Explore thirteen operational domains without turning them into thirteen disconnected products. Each pack connects outcomes to evidence, specialist roles, workflow and provider-neutral integration needs.
Three practical scopes
Start with the service boundary that matches the decision you need to improve. Domains can be narrowed after scope and evidence are understood.
Technology, IAM and cloud platform leaders
Reduce privilege, cloud-control and mobile-access risk with evidence that survives audit and incident response.
Identity Security and PAM · Cloud and Kubernetes Security · Mobile Device and Application Security
Discuss this scopeEngineering, product, privacy and data leaders
Connect secure delivery, exposure, data protection and cryptographic change to accountable release decisions.
Application and API Security · Data Security and Privacy Operations · Vulnerability and Exposure Management · Cryptographic Agility and Post-Quantum Readiness
Discuss this scopeSecurity operations, risk and critical-service leaders
Prepare evidence, command paths and recoverable operating controls for incidents, suppliers and regulated services.
Digital Forensics and Malware Analysis · OT, ICS and IoT Security · Human Risk and Insider Threat · Cyber Resilience and Disaster Recovery · Threat Intelligence and External Attack Surface · NZ and Australian Compliance Operations
Discuss this scopeidentity-pam · v1.0.0
Govern human and machine identities across their lifecycle and constrain privileged access.
Joiner, mover and leaver events reconcile against active accounts and access within approved timeframes.
Evidence: authoritative roster reconciliation; termination sample; exception register
Verify: Independently sample lifecycle events and confirm access removal and exception approval.
Privileged access is vaulted or just-in-time, individually attributable and independently reviewed.
Evidence: privileged account inventory; PAM session records; break-glass test
Verify: Confirm sampled privileged sessions have approval, attribution and expiry.
Business owners periodically certify sensitive roles, groups, applications and service identities.
Evidence: certification campaign; owner decisions; revocation evidence
Verify: Reconcile approved decisions to current entitlements.
Risky sign-ins, token theft, MFA abuse and privilege changes produce owned investigations and reversible response.
Evidence: identity detection coverage; triage record; session revocation test
Verify: Run a benign identity scenario and verify alert, scope, approval and post-action state.
Reconcile identities, entitlements, owners and lifecycle state.
IAM engineer · identity reconciliation
Prioritise orphaned, dormant and excessive privilege.
identity security analyst · identity risk register
Approve and execute the smallest reversible access change.
access owner · approval and execution receipt · approval required
Verify effective access and close or escalate residual risk.
independent reviewer · post-change verification
These are integration contracts, not claims of a live vendor connection. Customer qualification must prove credentials, tenancy, rate limits, failure states and approval before use.
| Contract | Matching capability | Status |
|---|---|---|
| Microsoft Entra ID | identity.directory.read, identity.signin.read, identity.entitlement.read, identity.session.revoke | Contract defined |
| Okta | identity.directory.read, identity.signin.read, identity.session.revoke | Contract defined |
| PAM Adapter | pam.audit.read, identity.entitlement.read | Contract defined |