GraphnAI
Stop admiring the problem. Start fixing it.
GraphnAI maps every identity in your directories, shows you which attack paths are real, and fixes them with changes you can undo.
The film
One Graphne. Every job.
Three minutes with Graphne and its crew, from a cornfield to a fix you can undo.
How it works
See the path. Judge how real it is. Fix it. Undo it.
Most identity tools stop at a picture of the problem. GraphnAI carries on to the fix, and you stay in control.
- 1. See
Every identity in one graph
Users, groups, computers, service accounts and app registrations from Active Directory and Entra ID, with the permissions between them. GraphnAI finds Tier 0 for you.
See what's real - 2. Judge
Evidence on each step
Each relationship is Theoretical, Constrained or Validated, depending on how much GraphnAI has checked it. Fix what's proven first.
How fidelity works - 3. Fix
Simulated before anything changes
Select Fire finds the cause and shows the blast radius and a safety score. You choose how much to automate.
Fix it safely - 4. Undo
Every change can come back
GraphnAI only runs changes it can reverse, and records how to undo each one.
Closed-Loop Rollback
Tiered Fidelity™
A path in a graph isn't proof. We show you how much is.
Every attack-path tool draws lines. GraphnAI labels how much evidence stands behind each step, and raises the label as evidence comes in.
Theoretical
Read from the directory
Every group membership and permission entry is a possible step. In this company, 34 people have a route to Tier 0, over 54 different steps. Nothing on those steps has been checked yet.
54 steps, all Theoretical
Constrained
Checked against what could stop it
GraphnAI checks the constraints on each step, like a disabled account, a Group Policy setting or a Conditional Access policy. 11 of these steps have been checked, and 5 turn out to be blocked. A blocked step stays on the map, dimmed: the access exists, but something stops it being used.
11 checked, 5 blocked
Validated
Seen in use
Logon and privilege-use events show which steps are actually used. 21 steps here have been seen in use, but only 3 people's routes are in use from end to end: svc-sql, c.reyes and e.kowalski, 4 to 5 steps each. Start with those.
3 of 34 routes in use end to end
The question before every fix
“What breaks if I change this?”
Remove the wrong permission and someone can't do their job in the morning, or a service account's 2 AM job fails and takes something down with it. GraphnAI simulates each change first, scores how safe it is, and keeps it reversible.
- Simulate. The change runs as a what-if on your live graph, and your directories stay untouched. You see what loses access and what depended on it.
- Score. The Operational Safety Metric weighs that blast radius with how much the access is used and what depends on it, and gives you a grade you can take to change management.
- Choose. Safe writes the script for you to run. Semi-Auto waits for your click. Full-Auto runs only what has earned it.
- Undo. A password reset can't be undone, so Select Fire never runs one. If a Full-Auto clean-up causes failed logons or failed services on the computers where the access was used, GraphnAI undoes it on its own.
Dashboard, on an example
BUILD-07 holds far more access than computers like it
A build server's account, near the top of the findings.
- Find the cause. BUILD-07 is privileged because a group it belongs to, Build Agents, was added to Domain Admins. Changing BUILD-07 alone would leave that in place.
- The fix. Remove Build Agents from Domain Admins. Two accounts lose privileged access, and two other checks clear with it. Fixing only BUILD-07 is offered too, but the nesting stays, so the problem can come back.
- Decide. Simulate it first, then authorize it at Semi-Auto. The account is Tier 0 and its access hasn't been seen in use, so a person makes the call. Undo is on the History tab. Ready for you to authorize
Identity Inventory, on an example
Reporting Sync holds 51 permissions across 7 services
An app in Entra ID, flagged for its permission load.
- The plan. Select Fire lists every service the app holds permissions on: Microsoft Graph 31, Power BI 9, SharePoint 5 and four more. It recommends removing the Microsoft Graph grants, the largest share, and you pick which go.
- Decide. Simulate it, then authorize it at Semi-Auto. Undo puts the grants back from a copy saved before the change. Ready for you to authorize
Graphne and its crew
An agent that shows its work. A crew that does it.
Ask Graphne about your identities. It reads your graph through a read-only account and shows the query and evidence behind each answer. Changes still go through Select Fire.
Graphne
GraphnAI’s AI assistant. Ask about any identity, path or alert and it brings in the right specialist.
Query
Answers graph questions and finds access paths with read-only queries, and shows you each one.
Analysis
Scores identity risk, and rates how safe a change is with the Operational Safety Metric.
Investigation
Investigates an identity and writes a report with the evidence.
Remediation
Plans the fix in Select Fire and simulates it first. Every change can be undone.
Triage
Checks each alert against the identity behind it and tells you which ones matter.
Monitor
Watches in the background and tells your team when a critical alert fires or your risk score jumps.
Trust
Your identity data stays on your network.
The only thing GraphnAI sends us is a usage report. It holds counts, never content, and every field is documented.
How we protect it- Self-hosted. One bundle on your server, with its own database.
- Outbound only. The Identity Bridge dials out over mutual TLS, so you open no inbound firewall rules.
- Your keys. Secrets are encrypted with keys generated and kept on your server.
- Your choice of model. Graphne uses the model you pick, even one you run yourself, and switches off in one click.
Changelog
Recently shipped.
Full-Auto acts only on evidence for its purpose
Full-Auto removes access only with proof it is unused, and contains an account only for a confirmed compromise. Select Fire and each receipt show the evidence, or why an action stays at Semi-Auto.
Licenses can count enabled user accounts
A license can cap enabled user accounts in Active Directory and Microsoft Entra ID. A user synced between them counts once.
Posture grades match their counts
Each Security Posture category grades all connectors together, so the grade agrees with its counts. A card names the lowest connector, one click away.
Workload identity checks
Security Posture checks service principals, app registrations and service accounts for tenant takeover, credential backdoors, illicit consent and unowned apps, with the fix named.
See your own attack paths this week.
The Public Preview is free for 30 days from your first sync, and it runs on your own server.
- 1Sign up with your work email.
- 2Confirm your email. Nothing ships until you do.
- 3Download the bundle. Your license is already inside.
- 4Start it with
docker compose up.