Identity Discovery

Identity discovery is the process of finding every identity across your environment, including employees, contractors, service accounts, API keys, and AI agents, and mapping what each one can access. It is the foundation for governance and security, since you can’t protect identities you don’t know exist.

These are accounts created outside central identity processes, such as local app accounts, SaaS sign-ups that bypass SSO, forgotten test accounts, agents spun up by individual teams, or shadow AI tools adopted without IT approval. They often lack ownership, MFA, and oversight, making them attractive targets for attackers.

Knowing an identity exists isn’t enough; you need to understand its effective access. Permission mapping reveals direct, inherited, and group-based entitlements across systems, exposing hidden privilege paths that could let an attacker move from a low-risk account to critical resources.

Effective discovery connects to identity providers, cloud platforms, SaaS applications, and directories through APIs, then correlates accounts belonging to the same person or workload. Continuous scanning matters because new accounts, keys, and agents appear constantly.

Common findings include orphaned accounts from former employees, dormant admin accounts, stale API keys, over-permissioned service accounts, local accounts bypassing SSO, AI agents with broad access and no clear owner, and shadow or unapproved AI tools adopted outside IT’s oversight. These unidentified and unmanaged identities increase the attack surface because they are the very gaps attackers target, especially given that credential compromise is the leading cause of breaches.