Security
Prove who is authorised to reach your most sensitive cloud assets
A read-only review of Azure, Entra ID and AKS access paths: who can reach your secrets, data and admin roles, and the fewest changes that close it.
For CISOs, cloud platform owners, and IT directors accountable for an Azure tenant, the audit question is rarely “is access control configured?” It is “who can reach secrets, data, cluster-admin, and subscription Owner—and why?” This page explains the review that provides a computed, reproducible result and concludes with a scoping call for your tenant.
Routes nobody granted on purpose
Access to a critical asset is seldom a single grant. It is a chain of individually harmless permissions—a pipeline identity, a group membership, or a managed identity on a workload—that together reach unintended targets. The review computes which people, pipelines, and workloads are authorised to reach your most sensitive Azure, Entra ID, and AKS assets, and identifies the smallest set of changes required to close those routes.
Code computes the paths, not AI. AI generates only the narrative, runs on our self-hosted EU infrastructure, and cannot add links the computation did not find. The report states what is authorised—not what an attacker can do.
Read-only, under your control
- Access: You create a dedicated service principal with Reader and read-only Microsoft Graph permissions, and optionally a read-only cluster role on one AKS cluster.
- Collection: You run the collector yourself and send back a snapshot. Credentials never leave your tenant.
- Safety: The collector refuses write calls and credential or key listing, and never reads secret values—only their names.
What you receive
A report and a self-contained HTML page with four computed views: crown jewels, blast radius, internet exposure, and coverage gaps. The remediation plan is prioritised; every change includes its commands, a read-only verification, and the risk if ignored.
Changes that break intended functions are not recommended. Where evidence cannot settle intent—such as a workload reading its own secret by design or a break-glass account—the decision remains yours. Any data inaccessible to the read access is reported as unknown, never as absent.
Controls are mapped to the Microsoft Cloud Security Benchmark families. The result provides evidence for the access-control and asset-management measures of Directive (EU) 2022/2555 (NIS2), Article 21(2)(i). Subsequent collections are compared against previous ones to highlight changes over time.