ContactBook a demo

Discovery & inventory

Find every identity.Keep finding it.

Connectors read identities, credentials and bindings from AWS, GitHub, Kubernetes and HashiCorp Vault — on a schedule or on request — and normalize them into one inventory, so the first question in any incident, what is this and who owns it, already has an answer.

AvailableIdentity Governance · M2

Book a demoView integrations

Read-only connectors · scheduled or on-request sync · evidence on every record

The problem

You cannot govern what you have not found.

Machine identities are created by pipelines, consoles, SDKs and now agents — faster than any spreadsheet, quarterly review or single console can track.

Sprawl by design

Every new service, pipeline and integration mints identities that nobody registers

Shadow integrations

OAuth consents and connected apps appear without a ticket and outlive the project that needed them

Fragmented views

Each cloud, identity provider and SaaS tool lists its own principals in its own vocabulary

How it works

Connect. Sync. Normalize. Evidence.

One connector contract for every source, so a new system adds records to the same inventory instead of a new dashboard to the pile.

  1. Connect

    A read-only connector is scoped to an AWS account, GitHub organization, Kubernetes cluster or Vault — least privilege, nothing to install

  2. Sync

    Each sync reads identities, credentials and bindings and records what appeared, changed or disappeared since the last one

  3. Normalize

    Source-specific principals are mapped onto one schema: type, lifecycle, owner, credentials, bindings

  4. Evidence

    Every record keeps its source system, snapshot time and raw attributes, so any record can be audited

View all integrations

What you get

A normalized inventory you can actually query.

Not a list of principals per console: one record per identity, with its type, environment, owner, credentials and the evidence behind each field.

Identity types

Type every principal from what its provider reports: IAM roles and machine users, service accounts, GitHub Apps and bots, Vault AppRoles and entities

Normalized records

Compare an IAM role, a Kubernetes service account and a GitHub App on the same fields

Search and filter

Search by name or provider id; filter by type, lifecycle, provider, ownership confidence and presence

Evidence per record

Open any identity and see the source snapshot, timestamps and raw attributes behind it

Change tracking

See what was created, modified or removed between syncs — and by which sync

Coverage reporting

Know which accounts, organizations and clusters are connected, and when each last synced

Example

From a list of principals to an inventory with answers.

Illustrative sample environment: the classified inventory on the left, and the evidence behind a single record on the right.

Identity inventory

12,424 non-human identities · 118 humans own 92%

  • Service account4,812
  • IAM role3,107
  • Machine user1,940
  • Workload1,286
  • GitHub App904
  • Bot311
  • Vault AppRole64

Illustrative · sample environment · agents are not discovered

svc-warehouse-load

Identity record · synced 2026-08-20 02:10 UTC

Service
Class
Service identityAWS IAM role
Scope
AWS account prod-dataconnector aws-prod-data
Lifecycle
Activepresent in the last complete sync
Reach
High-impact resourcesresource impact set by an operator
Owner
Data servicesfrom Owner tag · declared
Trust
Assumable by 1 principaltrust policy · account prod-data
Last used
2026-08-20 01:58 UTCreported by AWS for this role
Tags
billing · pii · tier-1

Evidence: IAM snapshot · sync run · owner tag

Illustrative · sample environment

NHI Security

Continue through the pillar

Discovery is the first step. Ownership, risk, effective access, blast radius and governance build on the same inventory.

See the inventory a connector builds.

A demo walks through a connector's normalized inventory on the demonstration estate, the evidence behind a record and what changed between syncs.

Book a demo