Stay ahead in the age of AI agents
At nerl0 we explore how AI agents and non-human identities change who can reach your data, and we build the tool to keep that visible. Read what we learn about access, evidence and fixing what matters first.
The AWS root access key can perform any action on any resource in the account
Recommended action: Delete the root account access key · Remove accessDetected: The AWS account has a root access key. The root user holds an access key; the root user is not bound by IAM policies and holds every action on every resource. Source: scan e07c354c-4aaa-4e30-b18f-8a1468449688 observed 2026-11-09T06:00:00Z, aws coverage complete.
5 measures changed between the scan of 7 Nov 07:00 and the scan of 9 Nov 07:00.
- The scan of 7 Nov 07:00 collected salesforce only partly: a difference there can be a difference in visibility, not in your environment.
- Counts compare totals; they do not say which entities came or went. Latest changes on the dashboard lists them per question.
Ask anything, @ charts & metrics, or / for skills…
Turn authority paths into fixes with Issues and the Agent
What a non-human identity is, and why it matters
The service accounts, keys and agents that act in your company without a person behind them.
How to read the Security Graph
Follow a route from an agent through roles and grants to the data it can reach.
Evidence is not a verdict
How automated checks map to ISO 27001, NIST CSF, CIS and NIS2, and what the counts do and do not say.
Connectors
IAM roles, keys, Lambdas and agents that can reach your buckets, secrets and databases
GitHub Apps and AI agents that can write to your repositories
Slack apps and bots, and the channels they may reach
OAuth service apps and API tokens that hold admin authority
Service accounts and API keys that can act in your projects
P▦27 more connectors across cloud, code, identity and AI
Read-only by default
Why nerl0 connects to your platforms through their own interfaces and never needs write access.
5 measures changed between the scan of 7 Nov 07:00 and the scan of 9 Nov 07:00.
- The scan of 7 Nov 07:00 collected salesforce only partly: a difference there can be a difference in visibility, not in your environment.
- Counts compare totals; they do not say which entities came or went. Latest changes on the dashboard lists them per question.
Ask anything, @ charts & metrics, or / for skills…
Five questions to ask the Agent first
Start with exposure, changes since the last scan, and who can reach crown-jewel data.
Updated 09 NovOHops-automation-agent can write to production crown-jewel prod/payments/stripe-key
Updated 09 NovOHanthropics/claude-code-action in northstar-tech/platform can write to repositories
Open–Assign an owner to the unowned agent
Updated todayMCThe AWS root access key can perform any action on any resource in the account
ClosedMCRotated secret no longer reachable from other accounts
From finding to fix
Work the Issues board: one recommended action, one owner, verified by the next scan.
Activity
A route is not proof of use
Granted authority and observed activity are different things. Why every answer says what it cannot show.
Deciding which data stores are crown jewels
Classify the stores that matter most, then track who can reach them over time.
Connecting your first five platforms
Cloud, code, identity, chat and AI: what each connector reads and what it shows you.