Inventory
31 assets across 5 sites · 3 NHIs
All (31)
Network (12)
Servers (8)
Identity (5)
NHIs (3)
Crown jewels (4)
Saved view: My queue ▾
●
dc-01.acme.local
microsoft · server · prod · DC1 · owner: ivan.devops
crown-jewel
grade C · 0 KEV
●
crm-prod-01.acme.local
cisco · network · prod · DC1
●
nhi-build-bot
okta · service_account · owner: ivan.devops · 2 years old
never rotated
last used today
●
veeam-prod-01
veeam · backup · prod · DC1
healthy
grade B · 14d immutable
Findings
7 open · 4 critical · 2 high
All (7)
Critical (4)
High (2)
Assigned to me (3)
Saved view: My queue ▾
CRIT
Orphan service account: nhi-legacy-importer
Owner henry.former departed · provider: AD · created 3 years ago
auto-fix available
HIGH
NHI never rotated: nhi-build-bot
2 years since rotation · service_account · client_secret
auto-fix available
HIGH
Tenant has users without MFA: ad-acme-local
13 users in Domain Admins, none enrolled · provider: AD
requires review
MED
Over-privileged: alice.admin@acme.local
In 6 groups (threshold 5) — Domain Admins, Helpdesk, Engineering, …
manual review
Identity translator
Plain-English → unified policy → applied across 5 IdPs
1. Translate
2. Preview
3. Apply
Per-system change preview
🔐
Okta — group rule: sc-deny-contractors-no-mfa
moves matched users to SafeCadence-Quarantine · 1 op
ready
🌐
Cisco ISE — authz rule
profile=DenyAccess · scoped to Contractors group
ready
🪟
Active Directory — group membership change
add to SafeCadence-Quarantined · 13 principals affected
ready
☁️
Entra ID — Conditional Access policy
block grant control · enabled state
ready
🛜
ClearPass — enforcement profile + policy
RADIUS:Reject · scoped role
ready