See every path to sensitive data
Follow authority from every agent and non-human identity through roles and credentials to your crown jewels, and cut the one route that matters.
Trace authority to the data that matters
Follow every authority path from an agent through roles and credentials to a crown-jewel secret. Every step is an observed relationship, not a guess.
Authority pathsSecurity Graph
One graph for every platform
nerl0 connects AWS, Azure, Salesforce, GitHub, Slack, OpenAI and MCP servers, and turns what it finds into authority paths.
AWS · Lambda functionpartner-sync can assume partner-integration-role, which other accounts can assume.
prod/payments/stripe-keyCROWN JEWELpartner-sync can read production crown-jewel prod/payments/stripe-key through partner-integration-role.
Cut the path. The next scan verifies.
nerl0 recommends the breakpoint that interrupts the most routes. You apply the change yourself, the next scan confirms the route is gone.
NRL-48partner-sync can read production crown-jewel prod/payments/stripe-key through partner-integration-role, which other accounts can assume
NRL-47Principals in other accounts can read production crown-jewel prod/payments/stripe-key through partner-integration-role
NRL-44claude-code installation token can read 7 repositories
NRL-41ops-automation-agent wrote to northstar-build-artifacts
NRL-46ops-automation-agent can administer prod/payments/stripe-key through ops-admin
NRL-43remediator-admin can administer prod/payments/stripe-key
NRL-39Unowned agent found in connected platforms
NRL-38partner-integration-role no longer reads prod/payments/stripe-key
NRL-36Share of identities older than 365 days dropped below target
Follow credentials into every repository
One installation token can read far more than the agent that holds it. See the whole fan-out at once.
partner-sync can read production crown-jewel prod/payments/stripe-key through partner-integration-role, which other accounts can assume
Every path becomes an issue with an owner
Severity, impact, evidence and the recommended breakpoint in one place, so nobody has to rebuild the story from logs.
- SeverityMedium, High, with the reason.
- EvidenceProven, with how often it was reproduced.
- OwnerAssigned, tracked, verified by the next scan.
Activity
Every event on the path, newest first
Reads, writes, decisions and re-checks sit on one timeline per entity, so you can show who knew what and when.
- DecisionsWho opened, assigned or closed an issue.
- ActivityEvery read and write on the paths.
- ReproducedEach path is re-checked on every scan.
Find the agents nobody registered
Shadow agent detection lists every agent and MCP server found in your connected platforms, with privilege, data reach and risk, so unowned agents cannot hide.
Shadow agent detectionSee exposure by platform and access
Data access leads your exposure. See where read, write and admin access sit across your platforms, then open the Security Graph from any cell.
ExposureThe question is never only who has access. It is which path leads to the data you cannot lose.
Non-human.
Non-negotiable.