Welcome to nerl0

Your company no longer runs only on people. AI agents, service accounts, API keys and MCP servers act on your behalf, and most of them can reach more than anyone intended. nerl0 shows which ones exist, what they can reach, and which single change closes the most exposure.

These docs take you from the first connected platform to your first verified fix, in the order you will use them.

What you’ll find in these docs

• Get started: What nerl0 measures and how it differs from a one-off audit. The quickstart walks you through your first scan, from connecting a platform to reading your first answers.
• Set up your workspace: Connect cloud, code, identity and AI platforms, decide which data stores are crown jewels, and organise what you see by owner and team.
• Interpret your results: Read the Questions you track, follow a path in the Security Graph, work the Issues list and check the Evidence behind each answer.
• Take action: Each issue names the smallest change that closes it. Assign an owner, apply the change, and let the next scan prove it worked.
• Your workspace: Members and roles, notifications, and how nerl0 handles your data.

What nerl0 does

nerl0 reads your platforms and builds one current map of agents, identities and data stores. Instead of listing misconfigurations, it follows authority: who can act, through which route, on which data. It answers three things that matter for AI in your company:

• Questions: The things you need to know, such as who can reach crown-jewel data, tracked and compared from scan to scan.
• Paths: The chain of roles, keys and grants that gives an agent access, shown in the Security Graph.
• Issues: One recommended action per finding, with an owner, ordered by severity and impact.

The basis for all of it is Connectors: the platforms, log sources and tools that nerl0 reads. Everything you see in nerl0 can be traced back to a scan and a connector.

What nerl0 does not do is just as important. A route shows granted authority, not proof that the access was used. Every answer says what it cannot show, so you never read more into a number than it contains.

Technical approach: read-only connectors

Why we only read

Many security tools need an agent installed on your hosts or write access to your platforms. That approach has costs:

• More attack surface: A tool with write access becomes one more identity that can be abused.
• More rollout work: Agents on hosts need maintenance, approvals and exceptions.

Our connector approach

nerl0 connects to the platforms you already run through their own interfaces:

• Read-only by default: All connections are read-only unless stated.
• Same view as your platforms: Roles, keys, grants and bots are read as the platform reports them.
• Gaps are flagged: If a platform was only collected partly, the answer says so instead of hiding it.

This means what you see reflects your environment, not an estimate of it.

How nerl0 helps

nerl0 shows you where you stand and what to do about it. You can track exposure over time, spot when a new agent or permission appears, and trace each answer back to the scan behind it.

The analysis goes beyond a single report: you can ask the Agent in plain words, export tables and charts as CSV, and follow every number to its evidence.

nerl0 helps you:

• Find every agent: See AI agents, service accounts, keys and MCP servers in one inventory.
• Trace authority: Follow each route from identity to the data it can reach.
• Protect crown jewels: Spot who can reach your most sensitive stores.
• Fix what matters first: Work issues in order, each with an owner and one action.
• Prove it worked: Let the next scan verify every change.
• Show your work: Back each answer with evidence for audits.