Map how identities combine permissions, role assumptions, trust policies, and service actions to gain privileges they were never meant to have.
Read-only AWS identity graph
A single AWS permission may look harmless. Combined with PassRole access, policy changes, service execution roles, and trust relationships, it can become a real escalation route.
Securitain connects those relationships so teams can review the paths that create the greatest business risk first.
Eight detection categories map the full spectrum of IAM privilege escalation risk in AWS.
Identify AWS permissions that work together to create access beyond the intended boundary.
Detect identities that can pass powerful roles to services that may execute elevated actions.
Map direct and indirect sts:AssumeRole paths that lead toward privileged roles.
Highlight broad principals, external trust, weak conditions, and risky role relationships.
Find identities that can alter policies, update trust, or attach permissions that create new access.
Identify Lambda, EC2, CloudFormation, and workload-role paths that can lift privilege.
Surface relationships where one AWS account can reach higher access in another account.
Analyze permission sets and assignments that create broad access across AWS accounts.
Securitain creates a connected view of the identities, roles, policies, permissions, trust relationships, and resources involved in each escalation path.
Securitain evaluates each escalation path with context so teams can review the most urgent exposures first.
Direct path to administrative access through an active identity
Multi-step path to privileged access or cross-account admin
Indirect path through service assistance or conditional trust
Theoretical path with limited practical reachability
An IAM user can assume a role with administrative access because the role trust policy is too broad.
A developer can pass a privileged role to Lambda or EC2 and execute actions beyond intended permissions.
An identity can create or activate a more permissive version of a managed IAM policy.
A user can add themselves or another identity to a group with elevated permissions.
A role in one account can assume another role that eventually reaches admin access elsewhere.
An Identity Center permission set provides broad access across multiple accounts.
Each finding includes the permissions, principals, roles, services, and accounts involved. Securitain remains read-only; your team stays in control of every remediation decision.
Connect through a read-only cross-account role with a unique External ID. No agents, long-lived keys, write permissions, or always-running collectors are required.
Find the AWS identities most capable of reaching administrative access.
Understand which permissions and trust relationships require redesign.
Detect workload identities with unintended escalation capability.
Produce evidence for privileged access path review and resolution.
Evaluate privilege escalation exposure across customer AWS accounts.
Discover toxic permissions, role-assumption chains, and hidden paths to administrative AWS access.
Explore analyzerDetect public, external, cross-account, and IAM-driven access to sensitive AWS resources.
Explore analyzerDiscover how identities, policies, roles, and trust relationships combine to create hidden routes to privileged AWS access.
Read-only analysis. No agents. No automatic remediation.
