on the quote if diligence requires it.
Does SPIRL/Defakto replace Aembit’s access-policy layer?
Not by default. Between these two, Defakto centers trust-domain SPIFFE ops and NHI lifecycle (Mint, Ledger, Trim, Ship, Mind). Aembit centers attestation into access policy and delivering short-lived credentials to target services, including MCP, and can also generate JWT-SVID / X.509-SVID via managed Credential Providers. Teams with strong SPIFFE ops that still store SaaS keys in agents often still need an access-policy / integration layer.
Does Aembit replace SPIFFE trust-domain operationalization?
Aembit can generate SPIFFE JWT-SVID tokens and issue X.509-SVIDs as managed identity, and can consume other workload identity signals. That is not the same product surface as Defakto’s commercial SPIFFE operationalization (trust domains, Mint, mesh/CI integrations, Ledger/Trim). If the weekly failure is “we never got SPIFFE trust domains into production,” compare that rollout explicitly in the PoC.
What public prices should buyers note?
Aembit lists Free (10 workloads or 3 AI agents), Teams at $20 per workload or per agent per month, and Enterprise custom on aembit.io/pricing (checked 30 Sep 2026). Defakto has no public dollar SKU; budget from a sales quote.
