Built to make identity risk easier to see

For most of my career in identity and security, I kept seeing the same pattern. Organisations believed they understood their identity environment because they had a few tools in place and a passing audit history. The problem showed up when someone asked the harder questions and no one could answer them quickly.

• Who still has access that should have been removed?
• Which accounts can reach something sensitive if misused?
• What changed since the last review?
• Can we show the evidence in a way that makes sense to the board?

The AD health check problem

Active Directory assessments are useful, but they only inspect one part of a much larger identity estate. Modern organisations operate across many systems at once. Looking only at AD is like inspecting the front door while ignoring every other entrance.

What the industry taught me

The identity security community has produced excellent specialist tools. They exposed hidden escalation paths, legacy misconfigurations, and weak identity resilience under attack conditions. They showed what becomes possible when identity relationships are mapped properly.

The shift from configuration to exposure

The real challenge is now relationships, context, and exposure: how permissions spread, how access paths form, and how one compromised account can become a much bigger problem.

The vision behind IdentityFirst

I created IdentityFirst to close that visibility gap. The goal was not another single-purpose checker, but a clearer way to understand identity behaviour across the connected identity systems in scope and answer practical risk questions:

• Where do the biggest access risks sit?
• Which accounts could cause the most harm if misused?
• How is access changing over time?
• Do policy decisions match real permissions?

Why this matters now

Most modern breaches begin with a misused account rather than a dramatic exploit. If you cannot see how access is spread across systems, you cannot explain the risk or the likely impact with confidence.

IdentityFirst exists because teams were still being asked to make important decisions with too little clarity. This is our attempt to make that easier.