Bob MartinezPerson
svc-backupService account
Find overlooked identities
Inspect human and service identities, credential age, and available activity evidence.
Who can reach what matters.
Every identity that can reach your sensitive data. Ranked by what to fix first.
Theodolite surveys human and service identities across AWS, Azure, and SharePoint, brings their reported permissions together with sensitive-data evidence, and gives your team a prioritized fix list.
svc-backup
Service account · SharePoint
- Owner
- Not recorded
- Credential age
- 400+ days
Reported permissionReader
employee-roster-2026.xlsx
187 personal-data matches
Detected patternssn
An aging credential, an owner to identify, and personal-data indicators to investigate.
Provider-reported. Effective access shown when verified.
Who holds access to what.
People leave. Service accounts stay. Permissions accumulate. Bring identities and resource permissions into the same view so your team can decide where to look first. Coverage follows the sources and permissions you authorize.
SharePoint- Identity
- svc-backup
- Reported permission
Put permissions in context
Follow reported permissions to associated resources and examine the supporting source evidence.
Who owns this identity?
Is the credential still needed?
What access needs confirmation?
Focus the investigation
See which access questions need an owner, a closer review, or more evidence.
What we inspected. What we couldn't.
See which sources were inspected and which need attention. Missing permissions and unsupported content appear alongside your results, with the scope and reason for each gap.
Missing permissions
Access denied
Inspection statusScope not inspected
The denied scope stays uninspected. Evidence collected elsewhere remains available.
Review the access gap
Review the affected scope and reason in the environment details. Confirm the intended scanner permissions with the environment owner.
Content not analyzed
Unsupported format
Inspection statusFile listed · Content not analyzed
A discovered file is not always analyzed content. When the scanner cannot process its format, the file remains listed with its inspection status.
Inspect the coverage reason
Use the reason recorded for the affected file to decide what needs a different review method.
Uninspected content is not an all-clear.
Sensitive data, with the evidence behind it.
Open a document to see detected patterns, match counts, and source context. Give your team the evidence to assess what deserves attention.
Documents
deploy-notes.md
SharePoint / Engineering / Shared Documents
- Detected pattern
api_key- Matches
- 3
Source context
API-key patterns were detected in these deployment notes. Review the source and the credential-remediation guidance in Top priorities.
Automated matches need review before confirming a classification.
Your fix list, ranked.
See the evidence and recommended remediation together.
Credential detected in deploy-notes.md
SharePoint
Critical
3 matches
Credential detected in legacy-config.env
SharePoint
Critical
6 matches
Review findings and recommendations; they do not remediate your environment.
What it could cost. In validation.
A typical year, a bad year, and a single incident answer different questions. Explore the modeled range and the chance of exceeding a loss threshold, including years with no incident. Theodolite and its report use the same three measures.
Possible annual-loss outcomes
Illustrative scenario- Typical year
- $0–$212,209
- Bad year (1-in-100)
- $3,581,025
- Per incident
- $110,325–$591,323
Annual P25–P75, including zero-incident years.
Annual P99. Not a maximum.
Individual-incident P25–P75.
In this example,
37.09% modeled chance of annual losses exceeding $41,053.
How to read this example
Typical year includes all modeled years, including those with no incident. A $0 lower bound does not mean zero risk. Bad year (1-in-100) is an annual tail threshold, not a maximum or a fixed schedule; tied values can mean fewer than 1% of years exceed it. Per incident describes individual losses, not totals for years with incidents.
This illustration assumes an average of 0.5 incidents per year and an incident-loss distribution with a $250,000 median and a $2 million 95th percentile. These are scenario inputs, not customer observations or a forecast.
Illustrative results; customer estimates require evidence, approval, and completed validation.
Your scanner.
Your environment.
Deploy in AWS or Azure. Connect the sources your administrator authorizes and keep detailed findings in your environment.
Survey AWS in your environment
Review the resources and supported content your scanner is authorized to read.
- Resource configuration
- Observed IAM identities
- Supported S3 content
Start small.
Then go deeper.
Sample survey
Review initial evidence within a bounded processing window.
Full survey
Continues automatically into a deeper review, with coverage gaps kept visible.
Your AWS or Azure environment
Theodolite scanner
Reads the sources you authorize
Detailed findings
In your scanner database
Connector secrets
In your secret store
In-memory relay
Requested details transit Theodolite over TLS.
Zero central persistenceof detailed findings
Your browser
Review findings, observed access, and priorities.
A connection initiated by your scanner.
The connection starts outbound from your scanner; your browser reviews the requested results through the relay.
Start with the access you grant.
The scanner uses the permissions granted to its workload identity and supported connectors. Additional accounts or subscriptions require explicit grants and registration.
Survey scope follows permissions, supported content, and processing limits.
Your software.
Expertise when you need it.
Use Theodolite as a standalone product. If your team wants help interpreting results or planning next steps, vCSO.ai advisory support is available separately.
Nick Shevelyov
Founder, vCSO.ai
Former Chief Security Officer
Silicon Valley Bank · 2007–2021
Frequently asked questions
What will we get?
An evidence-led view of identities, resource permissions, sensitive-data indicators, and prioritized security findings. Explore the source behind a result, follow the recommended next steps, and see where coverage needs attention.
The report view can be printed or saved as a PDF when its required data is available.
How do we start a sample survey?
Select “Request a sample survey” to discuss your sources and arrange assisted onboarding. Your administrator approves the scanner deployment, source permissions, and associated cloud costs before work begins.
A Sample survey gathers initial evidence within a bounded processing window, then continues automatically into a distinct Full survey. Volume, permissions, and provider response times affect completion.
The request itself needs no cloud access and starts no survey.
Where do our findings stay?
Detailed findings stay in your customer-hosted scanner database. Connector secrets stay in your customer-controlled secret store.
Requested details transit Theodolite encrypted and in memory for authorized viewing. Operational state and permitted run summaries may be retained centrally.
Will the scanner change our source data?
Supported scanning reads the sources you authorize. Installation creates the scanner’s own cloud resources; any permission to update that infrastructure is separate from access to your source data.
Does Theodolite quantify financial risk?
The loss engine is in validation, with an illustrative scenario on the homepage. Theodolite and its report use three measures: Typical year (annual P25–P75, including no-incident years), Bad year (1-in-100, annual P99), and Per incident (individual-incident P25–P75). Customer estimates require qualified evidence, an approved model, and completed validation; individual files, identities, and findings are not assigned dollar values.
Start with your
access questions.
Tell us which environments you want to review. We’ll discuss the scope, show you the product, and help your administrator prepare for the Sample survey.
- See the productReview observed access, sensitive-data evidence, and priorities using example results.
- Discuss your environmentDiscuss supported sources and the access your administrator would authorize.
- Choose your next stepPlan assisted onboarding, with optional advisory support if you need it.