- Home
- Architecture & Hardening
- Identity & access
Identity is the perimeter now,
so close the paths through it.
Identity architecture and cleanup across Active Directory, cloud directories and SaaS: who has access, why they have it, and whether it is still true. We map the paths an attacker would take to domain compromise and close them in order.
Who can reach what, and should they still?
Attackers rarely break in when they can log in. Every stolen password, forgotten service account and leaver who still has access is a door. Identity and access work is the discipline of knowing every one of those doors, deciding which should exist, and making sure the ones that remain are watched.
We cover the full lifecycle: joiner-mover-leaver processes, MFA coverage, privileged-account control, conditional access, role design and periodic access review. We work across legacy Active Directory, cloud directories and federated SaaS, because most real environments are a mix of all three, and the gaps live where they meet.
- An identity attack-path map: how an attacker gets from one foothold to domain or tenant compromise
- An MFA coverage report, including service accounts, legacy protocols and break-glass accounts
- A privileged-access inventory with a plan to remove standing admin rights
- Conditional access and role design matched to how your people actually work
- A joiner-mover-leaver review, with orphaned and stale accounts listed for removal
- A sequenced remediation roadmap your team can execute, or that we can run with you
Map, prioritise, fix, keep it fixed.
Inventory
We enumerate identities, groups, roles, service accounts and trust relationships across on-prem directories, cloud tenants and federated applications, with read-only access.
Map the attack paths
We trace how privilege can be chained, from a standard user to tier-zero assets, and rank each path by how easily it can be walked.
Close the worst first
Remediation is sequenced so the most dangerous paths go first: privileged group cleanup, legacy authentication retired, MFA gaps closed, delegation reviewed.
Build the controls that stay
Just-in-time admin access, conditional access, role-based design and a periodic access review your auditors will accept.
Hand over
Runbooks and knowledge transfer so your team keeps the environment clean as people join, move and leave.
Four layers of the identity stack.
Directory hardening
Tier-zero identification and isolation, privileged group cleanup, Kerberos and delegation review, local admin password rotation.
Privileged access
Removing standing admin rights, just-in-time and just-enough access, vaulted credentials, session recording and break-glass procedures.
Federation and cloud identity
Cloud directory hardening, SAML and OIDC integration for SaaS, conditional access, phishing-resistant MFA, legacy protocols switched off.
Governance
Joiner-mover-leaver workflows, role design, access certification and evidence for audit.
Who it is for
Organizations that have grown by acquisition and inherited several directories, and anyone whose leavers still have accounts. Also teams preparing for an audit that will ask who has privileged access and why.
- Zero trust, identity is the control point of the whole programme
- Microsoft security assessment, a full review of your Microsoft tenant
- vCISO, someone to own the roadmap after we hand over
- Penetration testing, prove the paths are closed
What buyers ask.
We have MFA on.
On everything? Including service accounts, legacy protocols, admin consoles and break-glass accounts? Those gaps are where attackers live, and they rarely show up on the MFA dashboard.
We already bought a privileged access tool.
Good. The tool is rarely the problem; coverage is. We check which accounts are actually vaulted, which still hold standing rights, and close the difference.
Will cleanup break things?
Not if it is sequenced. We map dependencies before any account or group is changed, stage changes in monitor mode where possible, and agree a rollback for every step.
Do you only work with one identity vendor?
No. We are vendor-agnostic and work across on-prem directories, cloud directories and federated SaaS. We recommend new tools only when what you own cannot do the job.
Find the paths before an attacker walks them.
Put an engineer on a call to scope an identity review for your environment. No charge, no commitment.