Obsidian Security Platform

Compares each connected SaaS tenant's security settings against vendor best practices and the customer's own baselines, reports misconfigurations and drift, and explains the fix, with the depth of checks and advice varying by application. Coverage of enterprise SaaS applications through native admin APIs, including smaller business-critical apps, also varies by vendor.

Maps SaaS configuration findings to CIS SaaS Benchmarks, CISA SCuBA secure configuration baselines, NIST 800-53, ISO 27001 and SOC 2 control requirements, and generates auditor-ready evidence from automated checks rather than manual screenshots, so that SaaS posture can be validated against published standards as they emerge.

Discovers the third-party applications, marketplace plug-ins and add-ons, and AI agents connected to core SaaS environments through OAuth grants, API tokens or MCP, maps the permissions each has been granted, and flags high-risk, over-scoped or unused connections for revocation, so that user-installed integrations do not become an unmanaged path to tenant data.

Analyzes identity telemetry (authentication events, access patterns, privilege use) in real time with behavioral baselines and risk scoring; leading implementations detect identity attacks in sub-second time.

Detects credential-abuse techniques that defeat authentication controls, including MFA circumvention, session hijacking, and forged or replayed tokens.

Detects attacks on the IAM infrastructure itself: misuse of directory and identity provider administrator credentials, changes to token-signing certificates and federation trust, tampering with conditional access, MFA, and admin role configuration, and other signs that an identity tool has been compromised, continuously monitoring root and global administrator accounts and their configuration changes.

Discovers service accounts, OAuth apps, API keys, JWT tokens, and Kubernetes service accounts alongside human accounts, mapping the complete identity population.

Flags identity-object hygiene problems: dormant and orphaned accounts, accounts without MFA enrolled, shared or generic accounts, weak or non-expiring passwords, and risky discretionary permissions, so they are cleaned up before attackers use them. Configuration of the identity providers and access policies themselves is covered by IAM Policy and Configuration Assessment.

Discovers the AI models, agents, MCP servers and AI-enabled applications in use across the organization, including those deployed without IT authorization, and keeps them in an inventory that records type, ownership and criticality. Discovery runs through traffic inspection and code repository scanning at minimum; some products add cloud provider, application server or AI engineering tool integrations. The inventory anchors exposure management and risk scoring.

Assesses the identities and service accounts that AI models, pipelines, and agents use, flagging over-permissioned non-human identities and access paths that violate least privilege. Reports identity risk as a posture finding, distinct from enforcing access policies at the model API at runtime.

Assesses and scores the risk of discovered AI services and embedded AI features (data handling, training-use terms, hosting, vendor posture) to drive sanction/block decisions.