Skip to main content
qorionix
All four modules

IAM

Identity and access

Every sign-in decided by a rule you can read, and a trace showing which one won.

Almost every intrusion into a company your size starts with a working password. Identity is therefore not the boring pillar; it is the one that decides whether the other three ever get exercised. The point of this pillar is not more sign-in friction — it is asking for a second factor precisely when a sign-in looks wrong, and being able to prove afterwards which rule made that call.

Included from Core · see the tiers

What it does

Capabilities, with their real status

  • Adaptive multi-factor with behavioural risk scoring

    Shipping

    A risky sign-in gets a step-up challenge, and the signal breakdown that triggered it is stored rather than discarded. Step-up is the safest possible automated action: the user proving their identity is the remediation, so the action is self-correcting when it is wrong.

  • Passkeys and hardware keys

    Shipping

    A real WebAuthn ceremony with signature verification. A forged signature, a phished origin and a replayed assertion are all rejected — verified against each case, not assumed. Text messages and authenticator push notifications are not treated as phishing-resistant, because they are not.

  • An ordered policy engine with a decision trace

    Shipping

    First match wins, and every evaluation produces a per-rule trace naming the winning rule and why each earlier one did not apply. When somebody asks why a contractor got in, there is an answer rather than a theory.

  • Network zones

    Shipping

    Allow and deny by address range or country, evaluated before rule matching. A sign-in from a blocked zone is refused outright; the same credentials from outside it work normally.

  • Single sign-on, OIDC, SAML and API keys

    Shipping

    Standard federation with the SAML implementation hardened against signature wrapping, duplicate identifiers, nested assertions and cross-tenant replay — each case tested against the live route rather than the library's documentation.

  • Role-based access with a real permission catalogue

    Shipping

    Eighty-five named permissions rather than three tiers called admin, user and viewer, plus delegated administration so an office manager can reset a password without being able to read the audit log.

  • Inbound user provisioning over SCIM

    Shipping

    Creates users and memberships from your HR or directory system, against the real tables — the shadow-store mount it once ran against has been retired.

The limits

What this module does not do

Every module on this site carries this section. A product page without one is a product nobody has run against a real customer.

  • Deprovisioning or deleting a user is never automated, at any tier.

The rest of the platform

Also included

PAM

Privileged access

Administrators do the work without ever holding the password.

ReadSIEM

Log collection and detection

Your logs in one place, matched against detections that carry their own false-positive guidance.

ReadXDR

Endpoint detection and response

What the suspicious process actually did, and a response you can take back.

Read

Find out what an attacker would see

Connect Microsoft 365 and read your own posture report. 82 checks against your real tenant, naming your real administrators, applications and devices. Free, complete, and yours to keep — not a sample with the findings blurred.

Start the free assessment

No card. No sales call before you have read the report.