Command
OktaIdentity & accessCheck MFA, sign-on and password policy, flag dormant users and unapproved AI apps, and feed the asset inventory.
An integration that only imports alerts gives you one more inbox. Command reads the configuration behind the tool, and asks whether the control you claim is actually implemented, so a connection produces evidence instead of noise.
§ 01What a connection does
Connections become
control evidence.
You connect a tool once. Command reads its live configuration, decides which controls that configuration evidences, attaches the proof, and raises a finding the moment the configuration drifts away from what the control requires.
Attack surface, operations, connections and technology in one placeMonitoring
+ Add connectionAttack surfaceOperationsConnectionsTechnology
EntraActiveMicrosoft Entra IDLast synced Jul 24, 11:00 PM
AWSActiveAmazon Web ServicesLast synced Jul 24, 11:00 PM
GitHubActiveGitHubLast synced Jul 24, 11:00 PM
CloudflareActiveCloudflareLast synced Jul 24, 11:00 PM
GCPActiveGoogle CloudLast synced Jul 24, 11:00 PM
WorkspaceActiveGoogle WorkspaceLast synced Jul 24, 11:00 PM
SOC 2 · access controlsLogical access is restricted to authorized users
PartialNIST PR.AA-03CIS v8 · 6.5
Evidence · read from connections
MFA enrollment · 202 of 214 usersEntra
Conditional access policy · 6 rules activeEntra
Admin role assignments · 9 accountsAWS
Refreshed nightlyDrift raises a finding
The control, evidenced
Command decides which controls a connection speaks to, attaches the live reading as evidence, and re-reads it nightly.
12 of 214 users are exempt from MFA.
That is not an alert. It is a control you are claiming, partially implemented, with the number attached and someone to fix it. Open the number and Command names the twelve, ready to export for whoever owns the fix. The moment that number moves the wrong way, it is a finding with a due date.
01 · Connect
Five minutes a tool.
Each connection is an OAuth consent screen and a read-only scope. No agents to deploy, no network changes, nothing for your team to maintain afterwards.
02 · Validate
Read the live config.
Command scans each connection to test whether the control is genuinely implemented, turning real configuration into evidence and drift into findings.
03 · Act
Metrics, then movement.
Live metrics land on the Command dashboard the moment a tool is connected. Findings route into the ticketing and on-call queues that own the fix, and briefings arrive in the channels your team already uses.
§ 02The directory
All 68,
by category.
Twelve categories, weighted toward the systems that actually carry control evidence: identity, cloud, endpoint and code. More are added every release.
OktaIdentity & accessMicrosoft Entra IDIdentity & accessCheck Conditional Access, MFA registration, admin sprawl and Secure Score, and feed the asset inventory.
Cisco DuoIdentity & accessVerify multi-factor coverage across the workforce and flag the exemptions automatically.
JumpCloudIdentity & accessMeasure MFA enrollment across directory users, and keep the admin count in view.
Ping IdentityIdentity & accessMeasure MFA enrollment, and flag users who have not signed in for ninety days.
ManageEngine AD360Identity & accessRead Active Directory accounts, groups and password policy as evidence for on-premises access controls.
1PasswordIdentity & accessTrack failed sign-ins and failed MFA attempts against the team account.
LastPassIdentity & accessKeep the admin count in view, and flag disabled accounts that were never removed.
CyberArkPrivileged accessConfirm privileged accounts are vaulted and rotated on schedule, and flag failed rotations.
BeyondTrustPrivileged accessConfirm privileged accounts are under management and rotated on schedule, and flag failed rotations.
SaviyntIdentity governanceBring access certifications and entitlement reviews in as evidence for your access-review controls.
Amazon Web ServicesCloudScan account configuration for control validation and catch drift as it happens.
Microsoft AzureCloudValidate cloud posture and resource configuration against your control set.
Google CloudCloudCheck GCP configuration and IAM against control requirements continuously.
CloudflareCloudVerify TLS, HTTPS and DNSSEC settings across every zone, and track threats blocked at the edge.
SupabaseCloudCheck SSL enforcement, network restrictions, point-in-time recovery, MFA and row-level security on every project.
WizCloud securityBring cloud risks and misconfigurations in as findings, tracked to closure.
Palo Alto NetworksNetwork securityFlag any-to-any allow rules, and confirm logging, threat profiles and device health across managed firewalls.
FortinetNetwork securityFlag any-to-any allow rules, and confirm logging and IPS profiles across the FortiGate estate.
Cisco MerakiNetwork securityConfirm intrusion detection and anti-malware on MX networks, admin 2FA, and device encryption through Systems Manager.
ZscalerSecure edgeRead web DLP, SSL inspection, URL filtering and firewall rules, and flag SSL bypasses that apply to everyone.
Cisco UmbrellaSecure edgeConfirm roaming devices are protected and in sync, and track risky requests allowed and threats blocked.
CrowdStrikeEndpoint & devicePull endpoint coverage and detections into findings, mapped to your controls.
SentinelOneEndpoint & deviceConfirm agent coverage across the fleet and surface detections automatically.
Microsoft DefenderEndpoint & deviceValidate endpoint protection coverage and pull alerts into the program.
Cisco Secure EndpointEndpoint & deviceConfirm connector coverage across the fleet and pull malware detections into findings.
Microsoft IntuneEndpoint & deviceEvidence device compliance, encryption and check-ins across managed endpoints, read through the Entra connection.
JamfEndpoint & deviceConfirm FileVault, firewall, SIP and Gatekeeper on every managed Mac, and catch Macs that dropped out of MDM.
HuntressManaged EDRTrack agent health and open threat findings, and how quickly they are resolved.
QualysVulnerabilityBring vulnerability scan results in as tracked findings with owners and due dates.
Rapid7VulnerabilitySync vulnerability findings and remediation status into the security program.
TenableVulnerabilityIngest exposure data and track remediation through to closure.
AxoniusAsset managementReconcile the full asset inventory and surface the gaps your controls do not cover.
JiraTicketingPush remediation into the queues your team already works, and measure overdue work and time to resolve.
PagerDutyOn-callRoute urgent findings to the on-call rotation that owns the fix.
SlackCommunicationDeliver briefings, approvals and alerts where your team already talks.
Microsoft TeamsCommunicationSend briefings and approval requests straight to your Teams channels.
Google WorkspaceProductivityCheck 2-Step Verification, super-admin count and email authentication, flag unapproved AI apps, and feed the asset inventory.
SalesforceCRMValidate org security settings, permission sets and MFA enforcement across your Salesforce users.
GitHubCodeScan repository and org settings, and connect code controls to your program.
GitLabCodeCheck branch protection, merge review and two-factor enforcement, and keep owner access in view.
BitbucketCodeCheck branch protection and merge review, and keep admin access in view.
SemgrepCodePull static analysis findings into the program and confirm scanning coverage.
SnykCodeBring dependency and code vulnerability findings into one remediation queue.
Aikido SecurityCodePull code, dependency and container findings into one queue, and confirm scanning coverage.
ProofpointEmail & awarenessMeasure malicious email caught at the gateway, and the messages and clicks that still reached users.
MimecastEmail & awarenessTrack malicious email detected, and how much of it still reached inboxes.
Abnormal SecurityEmail & awarenessBring inbound email attack and account-takeover signals into findings for triage.
KnowBe4Email & awarenessEvidence training completion and phishing resilience across the workforce.
SoSafeEmail & awarenessEvidence mandatory training completion, flag overdue learners, and track simulated phishing results.
BarracudaEmail & awarenessCount inbound threats stopped, and the malicious messages that still reached users.
Email AuthenticationEmail authenticationCheck DMARC, SPF, DKIM, MTA-STS, DNSSEC and CAA on every domain you send from.
ForcepointData loss preventionTrack DLP policy matches, and how many were allowed through.
CyberhavenData loss preventionTrack data-flow policy matches, and how many were allowed to leave.
Microsoft PurviewData governanceConfirm sensitivity labels, DLP policies and retention are enforced across Microsoft 365.
VeeamBackup & recoveryEvidence backup coverage and recovery readiness across protected workloads.
AWS BackupBackup & recoveryConfirm backup policy and retention are enforced across your AWS accounts.
SplunkSIEM & monitoringConfirm detection rules are enabled and security logs are kept long enough.
Microsoft SentinelSIEM & monitoringConfirm log ingestion and analytics-rule coverage, and bring incidents in as findings.
Elastic SecuritySIEM & monitoringEvidence detection-rule coverage and pull log-based findings into the remediation queue.
DatadogSIEM & monitoringConfirm log and monitor coverage across the stack, and bring security signals in as findings.
HPE OpsRampIT operationsEvidence infrastructure monitoring coverage and route operational alerts into the program.
NebulockThreat huntingBring hunt results and detection coverage gaps in as findings, tracked to closure.
ZeroFoxExternal threatsTrack impersonation alerts, exposed credentials and takedowns alongside the rest of the program.
WorkdayHR & peopleFlag leavers still marked active, and track terminations so offboarding keeps pace.
HiBobHR & peopleFlag leavers still marked active, and employees with no manager or department.
BambooHRHR & peopleCatch terminations still marked active, and track new hires and leavers each month.
RipplingHR & peopleFlag leavers still marked active, and keep manager and department records complete.
No integration matches that. Tell us what you run and we will get it on the roadmap.
Showing all 68 integrationsMore added every release
§ 03Next
Don't see
a tool you run?
Send us the stack. If something you depend on is not here yet, it goes on the roadmap, and we will tell you honestly whether it is weeks or quarters away.