Get early access

Coverage

What we connect to, and how deep.

This is not a logo wall. Breadth is easy to buy and useless to you — reviews do not fail across four hundred applications, they fail inside about ten.

Every tier below is labelled now, next or later. If you are evaluating this as a capability commitment, an unlabelled roadmap is how you get a broken promise in month two.

Get early access Request a connector
A service account, drawn as a scorpion sealed in amber
Scorpion — the service account. The reason on-prem Active Directory is Tier 0 rather than a fast-follow.

Deep tier Now

Entitlement-level, on the systems where reviews fail.

“Deep” means we read what is inside, not that we can authenticate against it. Here is what that means concretely, system by system.

  • OktaUsers, groups, app assignments, admin roles, policies, and the local accounts that bypass it.
  • Entra ID + on-prem Active DirectoryDirectory roles, nested groups resolved to effective access, service accounts, stale computer objects, delegated permissions.
  • Google WorkspaceAdmin roles, OAuth grants to third-party apps, shared drive permissions, service accounts and their keys.
  • AWS, Azure and GCP IAMRoles, policies and trust relationships resolved to effective permissions — including what a role can assume next.
  • SalesforceProfiles, permission sets, permission set groups, sharing rules, and who really holds Modify All Data.
  • NetSuiteRoles and permissions at transaction level, with segregation-of-duties conflicts surfaced as findings.
  • WorkdaySecurity groups, domain and business process policies, and the HR data that anchors joiner–mover–leaver.
  • GitHubOrg and repo roles, outside collaborators, deploy keys, personal access tokens, GitHub Apps.
  • SnowflakeRole hierarchy resolved to effective grants, service users, and key-pair authentication.
  • Microsoft 365Admin roles, mailbox delegation, sharing links, and application consent grants.

Everything else

The rest of the estate, staged honestly.

  • On-prem Active Directory

    Tier 0 — now

    The richest hygiene surface in most mid-market estates, and the clearest gap against SaaS-only competitors. Read through one lightweight, read-only collector per site.

  • Universal CSV import

    Now

    Any application joins a review without waiting for a connector. Evidence-grade: imported access carries the same review, certification and audit trail as everything else.

  • Connector SDK

    Now

    Build your own against the same interfaces we use. We intend to open-source it — community connectors won field evaluations — though that is an intention rather than a commitment.

  • Broad SaaS pack

    Next

    Shallow coverage — accounts, roles, last activity — across the long tail. Follows the deep tier deliberately: breadth before depth is how this category produces dashboards nobody acts on.

  • vSphere, SQL Server, Oracle

    Tier 1 — fast-follow

    On-prem infrastructure and database access, where standing privilege tends to be oldest and least reviewed.

  • SDK-deployed and gateway-pattern connectors

    Tier 2 — enterprise

    Reverse-proxy and API-gateway integration patterns for estates that cannot expose an API directly.

  • Deferred, and worth saying so

    Not planned

    Mainframe and RACF, deep on-prem ERP, and file-share ACL scanning are not on the roadmap. If one of these is the reason you are evaluating, we are not the right fit yet, and you should know that now rather than in week six.

What “agentless” actually means here.

It means nothing is installed on endpoints. No software on laptops, no software on application servers, no kernel modules, nothing to package and push.

It does not mean nothing is installed anywhere. Reading on-prem Active Directory requires one lightweight read-only collector per site, because there is no other way to read a directory that is not exposed to the internet. It runs as a service, holds read-only credentials, and initiates outbound connections only.

We would rather you hear this on the coverage page than discover it in a security review.

Operations

It has to survive you.

Mid-market identity programmes die when one champion leaves. The tool gets bought, configured around one person’s knowledge, and quietly stops being maintained the month they hand in their notice.

So there is no deployment project, no professional services engagement, no tuning cycle and no certification path. Connectors update themselves. Findings keep arriving. Campaigns keep running on schedule.

If you leave, it keeps working. That is a design constraint, not a marketing line — it is the reason we will not sell you a deployment.

A contractor identity, drawn as a worker bee sealed in amber
Worker bee — the contractor. Belongs to another hive, and should leave when the work is done. So should your consultants.

Missing something?

Request a connector.

Two fields, because we are asking you for a favour. Every request is logged and the tally genuinely drives what gets built next — this is the clearest demand signal we have.

So we can tell you when it lands.

Find out what is in your amber.

Register for early access. Connect one system read-only, and see your first findings within the hour — the accounts nobody owns, the privilege nobody granted, the access that was never actually removed.

Get early access See what we connect to
A service account, drawn as a scorpion sealed in amber

Scorpion — the service account. Ancient, over-privileged, still venomous. Real scorpions turn up in real amber, which makes this the most literally accurate specimen in the set.