Least privilege, with the evidence to show for it.

The audit cycle

Where privileged access drifts.

1. 01Privileged access

   Admin rights hide in nested groups.

   The privileged access list you review covers Domain Admins and a few named groups. The account that matters is often three nested groups away, or a service account nobody counts as an admin.

   What GraphnAI does

   The Asset Criticality Engine rates every identity after each sync. It finds Tier 0 on its own, and the accounts that reach it through up to ten hops of nested groups.

   Account security checks flag privileged accounts with a password that never expires, a service principal name, a mailbox or no recent logon.

   • Asset criticality guide
   • Account security checks guide

   See what's real

2. 02Separation of duties

   People change roles. Their access stays.

   A trader moves to operations and keeps the trading groups. A help desk group picks up rights over an OU of privileged accounts. Each grant made sense once. The conflict only shows when you see them together.

   What GraphnAI does

   Over-permission analytics compares each identity with peers in the same domain, department and title, counting what it inherits through nested groups. It finds the people who kept access through several role changes.

   Delegation Risk checks every OU and container with custom delegations. It flags trustees on a lower plane that hold rights over a higher one.

   • Over-permission analytics guide
   • Delegation Risk guide

   See what's real

3. 03Repeat findings

   The same finding comes back every quarter.

   Findings stay open because nobody can say what the fix would break. When one does get fixed, the evidence is spread across a ticket, a script and someone’s memory.

   What GraphnAI does

   Select Fire simulates the fix on your live graph, scores how safe it is, and runs only changes GraphnAI can reverse.

   The remediation history records who authorized each change, the mode, and the state before and after, read back from the directory. Each entry is sealed and kept for two years.

   • Select Fire guide
   • Remediation history guide
   • Undo guide

   Fix it safely

4. 04Inherited directories

   Every acquisition added a forest.

   Mergers leave trusts, delegations and service accounts the acquiring bank never mapped. A forest trust relaxed for an old migration can still let SID history across.

   What GraphnAI does

   GraphnAI reads every trust on every sync. It flags a cross-forest trust only when its SID filtering is weak, such as a forest trust with SID history allowed.

   Boundary Escape lists the identities that can reach into another forest or your Entra ID tenant. One Identity Bridge can sync several forests.

   • Domain and forest trusts guide
   • Boundary Escape guide
   • Identity Bridge guide

   See what's realIntegrations

Every change leaves a record.

When an examiner asks how a finding was closed, the answer is one link. Each entry in the remediation history has an address you can paste into a ticket or an incident report.

Before it runs

The blast radius, an Operational Safety Metric score from 0 to 100, and the mode it recommends. The same inputs always give the same score.

Who allowed it

The person who authorized it, or the policy that let Full-Auto run it. An Operator can run only fixes built from a Critical or High finding plan.

What changed

The state before and after, read back from the directory, step by step. For 14 days, each sync checks the object, and a change made outside GraphnAI shows on the entry.

How long it’s kept

Entries are sealed, so an edit shows, and kept for two years. Full-Auto actions, and what you did with each Graphne recommendation, stay in the governance audit for seven years.

Fix it safelyRemediation historyAI evidence trail