See everything one compromised account can reach.
Pick either one and the graph draws what it reaches. They stop looking identical immediately.
Posture, blast radius
Two admin accounts look identical on paper and reach completely different things.
How it works
Four rings for an identity: direct, group, nested and role, then lateral movement
Three rings for an application, including what its OAuth grants expose
An impact score weighted by what the account can reach, which ranks two admins with different reach differently
The jobs it is bought for.
Close the door firstFix the four exposures worth fixing, not the fourteen hundred
Nobody owns this accountEvery service account, key and token gets a name against it