AI safety starts with access
Make access make sense.
AI changed what access means. Copilots and agents read everything your permissions allow, and phishing written by AI means any account can turn hostile overnight. 1Security maps every identity in Microsoft 365 - human, app, AI agent, device - what it can reach, what it actually did, and fixes what shouldn't be there. Live, on the licenses you already own.
Read-only consent · connected before lunch
Why this exists
The era thesis
AI didn't create new risk. It switched yours on.
Copilots and agents read everything your permissions allow. A phished account is now an attacker with a copilot. Every overshared file and forgotten grant that sat harmless for a decade is one prompt away - blast radius is the whole game now.
Read the thesis →What you get
Everything your tenant does, one living graph.
Five branches, every identity and every path to your data. Pick a branch - each capability below is a screen, not a slide.
- Users
- Groups
- Devices - registered, unregistered, shadow
- Locations as identities
- Sign-in posture
The data moat
The deepest map of a Microsoft 365 tenant.
Not an export. A living graph of identities, permissions and actions - kept current in real time, remembered for years.
- 1B+files scanned
- 100k+users scanned
- Every typefiles, sites, users, groups, apps, agents, devices, email
- 3 yearsof activity memory on standard licenses
Signal nobody else has
Access data built from live activity, not only the directory.
A directory tells you what was declared. 1Security adds what actually happens, reconstructed from live activity:
Shadow devices
Machines touching your data with no observed sign-in at all - the signature of a stolen token, discovered from activity alongside your Intune enrollment.
Locations as identities
Country, city and network for every action, with Microsoft's own datacenter noise labelled out - so a foreign origin finally means something.
Agent reach, resolved
What each AI agent can actually get to - files, sites, users, mailboxes - resolved from knowledge sources, not assumed from a manifest.
The paths nobody drew
The unexpected route to a file - a guest, in a group, that inherits a folder - reconstructed hop by hop and drawn as a graph you follow with a finger, not a report you reverse-engineer.
Evidence of deletion
Email threads with missing parents - the quiet signal that someone cleaned up after themselves.
Built for action
From found to fixed - in the same screen.
Every security product leaves a gap between the finding and the fix. 1Security closes it in three moves:
- 01
Map
Every identity, permission and path to data - the full graph, from tenant-wide down to one file's "why".
- 02
Watch
Real-time evaluation, a learned normal for every identity, and an alert line you position - recorded even when it isn't shouting.
- 03
Fix
Automations that count what they'd fix before you enable them, stage proposals behind a grace period, and keep a review ledger.
Everything that writes is opt-in. The platform runs read-only until you deliberately consent to remediation - and even then, a review window can hold every action for human approval.
Why 1Security
Classification tells you what's sensitive. It can't tell you what can reach it.
A scanner can find every file holding credit card numbers. It cannot tell you which copilot can read them, which agent grounds on their site, which sharing link exposes them - and it cannot make them unreachable, or prove that you did. Four rungs; most data security tools stop on the first.
- 01
Classify
Know which files hold sensitive data. Where classification-first tools stop: they read files, not permissions - so the finding arrives with no way to act on it.
- 02
Map reach
Who and what can reach it: permissions, inheritance, sharing links, app grants - and the surface only 1Security models, from agent grounding to the reach every agent inherits from its maker.
- 03
Control reach
Declare a data category off-limits - to AI, or to everyone. Watch violations live, per channel, and stage the fix through the right lever, with a human approving every action.
- 04
Prove it
Evidence a regulator can read: restricted since when, violations found, time to remediation, exposure today - mapped to the EU AI Act, NIS2 and ISO 42001.
AI safety, demonstrated
Declare it. Watch it. Prove it.
Pick a data category - credit card numbers, source code, board papers - and declare it off-limits to AI. From that moment, the declaration is a fact your tenant is measured against.
- 01
Declare
One declaration - "unreachable by AI" or "unreachable by anyone" - recorded with who declared it, when, and the exposure it found.
- 02
Watch
Every agent, app and person that can still reach the category, live, channel by channel - each one an open violation with a staged fix behind your review.
- 03
Prove
The record a regulator can read: restricted since when, violations found, time to remediation, exposure today - down to the file.
Credit card numbers · restricted 3 March · 14 violations found · fixed in 6 days · exposure today: zero
Honest by design: a restriction is declared and watched from day one, and every fix is staged behind a review a human approves - nothing silently rewrites your tenant.
See what your copilots can reach →Major use cases
The questions you'll answer this week.
Each one used to be a project. Each card carries its own number.
- 12h → 10min
"Was this a breach?"
Chart the exact blast radius of a compromised account - which files, which sessions, from where.
See the replay → - Counted before rollout
"What can Copilot see?"
Know what every agent and assistant can reach before you switch it on - not at the incident review.
Count your agents → - Evidence drawn live
"Are we audit-ready?"
NIS2, ISO 27001, SOC 2 - reporting straight from the live permission and activity map, never stale.
See board reporting → - Ranked from day one
"Where's the waste?"
Dormant licenses, abandoned apps, orphaned sites - every cost line ranked and reclaimable.
Find the waste →
Proof
Trusted by security teams that measured the difference.
- 20×
faster access reviews
From a quarterly spreadsheet ritual to a filtered live view.
- 95%
less time on manual audits
Evidence assembled from the live map instead of screenshots.
- 8×
quicker investigations
Every event arrives connected - the anomaly, the device, the location, the sessions around it, every resource touched. The whole interconnected map in one intuitive view, not twelve log queries.
How it feels
Security tools ask for trust. This one shows its work.
No black boxes
Every detection is explainable: what normal was, how far today strayed, the line it crossed - and the line is yours to move, with history re-classified the moment you do.
Busywork automated - with receipts
The chasing, clicking and cleanup runs itself behind a review queue, and every action lands in a ledger you can replay. Your time goes to protecting, not administering.
Peace of mind, not noise
Everything is recorded even when nothing is shouting - so quiet means safe, not blind. And when something does matter, it arrives as one clear story.
What it takes to try: almost nothing.
- Standard Microsoft 365 licenses - no premium add-on required
- Read-only until you opt in to write
- First scan results the same day
- ISO 27001 · GDPR · European data centers
Get your answer today.
Connect read-only in the morning. By the afternoon, "who has access to what?" has an answer - for the first time.
No thanks - nobody's asked yet.