Works with the tools you already use

Read-only audit, login, and Gmail signals. Flags dormant accounts, missing MFA and risky OAuth grants.

Entra ID, Exchange and SharePoint signals with out-of-the-box detection for token theft and impossible travel.

Alert delivery into a private channel plus detection on external-user invites and risky app installs.

Org-level audit log monitoring: secret scanning, collaborator changes, Actions misconfiguration.

CloudTrail and IAM monitoring. Public-bucket detection, risky role assumptions, unusual region activity.

DNS record changes, WAF events and certificate expiry tracking.

Webhook-backed detection for account-takeover patterns and unusual payout routes.

Admin access, payment runs and invoice anomalies — surfaced in plain English.

Device compliance and patch-status signals mapped to Cyber Essentials requirements.

Push events and alerts into your own tooling via our public API (Pro plan).