← Exposure ManagementAvailableISPM · Built on Skyreach Orion

See what every human and workload identity can reach—and how privilege can grow.

ISPM connects users, groups, guests, service accounts, workload identities and application credentials to the resources they can access. Orion resolves direct and transitive permissions so identity risk is assessed by effective reach, not role names alone.

Discuss your environmentSee what it reveals
Evidence in

What Orion connects

The exact coverage depends on the integrations and authorised evidence available in your environment. Every record retains where it came from.

Example sources

  • Microsoft Entra ID and cloud RBAC
  • AWS IAM users, roles and policies
  • Google Cloud IAM
  • Kubernetes service accounts and RBAC
  • Application registrations and OAuth permissions
  • Supported developer and identity platforms

What the ontology models

  • Human, machine and workload identities
  • Groups, roles and memberships
  • Credentials, certificates and secret metadata
  • Direct, inherited and transitive permissions
  • Federation and trust relationships
  • Resources and data reachable by each identity
Intelligence out

What visibility and insight you gain

The module uses the shared Orion model, so its findings can be understood through evidence collected by other security disciplines.

Privilege inventory

Find standing administration, broad roles, wildcard access and identities able to change security controls.

Authentication posture

Assess MFA, credential age, expiry and other available authentication evidence.

Effective access

Trace group membership, role assumption and workload identity chains to what an identity can actually do.

Blast radius

Show the infrastructure, applications and data exposed if a particular identity is compromised.

Connected analysis

An example of the exposure Orion can reveal

This is an illustrative relationship chain, not a claim that every path represents a confirmed compromise. Orion preserves evidence and confidence so teams can validate what is effective.

Compromised userTransitive groupPrivileged roleProduction resource
Risks made visible

What the module is looking for

  • Dormant or external identities retaining active access
  • Permanent privileged assignments and excessive permissions
  • Long-lived credentials and poorly governed non-human identities
  • OAuth applications with broad delegated or application permissions
  • Cross-account, cross-tenant and federated trust paths
  • Identity escalation paths to critical systems
Questions it helps answer

Move from findings to decisions

  • Who can become an administrator, directly or indirectly?
  • Which service identities can modify production?
  • What could this compromised account reach?
  • Which privileged identities lack strong authentication evidence?
Why Orion matters

This discipline does not operate in isolation

Identity Security Posture Management contributes its evidence to the same ontology used by the rest of Exposure Management. That allows a finding to inherit network reachability, identity privilege, data sensitivity, software, application and business context where those facts exist.

See the complete Exposure Management product
ISPM evidence+Shared ontology+Cross-domain context=Prioritised exposure

See what this means in your environment

Tell us which sources you use and the questions your teams struggle to answer today.

Talk to SkyReach