Standard tools stop at hop 5.
The breach is at hop 14.
Every identity graph tool claims to trace access chains. Most return the first 5–10 hops and mark the path as reviewed. IdentityFirst follows the full chain — and finds what they miss.
Why 5–10 hops is not enough
Modern identity estates have deeply nested groups, cross-cloud federation chains, and non-human identities that carry credentials into multiple clouds. The critical risk is never in the first few hops.
The 5-hop blind spot
A developer in Dev-Contractors → UK-Technology-Staff → EMEA-Technology → Global-Infrastructure-Access looks routine at hop 5. Standard tools stop here. IdentityFirst continues four more hops to find Domain Admins → DCSync → all 4,821 credential hashes.
Cross-cloud pivots are invisible
A CI pipeline with S3 access looks fine. But that S3 bucket contains a Terraform state file with an Azure service principal secret embedded in plaintext — 847 days old, never rotated. Six hops later: 2.1 million customer records.
Orphaned apps have no owner to revoke
An Entra application registration whose owner departed 6 months ago.
The app holds application-level Microsoft Graph permissions
— User.ReadWrite.All, Group.ReadWrite.All,
Mail.ReadWrite — with no MFA checkpoint.
No one is responsible. The secret is 847 days old.
NHI chains span three clouds
A Kubernetes service account reaches an Azure Key Vault — expected. What standard tools miss: that vault contains an AWS access key (1,247 days old) and a GCP service account JSON key. Two independent paths to PCI-scoped payment data, both invisible beyond hop 5.
Four scenarios. Same pattern. Different stack.
Each scenario starts with a path that appears safe at 5 hops. The red line shows where standard tools stop. Everything below it is what IdentityFirst finds.
Shadow Admin
Impact: Complete domain compromise — attacker can harvest every credential hash via DCSync.
Cross-Cloud Pivot
Impact: Production database with 2.1M customer records reachable via a credential embedded in Terraform state.
Orphaned Application
Impact: No MFA checkpoint, no current owner. App can modify any user, control group membership, read all executive email.
NHI Daisy Chain
Impact: Two independent paths to PCI-scoped payment data from a single K8s service account. Both invisible at hop 5.
How IdentityFirst traces the full chain
Three architectural choices that make depth possible.
Canonical identity graph
A single graph model normalises identities from 40+ sources into one traversable structure. Nested group depth, federation chains, and cross-cloud credential links are all first-class edges — not separate reports.
14 node types, 17 edge types
Credential, Token, Session, Device, and Network are first-class nodes with time-bound attributes (issuedAt, expiresAt, mfaSatisfied). Policies are nodes with explicit EVALUATES and RESTRICTS edges. Nothing is embedded in text.
Unbounded traversal with cycle detection
IdentityFirst traverses the full access chain from any identity — no artificial hop limit. Cycle detection prevents infinite loops while allowing the engine to surface paths that are 14+ hops deep.
See what your tools are missing
Book a live assessment against your estate. We trace every chain.