There’s nothing to onboard
Identities aren’t a target you add — they’re discovered from the accounts you’ve already connected. Once you’ve connected a cloud account or a GitHub account, BreachLens can enumerate their identities using the same read-only credentials. No new keys, no separate connector. Providers discovered today:AWS discovery needs IAM read access (
iam:ListUsers, ListRoles, ListAccessKeys, GetAccessKeyLastUsed, and the tag/list calls) — all covered by the SecurityAudit policy you attached when connecting the cloud account. No extra grant.Run discovery
Open Identities and click Refresh to sweep every connected account in parallel. BreachLens builds (or updates) the identity inventory, correlates each identity’s findings, and computes hygiene issues.1
Connect an account first
Discovery has nothing to enumerate until at least one cloud or GitHub account is connected.
2
Refresh
From Identities, run Refresh. Re-run it whenever you want a fresh inventory — it’s how you catch a newly-created role or a key that just went stale.
3
Triage the risky ones
Filter to over-permissioned, stale-credential, or unowned identities. Open one to see its access, the findings attached to it, and — where available — who owns it.
Fix
Each identity carries concrete recommended actions (revoke an unused key, scope down a role). For an eligible finding, Remediate generates an AI-drafted remediation you can review before applying it on your side.Next steps
Connect a cloud account
The source identities are discovered from — connect AWS / Azure / GCP read-only.
Continuous monitoring
How identity findings feed the always-on correlation graph and chain into cross-tier attack paths.