Security Posture

VeraID provides Identity Security Posture Management (ISPM) — a continuous assessment of your organization’s non-human identity landscape. The ISPM dashboard surfaces unmanaged identities, quantifies risk, and guides remediation priorities across AWS, Azure, GCP, and Kubernetes.

ISPM Dashboard

The Security Posture dashboard provides a unified view of your identity security health:

• Aggregate Security Score — A weighted score (0–100) across all managed and discovered identities, updated in real time as identities are created, modified, or remediated.
• Identity Inventory — Total count of managed NHIs, broken down by type, platform, and risk level.
• Risk Distribution — Visual breakdown of identities by risk tier (Low, Moderate, Elevated, High, Critical).
• Discovery Status — Count of unmanaged identities discovered but not yet imported.
• Trend Analysis — Historical posture score over 7, 30, and 90-day windows.

Tip

The aggregate security score is a weighted average, not a simple mean. High-risk identities with broad permissions carry more weight than low-privilege service accounts. Remediating a single critical identity can significantly improve your overall score.

Aggregate Security Score

The aggregate score is computed from individual identity risk scores, weighted by:

Factor	Weight	Description
Permission scope	30%	Breadth of access granted to the identity.
Credential hygiene	25%	Age, rotation frequency, and storage method of credentials.
Activity patterns	20%	Frequency and regularity of usage, dormancy detection.
Policy coverage	15%	Whether the identity is governed by active policies.
Owner assignment	10%	Whether a human owner is assigned for accountability.

Score ranges:

Score	Rating	Interpretation
90–100	Excellent	Strong posture, minimal risk.
70–89	Good	Minor improvements recommended.
50–69	Fair	Several identities require attention.
30–49	Poor	Significant risk exposure, remediation needed.
0–29	Critical	Immediate action required.

Discovery

VeraID automatically scans your cloud environments to discover non-human identities that exist outside of VeraID’s management. Discovery surfaces shadow service accounts, orphaned API keys, and over-privileged roles that may pose security risks.

Supported Platforms and NHI Types

Discovery scans across four platforms and identifies the following NHI types:

Platform	NHI Type	Description
AWS	AWS_IAM_USER	IAM users with programmatic access keys.
AWS	AWS_IAM_ROLE	IAM roles assumed by services or cross-account.
AWS	AWS_LAMBDA_ROLE	Execution roles attached to Lambda functions.
AWS	AWS_ECS_TASK_ROLE	Task roles assigned to ECS containers.
AWS	AWS_SECRET	Secrets stored in AWS Secrets Manager.
GCP	GCP_SERVICE_ACCOUNT	GCP service accounts with key files or Workload Identity.
Azure	AZURE_SERVICE_PRINCIPAL	Azure AD service principals and managed identities.
Azure	AZURE_APP_REGISTRATION	Azure AD application registrations with client secrets.
Kubernetes	K8S_SERVICE_ACCOUNT	Kubernetes service accounts across clusters.
Google Workspace	GOOGLE_WORKSPACE_DELEGATION	Domain-wide delegation grants to service accounts.

Caution

Discovery requires read-only credentials for each platform. VeraID never modifies resources during discovery scans. See the Integrations section for setup instructions.

Discovery Scan API

Trigger and monitor discovery scans programmatically.

Start a discovery scan:

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "platforms": ["AWS", "GCP", "AZURE", "K8S"],
    "scope": {
      "aws": {
        "accountIds": ["123456789012", "210987654321"],
        "regions": ["us-east-1", "eu-west-1"]
      },
      "gcp": {
        "projectIds": ["my-project-prod", "my-project-staging"]
      },
      "azure": {
        "subscriptionIds": ["sub-abc-123"]
      },
      "k8s": {
        "clusterNames": ["prod-cluster", "staging-cluster"]
      }
    }
  }' \
  https://app.veraid.io/api/v1/discovery/scans

Get scan history:

curl -H "Authorization: Bearer $API_KEY" \
  https://app.veraid.io/api/v1/discovery/scans

Response:

{
  "scans": [
    {
      "id": "scan_abc123",
      "status": "COMPLETED",
      "startedAt": "2026-03-19T08:00:00Z",
      "completedAt": "2026-03-19T08:12:34Z",
      "platforms": ["AWS", "GCP"],
      "discovered": 47,
      "newSinceLastScan": 12,
      "riskSummary": {
        "critical": 3,
        "high": 8,
        "moderate": 21,
        "low": 15
      }
    }
  ]
}

List discovered NHIs:

curl -H "Authorization: Bearer $API_KEY" \
  "https://app.veraid.io/api/v1/discovery/identities?status=DISCOVERED&platform=AWS"

Response:

{
  "identities": [
    {
      "id": "disc_xyz789",
      "type": "AWS_IAM_ROLE",
      "name": "legacy-data-pipeline-role",
      "platform": "AWS",
      "accountId": "123456789012",
      "region": "us-east-1",
      "status": "DISCOVERED",
      "discoveredAt": "2026-03-19T08:05:12Z",
      "riskIndicators": [
        "NO_OWNER_ASSIGNED",
        "OVERPRIVILEGED",
        "NO_ACTIVITY_90_DAYS",
        "KEY_NOT_ROTATED_180_DAYS"
      ],
      "riskScore": 78,
      "lastActivity": "2025-12-15T03:22:00Z",
      "permissions": {
        "policies": ["AdministratorAccess"],
        "scope": "FULL_ADMIN"
      }
    }
  ]
}

Risk Indicators

Each discovered NHI is tagged with risk indicators that explain why it was flagged:

Indicator	Description
NO_OWNER_ASSIGNED	No human owner is associated with this identity.
OVERPRIVILEGED	Permissions exceed what is needed for observed usage.
NO_ACTIVITY_90_DAYS	No API calls or authentication events in the last 90 days.
KEY_NOT_ROTATED_180_DAYS	Credentials have not been rotated in over 180 days.
MULTIPLE_ACCESS_KEYS	More than one active access key (AWS-specific).
CROSS_ACCOUNT_TRUST	Role can be assumed from external AWS accounts.
DOMAIN_WIDE_DELEGATION	Google Workspace domain-wide delegation is active.
NO_MFA_ON_OWNER	The human owner does not have MFA enabled.

NHI Status Workflow

Discovered identities follow a triage workflow:

DISCOVERED → REVIEWED → IMPORTED
                      → IGNORED
                      → ARCHIVED

Status	Description
DISCOVERED	Newly found by a scan, awaiting triage.
REVIEWED	A team member has reviewed the identity and is deciding on action.
IMPORTED	Imported into VeraID for full lifecycle management and policy enforcement.
IGNORED	Acknowledged but intentionally left unmanaged (e.g., third-party managed).
ARCHIVED	No longer active or relevant, retained for audit history.

Update discovery status:

curl -X PATCH \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"status": "REVIEWED"}' \
  https://app.veraid.io/api/v1/discovery/identities/{discoveryId}

Import a discovered identity into VeraID:

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "discoveryId": "disc_xyz789",
    "ownerId": "user_owner123",
    "tags": ["legacy", "needs-rotation"],
    "policies": ["pol_default_read_only"]
  }' \
  https://app.veraid.io/api/v1/discovery/identities/{discoveryId}/import

Note

Importing a discovered identity does not modify the identity in the source platform. It creates a managed record in VeraID and begins policy enforcement and monitoring.

Scheduled Scans

Configure discovery scans to run on a recurring schedule:

curl -X POST \
  -H "Authorization: Bearer $API_KEY" \
  -H "Content-Type: application/json" \
  -d '{
    "schedule": "0 2 * * *",
    "platforms": ["AWS", "GCP", "AZURE", "K8S"],
    "notifyOnNewDiscoveries": true,
    "notifyOnRiskChange": true
  }' \
  https://app.veraid.io/api/v1/discovery/schedules

The schedule field accepts standard cron syntax. The example above runs a full scan daily at 2:00 AM UTC.

Tip

Start with a daily scan schedule. Once you have baseline coverage, consider increasing frequency to every 6 hours for production environments where identities change frequently.

Next Steps

• Threat Detection — Monitor identity behavior and detect anomalies.
• Blast Radius Analysis — Assess the impact of a compromised identity.
• Alerts — Configure notifications for posture changes and discoveries.