Developer Tools · head to head
Earthly vs Semperis
Semperis
Cybersecurity
Identity threat detection and Active Directory forest recovery for AD, Entra ID and Okta, from a privately held US vendor.
- From
- On request
- Free plan
- No
The short version
- Only Earthly has a free tier, so it costs nothing to try first.
- Each has a real cost: Earthly pricing model not published; requires sales contact; Semperis scope is limited to Active Directory, Entra ID and Okta, so an organisation whose critical identity lives elsewhere gets little from it, and the recovery value declines in direct proportion to how much has already moved off on-premises AD.
- They diverge on capability: Earthly covers Policy as code, Semperis covers Active Directory Forest Recovery.
- Prices and features above were last checked on 30 August 2026.
Where they differ
Only the attributes on which Earthly and Semperis actually diverge.
Identical on both: user rating (Not yet rated).
What each one covers
Drawn from each product's published feature list. An absence here means we hold no record of it - not that the product lacks it.
Only in Earthly
- Policy as code
- Multi-stage enforcement
- AI agent governance
- Repository-wide policies
- Incident response automation
- Compliance management
- Earthfiles build tool
- Satellites
Only in Semperis
- Active Directory Forest Recovery
- Malware-free restore
- Replication-stream monitoring
- Automated rollback
- Attack indicator scoring
- Entra ID and Okta coverage
- Purple Knight
- Forest Druid
What people use each for
The jobs each tool is most often brought in to do.
Earthly
- Enforcing engineering standards across AI and human developersnot Semperis
- Automating incident response procedures across all repositoriesnot Semperis
- Embedding compliance requirements into development workflowsnot Semperis
- Standardizing build processes with Earthfilesnot Semperis
Semperis
- An organisation that cannot answer an auditor or insurer asking how long it would take to rebuild Active Directory after a destructive attacknot Earthly
- Post-incident recovery where domain controllers are compromised and restoring from system-state backup would reintroduce the attacker's footholdnot Earthly
- Continuous detection of privileged group changes and directory-level tampering that domain controller security logs missnot Earthly
- Hybrid estates where AD, Entra ID and Okta all matter and no single tool currently shows changes across the threenot Earthly
Where each one falls short
Documented limitations, not opinions. Every one is a constraint you would hit in normal use.
Earthly
- Pricing model not published; requires sales contact
- Earthly Lunar is a recent launch (2025) with limited track record
- Primarily GitHub-focused; limited integration with other platforms
- No public documentation on pricing or feature tiers
Semperis
- Scope is limited to Active Directory, Entra ID and Okta, so an organisation whose critical identity lives elsewhere gets little from it, and the recovery value declines in direct proportion to how much has already moved off on-premises AD.
- The licence buys tooling, not a proven runbook: forest recovery is only worth what your last rehearsal demonstrated, and a plan that has never been executed end to end in a lab is an untested assumption regardless of what was purchased.
- It overlaps with backup and directory management products from Quest, Veeam, Commvault and others, so the buyer must argue internally why a dedicated product is needed alongside a backup contract that already claims to protect Active Directory.
- Running Directory Services Protector well requires someone who understands AD internals, replication metadata and Tier 0 attack paths, and without that person the alerts on privileged changes are either ignored or auto-reverted in ways that break legitimate administration.
- Licensing is driven by identity object counts, so directories carrying years of stale user accounts and service principals pay for objects that should have been deleted, and the cleanup project that would reduce the bill is the one nobody has time for.
Pricing, plan by plan
Earthly
FreeNo published plan breakdown. See the Earthly review.
Semperis
On requestNo published plan breakdown. See the Semperis review.
Which should you pick?
Choose Earthly if
- You need policy as code.
- You want to start without paying.
- You work on Web, CLI.
- You also want multi-stage enforcement.
Choose Semperis if
- You need active directory forest recovery.
- You also want malware-free restore.
Questions people ask
- Is Earthly or Semperis better?
- Neither clearly leads. Earthly starts at Free and Semperis at On request, and user ratings are close enough to be indistinguishable. Choose on capability and platform support.
- Which is cheaper, Earthly or Semperis?
- Earthly has a free tier; the other does not. Paid plans start at Free for Earthly and On request for Semperis.
- Does Earthly or Semperis run on more platforms?
- Earthly runs on Web, CLI. Semperis runs on Web.
- Can I use Earthly for free?
- Yes. Earthly has a free tier, so you can try it without paying. Semperis starts at On request.
- What is Earthly best used for?
- Earthly is most often used for enforcing engineering standards across ai and human developers, automating incident response procedures across all repositories, embedding compliance requirements into development workflows, standardizing build processes with earthfiles. Of those, enforcing engineering standards across ai and human developers and automating incident response procedures across all repositories are not what Semperis is typically brought in for.
- What can Earthly do that Semperis cannot?
- Earthly covers Policy as code, Multi-stage enforcement, AI agent governance, Repository-wide policies. Semperis covers Active Directory Forest Recovery, Malware-free restore, Replication-stream monitoring, Automated rollback.
Answered from the vendors’ own pages
Earthly: What is the difference between Earthfiles and Earthly Lunar?
Earthfiles is an open-source build tool that reached 12,000 GitHub stars and is used by companies like NVIDIA, Intel, and Databricks. Earthly Lunar is a separate governance platform launched in 2025 for enforcing standards across development workflows.
SourceSemperis: Does this replace my backups?
No. It replaces the Active Directory recovery procedure specifically. You still need backups for everything else, and the point of Semperis is that a generic system-state backup of a domain controller is a poor way to recover a forest because it restores the operating system along with whatever compromised it.
Earthly: How does Earthly Lunar enforce standards?
Lunar converts engineering standards, compliance requirements, and processes documented in AGENTS.md files, wikis, and incident postmortems into enforceable guardrails that apply consistently across repositories and development stages.
SourceSemperis: Is it useful if we are cloud-only on Entra ID?
Partly. Directory Services Protector covers Entra ID and Okta for change tracking and posture, but the forest recovery product, which is the strongest reason to buy, applies to on-premises Active Directory. A genuinely cloud-only organisation should weigh it against Microsoft's own tooling.
Earthly: What is the pricing for Earthly Lunar?
Pricing is not published on the website. Interested customers should contact Earthly's sales team for current pricing and feature tiers.
SourceSemperis: Are Purple Knight and Forest Druid really free?
Yes, both are free downloads with no licence requirement, and they are widely used by organisations that are not Semperis customers. They are also, transparently, the top of the sales funnel.
Semperis: How long does forest recovery actually take?
The honest answer is whatever your rehearsal took. The vendor's case is hours instead of days, and automation genuinely removes most manual steps, but the number that matters for your board is the one from a test in your own environment.
Semperis: Does it require agents on domain controllers?
It collects directory changes from the AD replication stream, which is what lets it see changes that bypass the security log. Deployment details vary by product and version, so confirm the exact architecture against your domain controller change-control rules.
Related pages
Other head to heads
- Earthly vs Spacelift
- Earthly vs Dagger
- Earthly vs Nixpacks
- Earthly vs Cloud Native Buildpacks
- Earthly vs OpsLevel
- Earthly vs Namespace
- Earthly vs Depot
- Earthly vs Blacksmith
- Earthly vs WarpBuild
- Earthly vs Ona (formerly Gitpod)
- Earthly vs Garden
- Earthly vs Nx Cloud
- Earthly vs Cody
- Earthly vs ConfigCat
- Earthly vs Cortex
- Earthly vs Deep Code
- Earthly vs Deno
- Earthly vs Bitdefender Total Security
- Earthly vs 1Password
- Earthly vs Norton 360
- Earthly vs LastPass
- Earthly vs NICE Actimize
- Earthly vs Netwrix
- Earthly vs VMware Carbon Black
- Earthly vs LogRhythm SIEM
- Earthly vs One Identity
- Earthly vs Ping Identity
- Earthly vs Signicat
- Earthly vs CrowdStrike Falcon
- Earthly vs Authy
- Earthly vs Baffle
- Earthly vs Beyond Identity
- Earthly vs BeyondTrust
- Earthly vs Burp Suite
- Earthly vs Bitdefender VPN
- Semperis vs Spacelift
- Semperis vs Dagger
- Semperis vs Nixpacks
- Semperis vs Cloud Native Buildpacks
- Semperis vs OpsLevel
- Semperis vs Namespace
- Semperis vs Depot
- Semperis vs Blacksmith
- Semperis vs WarpBuild
- Semperis vs Ona (formerly Gitpod)
- Semperis vs Garden
- Semperis vs Nx Cloud
- Semperis vs Cody
- Semperis vs ConfigCat
- Semperis vs Cortex
- Semperis vs Deep Code
- Semperis vs Deno
- Semperis vs Bitdefender Total Security
- Semperis vs 1Password
- Semperis vs Norton 360
- Semperis vs LastPass
- Semperis vs NICE Actimize
- Semperis vs Netwrix
- Semperis vs VMware Carbon Black
- Semperis vs LogRhythm SIEM
- Semperis vs One Identity
- Semperis vs Ping Identity
- Semperis vs Signicat
- Semperis vs CrowdStrike Falcon
- Semperis vs Authy
- Semperis vs Baffle
- Semperis vs Beyond Identity
- Semperis vs BeyondTrust
- Semperis vs Burp Suite
- Semperis vs Bitdefender VPN