All features

Everything you need
to reduce identity exposure

Saporo combines deep identity analysis with practical remediation and automation,
so teams spend less time investigating exposures and more time eliminating them.

Explore Saporo's capabilities

Saporo brings together everything needed to continuously reduce identity exposure: enterprise-scale graph analytics that reveal attack opportunities, guided remediation and automation that eliminate them, and dashboards that prove progress, across your entire hybrid identity environment.

Upload files effortlessly with our intuitive drag-and-drop interface, streamlining your workflow.

Graph engine & analysis

Build a unified identity graph that reveals attack opportunities and attacker movement.

Exposure management

Discover, prioritize, validate, and continuously reduce identity exposure.

Guided remediation

Resolve the highest-impact exposures with guided and automated workflows.

Automation & integrations

Orchestrate remediation across identity, cloud, ITSM, and security tools with 1,900+ integrations.

Dashboards & reporting

Measure exposure, track security improvements, and demonstrate business outcomes.

Enterprise platform

Deploy anywhere, scale to millions of identities, and support hybrid enterprise environments.

Graph engine & analysis

At the core of Saporo is an enterprise-scale graph engine that continuously connects identities, permissions, relationships, activity, and misconfigurations into a unified model of attack opportunities.

See your identity environment as one connected graph

Saporo unifies fragmented identity data into a continuously updated graph of identities, permissions, relationships, activity, and misconfigurations. See how your environment is connected, uncover attack opportunities, and identify where remediation will have the greatest impact.

Hybrid identity graph

Continuously connect identities and relationships across Active Directory, ADCS, SMB Shares, local accounts, Entra ID, Azure, Microsoft 365, Google Workspace, GCP, AWS, and more in one unified model.

Attack opportunity analysis

Reveal how identities, permissions, relationships, activity, and misconfigurations combine into real attack opportunities, exposing attacker movement before it becomes an attack.

Chokepoint identification

Identify the identities, permissions, and relationships that sit at the center of millions of attack opportunities. Fixing a single chokepoint can eliminate entire classes of attack paths.

Chokepoint identification

Identify the identities, permissions, and relationships that sit at the center of millions of attack opportunities. Fixing a single chokepoint can eliminate entire classes of attack paths.

Chokepoint identification

Identify the identities, permissions, and relationships that sit at the center of millions of attack opportunities. Fixing a single chokepoint can eliminate entire classes of attack paths.

Common impact scoring

Every exposure is analyzed using a consistent scoring model based on reachability, propagation, and impact, enabling accurate prioritization across the entire environment.

Common impact scoring

Every exposure is analyzed using a consistent scoring model based on reachability, propagation, and impact, enabling accurate prioritization across the entire environment.

By transforming fragmented identity data into attack opportunities, Saporo helps security teams understand real exposure, prioritize the remediation that matters most, and continuously reduce identity risk before attackers can exploit it.

Hybrid identity coverage

Saporo provides comprehensive coverage across the identity systems that matter most. By connecting on-prem, cloud, SaaS, and companion identity platforms into a single graph, it reveals attack opportunities that span traditional security boundaries.

See identity exposure across hybrid environment

Identity spans legacy Active Directory, cloud directories, SaaS platforms, and cloud infrastructure. Saporo brings these sources into one connected view, helping uncover relationships, misconfigurations, and attack opportunities that cross technology silos.

Active Directory, ADCS, SMB Shares and Local windows machines

Full coverage of Active Directory, ADCS, SMB Shares, and local Windows accounts, including trusts, ACLs, delegation, GPOs, certificates, privileged identities, and lateral movement opportunities. Reveal excessive permissions, weak configurations, and attack opportunities across your on-premises identity infrastructure.

Active Directory, ADCS, SMB Shares and Local windows machines

Azure, Entra ID and M365

Analyze Entra ID, Azure, and Microsoft 365 identities, roles, applications, permissions, and conditional access policies. Detect excessive privileges, risky app consents, legacy authentication, workload identities, and tenant-wide attack opportunities while continuously assessing Microsoft security best practices.

Google Workspace and GCP

Unify Google Workspace and Google Cloud into a single identity graph that connects users, groups, admin roles, IAM permissions, service accounts, devices, storage, and cloud resources. Reveal cross-domain attack opportunities, privilege escalation paths, and overprivileged service accounts that span both control planes, while continuously assessing Google security best practices.

Extended identity ecosystem

Extend visibility beyond core identity platforms with Okta, AWS IAM, and other enterprise identity sources. Connect identities across environments into a single attack graph to eliminate blind spots. Coverage continues to expand with additional SaaS, cloud, and AI platforms.

Extended identity ecosystem

Saporo unifies identity exposure across on-premises, cloud, and SaaS environments, eliminating the blind spots attackers exploit. By connecting every identity system into a single graph, it provides a complete view of identity exposure and one place to continuously reduce it.

Misconfiguration & risk

Continuously discover identity exposures across hybrid environments. From misconfigurations and excessive permissions to risky identities and policy violations, Saporo reveals the weaknesses attackers can exploit.

From noise to clear priorities

Modern environments generate thousands of identity exposures. Saporo analyzes each one in context, connecting identities, permissions, relationships, and policies to prioritize the weaknesses that create real attack opportunities.

1,000+ security controls

Continuously assess identity security using more than 1,000 built-in controls aligned with ANSSI, MITRE ATT&CK, Microsoft, CIS, ISO, and other industry best practices.

1,000+ security controls

Continuously assess identity security using more than 1,000 built-in controls aligned with ANSSI, MITRE ATT&CK, Microsoft, CIS, ISO, and other industry best practices.

1,000+ security controls

Continuously assess identity security using more than 1,000 built-in controls aligned with ANSSI, MITRE ATT&CK, Microsoft, CIS, ISO, and other industry best practices.

Identity exposure discovery

Detect excessive permissions, dormant privileged accounts, stale identities, risky delegations, and other exposures that increase your attack surface.

Identity exposure discovery

Detect excessive permissions, dormant privileged accounts, stale identities, risky delegations, and other exposures that increase your attack surface.

Identity exposure discovery

Detect excessive permissions, dormant privileged accounts, stale identities, risky delegations, and other exposures that increase your attack surface.

Tiering exposures

Identify violations of Microsoft's Tier Model and privileged access boundaries that enable attackers to move from lower-trust accounts to critical infrastructure.

Tiering exposures

Identify violations of Microsoft's Tier Model and privileged access boundaries that enable attackers to move from lower-trust accounts to critical infrastructure.

Tiering exposures

Identify violations of Microsoft's Tier Model and privileged access boundaries that enable attackers to move from lower-trust accounts to critical infrastructure.

Privilege escalation paths

Reveal inherited permissions, shadow administrators, AdminSDHolder persistence, ACL abuse, and other privilege escalation opportunities that attackers rely on.

Privilege escalation paths

Reveal inherited permissions, shadow administrators, AdminSDHolder persistence, ACL abuse, and other privilege escalation opportunities that attackers rely on.

Privilege escalation paths

Reveal inherited permissions, shadow administrators, AdminSDHolder persistence, ACL abuse, and other privilege escalation opportunities that attackers rely on.

Context-aware prioritization

Every exposure is evaluated based on reachability, propagation, and business impact, helping teams focus on the remediation actions that reduce the most risk.

Context-aware prioritization

Every exposure is evaluated based on reachability, propagation, and business impact, helping teams focus on the remediation actions that reduce the most risk.

Context-aware prioritization

Every exposure is evaluated based on reachability, propagation, and business impact, helping teams focus on the remediation actions that reduce the most risk.

Saporo transforms thousands of identity exposures into a prioritized remediation roadmap. By continuously identifying the weaknesses that create real attack opportunities, it helps security teams focus on the actions that reduce risk the fastest.

Attack path chokepoints

Stop attackers before they reach critical assets by identifying the identities, permissions, and relationships that sit at the center of millions of attack opportunities.

One fix, massive impact

Attackers rarely rely on a single weakness. They combine identities, permissions, relationships, and misconfigurations to reach critical assets. Saporo identifies the chokepoints shared across these attack opportunities, revealing where a single remediation can eliminate entire clusters of risk.

Complete attack opportunity visibility

Analyze every viable attack opportunity across Active Directory, Entra ID, Google Workspace, GCP, AWS, and companion identity sources to understand how attackers can move through your environment.

Complete attack opportunity visibility

Analyze every viable attack opportunity across Active Directory, Entra ID, Google Workspace, GCP, AWS, and companion identity sources to understand how attackers can move through your environment.

Complete attack opportunity visibility

Analyze every viable attack opportunity across Active Directory, Entra ID, Google Workspace, GCP, AWS, and companion identity sources to understand how attackers can move through your environment.

Chokepoint identification

Identify identities, permissions, relationships, and resources that concentrate risk across many paths, where one fix can collapse millions of routes.

Chokepoint identification

Identify identities, permissions, relationships, and resources that concentrate risk across many paths, where one fix can collapse millions of routes.

Chokepoint identification

Identify identities, permissions, relationships, and resources that concentrate risk across many paths, where one fix can collapse millions of routes.

Attack-aware prioritization

Prioritize chokepoints based on realistic attacker objectives, such as privilege escalation, ransomware propagation, credential abuse, and domain compromise.

Attack-aware prioritization

Prioritize chokepoints based on realistic attacker objectives, such as privilege escalation, ransomware propagation, credential abuse, and domain compromise.

Attack-aware prioritization

Prioritize chokepoints based on realistic attacker objectives, such as privilege escalation, ransomware propagation, credential abuse, and domain compromise.

Business-aware remediation

Predict how a remediation will affect access to tagged business services, including whether alternative access paths remain available, helping teams reduce risk without disrupting operations.

Business-aware remediation

Predict how a remediation will affect access to tagged business services, including whether alternative access paths remain available, helping teams reduce risk without disrupting operations.

Business-aware remediation

Predict how a remediation will affect access to tagged business services, including whether alternative access paths remain available, helping teams reduce risk without disrupting operations.

Chokepoint analysis shifts remediation from fixing individual findings to eliminating entire classes of attack opportunities. By focusing on the few changes that matter most, security teams reduce identity exposure faster and with less effort.

Automation & integrations

Turn identity exposure into action with guided workflows, human approval, execution tracking, and 1,900+ integrations across security, IT, cloud, and collaboration tools.

From insight to action

Turn identity exposure into continuous action with guided workflows, human approval, and 1,900+ integrations that reduce manual effort while keeping environments hardened as they evolve.

Prebuilt workflow library

Use 140+ ready-made workflows for common remediation tasks, or create your own workflows tailored to your environment.

Prebuilt workflow library

Use 140+ ready-made workflows for common remediation tasks, or create your own workflows tailored to your environment.

Prebuilt workflow library

Use 140+ ready-made workflows for common remediation tasks, or create your own workflows tailored to your environment.

Continuous remediation

Associate workflows with findings or finding groups once, and automatically remediate new matching exposures as they appear.

Continuous remediation

Associate workflows with findings or finding groups once, and automatically remediate new matching exposures as they appear.

Continuous remediation

Associate workflows with findings or finding groups once, and automatically remediate new matching exposures as they appear.

Human approval

Route approvals through email, Microsoft Teams, Slack, or ITSM platforms, keeping security teams in control before sensitive actions are executed.

Human approval

Route approvals through email, Microsoft Teams, Slack, or ITSM platforms, keeping security teams in control before sensitive actions are executed.

Human approval

Route approvals through email, Microsoft Teams, Slack, or ITSM platforms, keeping security teams in control before sensitive actions are executed.

1,900+ integrations

Create tickets, request approvals, enrich XDR alerts with Saporo context, tag high-risk nodes based on detections, and share exposure intelligence across your security stack.

1,900+ integrations

Create tickets, request approvals, enrich XDR alerts with Saporo context, tag high-risk nodes based on detections, and share exposure intelligence across your security stack.

1,900+ integrations

Create tickets, request approvals, enrich XDR alerts with Saporo context, tag high-risk nodes based on detections, and share exposure intelligence across your security stack.

Measure time saved

Track the hours saved through automation, monitor remediation coverage, and quantify the operational impact of your workflows over time.

Measure time saved

Track the hours saved through automation, monitor remediation coverage, and quantify the operational impact of your workflows over time.

Measure time saved

Track the hours saved through automation, monitor remediation coverage, and quantify the operational impact of your workflows over time.

Reliable execution

Monitor workflow runs, retries, failures, rollback status, and detailed execution logs to ensure every remediation completes safely and reliably.

Reliable execution

Monitor workflow runs, retries, failures, rollback status, and detailed execution logs to ensure every remediation completes safely and reliably.

Reliable execution

Monitor workflow runs, retries, failures, rollback status, and detailed execution logs to ensure every remediation completes safely and reliably.

Workflow governance

Organize workflows with folders and tags, including production-risk levels, ownership, status, and publication controls.

Workflow governance

Organize workflows with folders and tags, including production-risk levels, ownership, status, and publication controls.

Workflow governance

Organize workflows with folders and tags, including production-risk levels, ownership, status, and publication controls.

With Saporo, automation is not a separate step after analysis. It is part of the exposure reduction lifecycle, helping teams act faster, reduce manual effort, and continuously harden identity environments as risk evolves.

Dashboards & monitoring

Continuously measure identity exposure, monitor posture changes, and demonstrate security improvements over time with dashboards, resistance scores, and trend analysis.

Measure, monitor, and improve

Identity exposure is constantly evolving. Saporo continuously tracks posture changes, attack opportunities, resistance scores, remediation progress, and operational metrics through dashboards that make security improvements easy to measure and communicate.

Continuous posture monitoring

Automatically refresh analysis as your environment changes, ensuring dashboards and findings always reflect your current identity exposure.

Continuous posture monitoring

Automatically refresh analysis as your environment changes, ensuring dashboards and findings always reflect your current identity exposure.

Continuous posture monitoring

Automatically refresh analysis as your environment changes, ensuring dashboards and findings always reflect your current identity exposure.

Resistance scores

Quantify overall identity resilience using proprietary resistance scores that combine exposure, attack opportunities, and remediation progress into a single benchmark.

Resistance scores

Quantify overall identity resilience using proprietary resistance scores that combine exposure, attack opportunities, and remediation progress into a single benchmark.

Resistance scores

Quantify overall identity resilience using proprietary resistance scores that combine exposure, attack opportunities, and remediation progress into a single benchmark.

Exposure trends

Track how identity exposure changes over time, including new attack opportunities, remediated findings, attack paths removed, and overall posture improvements.

Exposure trends

Track how identity exposure changes over time, including new attack opportunities, remediated findings, attack paths removed, and overall posture improvements.

Exposure trends

Track how identity exposure changes over time, including new attack opportunities, remediated findings, attack paths removed, and overall posture improvements.

Activity timeline

Track changes to identities, permissions, and configurations alongside log events to understand how your environment evolves over time.

Activity timeline

Track changes to identities, permissions, and configurations alongside log events to understand how your environment evolves over time.

Activity timeline

Track changes to identities, permissions, and configurations alongside log events to understand how your environment evolves over time.

Trend dashboards

Track attack opportunities, remediation progress, resistance scores, HVT protection, workflow adoption, and security improvements over time.

Trend dashboards

Track attack opportunities, remediation progress, resistance scores, HVT protection, workflow adoption, and security improvements over time.

Trend dashboards

Track attack opportunities, remediation progress, resistance scores, HVT protection, workflow adoption, and security improvements over time.

Pre-built and custom dashboards

Start with pre-built dashboards covering compliance (ANSSI, ISO, MITRE, etc.), tiering, exposure, remediation, and executive KPIs or build your own with reusable widgets and flexible queries.

Pre-built and custom dashboards

Start with pre-built dashboards covering compliance (ANSSI, ISO, MITRE, etc.), tiering, exposure, remediation, and executive KPIs or build your own with reusable widgets and flexible queries.

Pre-built and custom dashboards

Start with pre-built dashboards covering compliance (ANSSI, ISO, MITRE, etc.), tiering, exposure, remediation, and executive KPIs or build your own with reusable widgets and flexible queries.

With Saporo, monitoring isn’t just about spotting changes, it’s about measuring resilience. Resistance scores and trend visibility provide the clarity needed to prove progress, maintain control, and ensure environments stay hardened as they evolve.

Scale & performance

Saporo is built for enterprise scale. Analyze millions of identities, permissions, relationships, and attack opportunities across the largest hybrid environments without sacrificing speed, accuracy, or deployment flexibility.

High performance at enterprise scale

Modern identity environments span millions of identities, permissions, relationships, and cloud resources. Saporo's enterprise-scale graph engine efficiently ingests, models, and analyzes this data in memory, delivering fast, interactive analysis whether deployed on-premises or in the cloud.

Enterprise-scale graph engine

Designed for environments where traditional graph analysis struggles to scale. Analyze millions of identities, permissions, relationships, and attack opportunities in memory while maintaining fast traversal and accurate prioritization.

Enterprise-scale graph engine

Interactive analysis

Explore graphs, findings, dashboards, and attack opportunities with responsive queries even in the largest enterprise environments.

Interactive analysis

Explore graphs, findings, dashboards, and attack opportunities with responsive queries even in the largest enterprise environments.

Interactive analysis

Explore graphs, findings, dashboards, and attack opportunities with responsive queries even in the largest enterprise environments.

Flexible deployment

Deploy entirely on-premises, in your private cloud, or as a SaaS platform while maintaining the same enterprise-scale analysis capabilities.

Flexible deployment

Deploy entirely on-premises, in your private cloud, or as a SaaS platform while maintaining the same enterprise-scale analysis capabilities.

Flexible deployment

Deploy entirely on-premises, in your private cloud, or as a SaaS platform while maintaining the same enterprise-scale analysis capabilities.

Purpose-built for enterprise environments

Designed for multi-forest Active Directory deployments, complex Microsoft 365 tenants, and hybrid environments containing millions of identities, permissions, and relationships.

Purpose-built for enterprise environments

Designed for multi-forest Active Directory deployments, complex Microsoft 365 tenants, and hybrid environments containing millions of identities, permissions, and relationships.

Purpose-built for enterprise environments

Designed for multi-forest Active Directory deployments, complex Microsoft 365 tenants, and hybrid environments containing millions of identities, permissions, and relationships.

Continuous analysis

Comprehensive graph analysis keeps identity exposure current as environments evolve. Analysis schedules can be tailored to each organization, while runtime scales efficiently with environment size, graph complexity, and the number of attack opportunities discovered.

Continuous analysis

Enterprise scale should never come at the expense of visibility. Saporo efficiently analyzes the largest hybrid identity environments, delivering complete, accurate results while allowing organizations to choose the analysis frequency that best fits their operational needs.

Advanced exploration

Go beyond predefined analysis with graph exploration, custom queries, saved searches, and advanced reporting tailored to your environment.

Saporo pre written custom queries interface

Explore, query, and report

Every environment is different. Saporo gives analysts the flexibility to explore identity data, build custom graph queries, investigate hypotheses, search collected logs, and create tailored reports and dashboards.

Graph exploration

Interactively explore the identity graph to investigate attack opportunities, relationships, inheritance, and privilege escalation paths beyond predefined reports.

Graph exploration

Interactively explore the identity graph to investigate attack opportunities, relationships, inheritance, and privilege escalation paths beyond predefined reports.

Graph exploration

Interactively explore the identity graph to investigate attack opportunities, relationships, inheritance, and privilege escalation paths beyond predefined reports.

Graph query builder

Build custom graph queries using an intuitive query builder to investigate specific identities, permissions, relationships, or attack opportunities.

Graph query builder

Build custom graph queries using an intuitive query builder to investigate specific identities, permissions, relationships, or attack opportunities.

Graph query builder

Build custom graph queries using an intuitive query builder to investigate specific identities, permissions, relationships, or attack opportunities.

Log exploration

Search collected identity logs alongside graph data to correlate activity with identity exposure and accelerate investigations.

Log exploration

Search collected identity logs alongside graph data to correlate activity with identity exposure and accelerate investigations.

Log exploration

Search collected identity logs alongside graph data to correlate activity with identity exposure and accelerate investigations.

Custom dashboards

Build custom dashboards and reports using reusable widgets, graph queries, and flexible filters tailored to analysts, executives, or compliance teams.

Custom dashboards

Build custom dashboards and reports using reusable widgets, graph queries, and flexible filters tailored to analysts, executives, or compliance teams.

Custom dashboards

Build custom dashboards and reports using reusable widgets, graph queries, and flexible filters tailored to analysts, executives, or compliance teams.

Prebuilt investigations

Start with a library of predefined graph queries for common investigations, then customize or create your own as your needs evolve.

Prebuilt investigations

Start with a library of predefined graph queries for common investigations, then customize or create your own as your needs evolve.

Prebuilt investigations

Start with a library of predefined graph queries for common investigations, then customize or create your own as your needs evolve.

Whether investigating an attack opportunity, validating a hypothesis, or building executive reports, Saporo gives analysts the flexibility to explore identity exposure their way without sacrificing the speed and scale of the underlying graph engine.

Enterprise ready

Saporo is built for enterprise environments, with the security, governance, deployment flexibility, and access controls organizations expect from mission-critical security platforms.

Security and governance by design

Enterprise security platforms must meet the same standards they help enforce. Saporo includes enterprise-grade security, governance, authentication, and auditing capabilities that enable organizations to deploy with confidence.

Role-based access control (RBAC)

Granular permissions let you control who can view, investigate, manage, export, or remediate findings using granular role-based permissions.

Role-based access control (RBAC)

Granular permissions let you control who can view, investigate, manage, export, or remediate findings using granular role-based permissions.

Role-based access control (RBAC)

Granular permissions let you control who can view, investigate, manage, export, or remediate findings using granular role-based permissions.

Single sign-on (SSO)

Integrate with enterprise identity providers for centralized authentication and simplified user lifecycle management.

Single sign-on (SSO)

Integrate with enterprise identity providers for centralized authentication and simplified user lifecycle management.

Single sign-on (SSO)

Integrate with enterprise identity providers for centralized authentication and simplified user lifecycle management.

Multi-factor authentication (MFA)

Strengthen account security with built-in MFA enforcement, helping ensure only authorized users access the platform.

Multi-factor authentication (MFA)

Strengthen account security with built-in MFA enforcement, helping ensure only authorized users access the platform.

Multi-factor authentication (MFA)

Strengthen account security with built-in MFA enforcement, helping ensure only authorized users access the platform.

Audit trails

Maintain a complete audit trail of user activity, configuration changes, remediation actions, and administrative operations to support governance and compliance.

Scoped Access

Limit visibility by domain, tenant, organization, or scope, enabling delegated administration while protecting sensitive data and preserving graph analysis.

Compliance-ready platform

Built with enterprise security practices and certified against ISO 27001 (SOC 2 in progress), with support for the compliance requirements of regulated organizations.

Compliance-ready platform

Built with enterprise security practices and certified against ISO 27001 (SOC 2 in progress), with support for the compliance requirements of regulated organizations.

Compliance-ready platform

Built with enterprise security practices and certified against ISO 27001 (SOC 2 in progress), with support for the compliance requirements of regulated organizations.

Saporo combines enterprise-grade security, governance, and operational controls with the scalability required by large organizations, allowing security teams to deploy confidently across regulated and business-critical environments.

AI & assisted resolution

Saporo goes beyond analysis. It provides clear, prescriptive recommendations — enhanced with AI assistance — so teams can remediate with confidence.

From findings to fixes

Security teams don’t just need to know what’s wrong, they need to know how to fix it. Saporo generates tailored recommendations for every issue, enriched with AI explanations that clarify risks and propose safe remediation steps.

Contextual recommendations

Every finding is paired with a prescriptive fix tailored to your specific AD, Entra ID, or cloud environment. A script or cmd to fix the issue is provided when possible.

AI-powered guidance

LLM assistance (cloud or on-prem) explains complex risks in plain language and suggests remediation steps aligned to best practices.

Framework mapping

Recommendations link directly to ANSSI, MITRE, ISO, and CIS controls, making it easy to align fixes with compliance goals.

Framework mapping

Recommendations link directly to ANSSI, MITRE, ISO, and CIS controls, making it easy to align fixes with compliance goals.

Framework mapping

Recommendations link directly to ANSSI, MITRE, ISO, and CIS controls, making it easy to align fixes with compliance goals.

With AI-assisted resolution, Saporo transforms posture management into action. Teams get clear fixes, trusted guidance, and the confidence to harden identities without fear of breaking critical systems.

See Saporo in Action

Reduce identity exposure before it becomes an attack

See how Saporo helps organizations discover attack opportunities, prioritize what matters most, and mobilize remediation before exposure becomes an incident.

Book a demo