57%
Identities are invisible
Over half of enterprise identities are invisible to the systems meant to govern them. You can't review what you can't see.
NDGM/ identity-graph/ live
lat 51.509°Nlon 0.118°W● UK
Closed-loop identity governance
estate 400nhi:human 7:1evidence 100%
Identity governance that fixes what it finds.
NDGM discovers every human, service account and AI agent on your estate — then rotates the credential, vaults the secret, and hands your auditor the evidence. A closed loop, not another report.
Customer zero — governs its own 400-identity estateNow recruiting UK design partnersBuilt & hosted in the UK
/ 01The problem
legacy_iga.finds_not_fixesLegacy IGA finds. It doesn't fix.
Most identity governance ends at a finding: a stale key flagged, a review completed, a PDF filed. The risk itself is still live.
45:1
Machines outnumber people
Service accounts, keys and AI agents outnumber humans roughly 45 to one — and legacy IGA was built for the one.
#1
Credentials still win breaches
Stolen credentials remain among the most common ways in. The stale key gets a ticket; the ticket gets a backlog; next year's audit finds the same key.
1. Orchid Security, 2026 Identity Gap report · 2. CyberArk, Identity Security Landscape · 3. Verizon, Data Breach Investigations Report
Read the full analysis: Invisible Identity, Visible Liability — the NDGM white paper
/ 02The loop
discover → enforce → prove → repeatFive steps. One closed loop.
Identities change constantly, so governance can't be an annual event. NDGM runs the loop continuously — and step four is the one nobody else has.
step 01
Discover
Connect your estate. Humans, service accounts, keys and agents land in one live identity graph.
step 02
Classify
Every identity typed, owned and risk-scored — graphed against its actual access.
step 03
Govern
Blueprint-driven reviews with AI-recommended decisions. Certifications without spreadsheets.
the difference
step 04
Enforce
Rotate the credential. Vault the secret. Revoke what shouldn't be there. The loop closes.
step 05
Prove
Checksummed, auditor-ready evidence packs from every run. Immutable by design.
/ 03The product
recorded in the live platformThe actual product. No slideware.
Real walkthroughs recorded in the live platform — reviews, blueprint runs and evidence packs as your team would see them.
Reviewer Inbox & Reeve AI Assistant
Click any access item below to see Reeve's real-time AI reasoning and confidence score.
All Severities (3)High RiskPending Decision
PENDING ACCESS REVIEWS
🤖
Reeve AI Decision Assistant
96%Confidence
TARGET ACCESS & RESOURCE
aws-prod / arn:aws:iam::*::role/InfraAdmin
✨AI Triage & Policy Evidence
Identity has not assumed this role in 35 days. Standing admin access violates least-privilege policy (AWS-SEC-04).
✓ Checked against company Zero-Trust Access Policy✓ 100% Tamper-evident audit log generated
EXECUTE ONE-CLICK GOVERNANCE ACTION:
Live Simulation
Experience Closed-Loop Governance
Test Reeve AI’s decision triage on live simulated identity risks. Click any finding below to inspect the reasoning, policy match, and trigger one-click remediation.
Pending Access Certifications (3)0/3 Remediated
Reeve Decision Assistant (End-to-end encrypted AI)96% Confidence
TARGET ACCESS & RESOURCE IDENTIFIER
arn:aws:iam::prod:role/InfraAdmin
✦Reeve Policy & Least-Privilege Evidence
Identity has not assumed this role in 35 days. Standing admin access violates least-privilege policy (AWS-SEC-04) and exceeds the 30-day dormant privilege limit.
✓ Evaluated against:
AWS-SEC-04 (Zero-Trust Access)✓ Tamper-evident SHA-256 audit entry stagedEXECUTE ONE-CLICK GOVERNANCE ACTION
Notice how the loop closes: no Jira ticket, no stale PDF. The risk is fixed.
/ 04The agent
encrypted AI · human gatesMeet Reeve. Governance that doesn't wait for tickets.
Reeve watches your identity graph continuously. It detects the orphaned account or ageing credential, triages it with end-to-end encrypted AI, opens a job with its reasoning attached — and once you approve, it acts: assigns the owner, rotates the secret, closes the loop.
End-to-end encrypted AI — the model provider never sees your data
Human-approval gates on every destructive action
Every job carries its reasoning and a confidence score
reeve (n.) — the English official who kept order long before “sheriff” was a word.
reeve · jobs queue● 3 active
orphaned_nhirecommended
Service account svc-data-sync has no owner
→ Assign owner j.whitfieldconf 0.91
secret_hygieneawaiting approval
App credential entra-prod-02 is 84 days old
→ Rotate & vault credentialconf 0.88
orphaned_nhirecommended
API key ci-deploy-key unused for 60 days
→ Open reviewconf 0.79
encrypted AI · attested enclave
/ 05The edge
metadata only · outbound-onlyGovern what your cloud APIs can't see.
Most identity tools stop at the SaaS API. NDGM's lightweight edge agent runs inside your environment — a VM, a container, or a laptop — and surfaces the identity risk that never reaches a cloud console. Findings are reported as metadata only; raw secrets never leave your environment, and each one is handed to Reeve to govern.
/ secrets sprawl
Unmanaged secrets
An AWS key in a .env, a private key on disk, a token in a config file. The agent finds them — and Reeve queues each one to vault and rotate.
/ shadow ai
Shadow AI & MCP
Every AI agent and MCP server is a non-human identity with real credentials and scope. NDGM discovers them and governs them like any other identity — owner, least privilege, kill-switch.
Metadata onlyOutbound-onlyDocker or bare VPSReads only what you scope it to
/ 06The platform
four_pillars.no_gapsFour pillars. No gaps.
Govern
Blueprint-driven access reviews with AI-recommended decisions, for humans and machines alike.
Enforce
Rotate credentials and vault secrets automatically — Keeper Secrets Manager integration live today.
Prove
Every decision paired with a checksummed evidence item. One-click auditor-ready packs.
Sovereign
Self-host in your estate. AI on local models. Built and hosted in the UK.
/ 07From our live deployment
customer_zero.metrics7:1
Non-human to human identities found in our live deployment's first sync — 350 NHIs against 48 people.
90d
Fully-automated credential rotation cadence — minted, verified, vaulted, no human in the loop.
<15m
From connecting a source to first automated governance findings.
100%
Of review decisions evidence-backed with SHA-256 checksums.
/ 08Who it's for
teams + mspsBuilt for teams — and the MSPs who serve them.
for security & IT teams
Own your audit. Govern everything.
One live graph for every human, service account and AI agent. Blueprint reviews your auditors accept, enforcement your board expects, deployed in your estate — not someone else's cloud.
for MSPs
Deliver governed identity as a service.
Multi-tenant by design. Bundle governance, PAM and vaulting into one managed offering with margin you own.
Trusted patterns for regulated work: financial services · healthcare · AI platforms · public sector
/ 09Integrations
70+ connectors · 13 categoriesConnect anywhere. Govern everywhere.
Microsoft Entra ID, GitHub and CSV import are live today — 70+ connectors across 13 categories are shipping through 2026.
Microsoft Entra ID LIVEGitHub LIVECSV import LIVE
Identity providersCloud IAMDevOpsHR / HRISSaaSSecurityMonitoringSecrets / PAMInfrastructureITSMCI / CDFinanceMDM
/ 10Security & trust
designed like the systems it governsDesigned like the systems it governs.
Tenant isolation
Row-level security at the database layer — every query scoped to one tenant.
Immutable audit
Every decision creates a SHA-256-checksummed evidence item. Tamper-evident by default.
Self-host option
Run NDGM entirely inside your own estate, including the AI.
UK GDPR
UK-built, UK-hosted, processor terms published. AI is end-to-end encrypted.
/ engage
See NDGM on your estate.
A 30-minute tailored walkthrough. Bring a real cloud account — we'll map it live. No slideware.