Read-only first
Start by checking existing systems without changing production. That makes the first step easier to approve and easier to explain internally.
Identity attack surface intelligence
See how your organisation gets breached before attackers do.
IdentityFirstMRI maps every identity, relationship, and path to privilege across hybrid estates, then shows the blast radius, business impact, and first fix.
Start with a read-only assessment. See the shortest route to privileged impact, understand why it exists, and turn the same evidence into board, SOC, IAM, and audit-ready decisions.
Read-only start
Attack-path visibility
Board and operator views from one evidence set
Choose the angle that matches your role. The page will keep the same story, but bring forward the problems and outcomes most relevant to you.
Choose the view that fits you best
The story stays the same. The emphasis changes to match what matters most in your role.
Overview
Start with the big picture first
Overview
I lead security
Focus on exposure, resilience, and board confidence
Security
I run identity and access
Focus on review effort, stale access, and control
Identity
I oversee finance or risk
Focus on governance, prioritisation, and value
Risk
I handle compliance
Focus on evidence, assurance, and audit readiness
Assurance
I run an MSP
Focus on service creation, proof, and recurring revenue
MSP
Why teams start here
The first value is clarity, not disruption.
Most organisations do not need another tool telling them there may be a problem. They need a clearer answer on where access has built up, what matters first, and how to show improvement afterwards.
Usable findings
Turn access sprawl, risky exposure, and control gaps into something operators, boards, auditors, and clients can actually understand.
Credible next step
Start with assessment, then move into ongoing review and governance if the organisation or MSP wants a repeatable service around it.
Identity intelligence
The same identity reality should mean something different to each stakeholder.
Most products give one score, one explanation, and one generic recommendation. IdentityFirst keeps the underlying facts the same, then translates them for the person who actually has to act on them.
Explain identity risk
Show the board the strategic risk posture, show the SOC the active threat surface, and show IAM where drift and lifecycle hygiene are breaking down.
Translate complexity
Turn accumulated access, hidden privilege, and cross-system exposure into evidence, context, and recommended action instead of another dense technical screen.
Keep one truth underneath
The same estate, findings, and evidence can support executives, auditors, app owners, and finance stakeholders without inventing a different story for each of them.
Built for the people who own identity risk
Whether you’re briefing the board, responding to an incident, building an audit pack, or managing a client portfolio — IdentityFirst turns the same evidence into predictive, decision-ready reporting for each audience.
For CISOs
Board-ready risk picture
Turn identity sprawl into posture trend, likely next impact, confidence-backed decision framing, and a roadmap your board can actually fund.
CISO use cases →For SOC Teams
Triage faster with context
Move from alert detail to threat narrative: likely time-to-impact, AI confidence, attack-path realism, and when automation beats manual response.
SOC use cases →For GRC & Compliance
Control-reference reporting
Prioritise controls by risk, see likely time-to-compliance, and measure audit readiness from the same identity evidence instead of reworking it by hand.
GRC use cases →For MSPs
Multi-tenant at scale
Run assessments across your client portfolio with tenant-isolated reporting that feels personalised to the role, estate, and commercial moment in front of you.
MSP use cases →Report evolution
Reports that move from static findings to decision support.
The same evidence can now be layered into different report stories: trend and prediction, what to do next, business impact, guided narrative flow, and role-aware context.
Static to dynamic
Trend, movement, and likely next-state instead of one frozen score.
Descriptive to prescriptive
What to do next, why now, and where the first visible value appears.
Risk to decision impact
Operational, audit, and financial consequence tied back to the same identity evidence.
Data to story
Guided narrative flow from threat path to action, not a disconnected findings dump.
Generic to personalised
Different framing for boards, SOC, IAM, GRC, and service-provider delivery teams.
What this means for finance or risk leader
Translate technical sprawl into clearer exposure, better reporting, and a more defensible conversation about risk and investment.
Frame exposure in a more usable business context
Support investment decisions with better evidence
Track whether control is actually improving
Why identity first
The operating problem is rarely one alert. It is accumulated access.
Hybrid estates, SaaS growth, third-party access, leavers, dormant accounts, and privileged drift create slow-moving exposure that traditional tooling often reports too late or too noisily.
Most organisations do not have one clean identity boundary. They have several source systems, multiple admin surfaces, third-party applications, and years of inherited access decisions. The job is not to generate more noise. It is to turn that sprawl into a clearer answer.
- Bring disconnected identity sources into one view of access.
- Highlight the exposures that accumulate quietly between systems.
- Give operators and boards a more usable explanation of what matters first.
Stale access
Ex-employees, dormant accounts, inherited group membership, and guest identities linger long after their business need has gone.
Hybrid drift
AD, Entra ID, M365, remote access, and line-of-business systems rarely move in lockstep. Risk hides in the gaps between them.
Application sprawl
OAuth grants, service principals, shared mailboxes, and third-party SaaS create access paths that are hard to explain to a board and harder to govern at scale.
Evidence gap
Security teams may suspect the issue. Boards, auditors, insurers, and managed service providers still need evidence, prioritisation, and a credible operating story.
Product progression
Four products. One progression.
Most buyers want to start with proof, then move into regular review and better control. The product range follows that same path.
Available now
IdentityFirst MRI
A read-only access review that shows what looks risky and gives you a report you can use.
Best for getting a clear first picture without making changes to the customer environment.
View MRI
Next step
IdentityFirst Core
The ongoing review layer for organisations that want regular visibility, reporting, and governance.
Best for turning a one-off assessment into a repeatable operating rhythm.
View Core
Private beta
IdentityFirst Enhanced
Extra help for teams that want deeper analysis, clearer write-ups, and more guided decisions.
Best for more mature teams that need more than baseline monitoring.
View Enhanced
Private beta
IdentityFirst AISF
The longer-term orchestration layer for organisations that want tighter, more governed automation.
Best understood as an advanced future-facing layer, not the place most customers start.
View AISFGet Personalized Recommendation
Not sure where to start? We'll help you choose.
Answer a few quick questions to get a tailored product recommendation based on your role and goals.
Recommended Starting Point
Alternative Starting Point
IdentityFirst Core
If you need ongoing risk metrics, start with governance reporting
Learn MoreShared substrate
One website, one working product, and one shared foundation underneath.
Public and demo
The public website and demo layer explain the company, show representative workflows, and carry commercial and trust messaging.
Authenticated portal
The authenticated portal is the operator and customer experience for runs, reports, governance, posture, and presentation views.
Control plane
The control plane handles runtime authority, licensing, orchestration, approvals, and connector execution boundaries.
Substantia
Identity truth, graph, intelligence, evidence, and execution contracts. The reason the stack is more than disconnected dashboards.
Buyer fit
Built for commercial clarity as well as technical depth.
Boards and executives
A clearer line from identity exposure to governance, resilience, audit evidence, and measurable improvement over time.
MSPs and service providers
A credible entry service in MRI, then a path into recurring monitoring, client reporting, remediation governance, and account expansion.
Security and IAM teams
Evidence-backed visibility, less guesswork, better prioritisation, and a more defensible operating model for hybrid identity estates.
Start where the evidence is strongest
Most customers do not buy platform first. They buy proof.
That is why IdentityFirst MRI leads with attack paths, blast radius, and first actions. It proves exposure quickly, then gives the buyer a credible path into continuous identity governance.