Cloud Identity Posture Bundle

Most practices do not get to choose which cloud suite a client runs, what fronts it, where the customer data sits, or how the code ships. This is all five posture kits — the same five modules, the same blast-radius bands, each built around its own platform's blind spots — so a mixed estate is assessed with one method rather than five.

M365 Security Posture Kit — licence-tier-aware blast-radius scoring across mailbox, file & collaboration, app consent, identity and detection; a Conditional Access / Entra ID Protection / PIM identity review; a CIS-aligned hardening baseline; data governance and detection readiness.

Google Workspace Security Posture Kit — edition-aware blast-radius scoring across Gmail, Drive & Docs, OAuth / Marketplace and detection; a Context-Aware Access / 2SV / admin-roles identity review; a CIS Google Workspace-aligned baseline; Vault and DLP governance and the Security Investigation Tool readiness matrix.

Okta / Identity Provider Security Posture Kit — the front door in front of both: blast radius across the whole downstream app catalogue, API tokens and third-party integrations weighted as a trust root deserves, a CIS Controls v8 baseline, directory and non-human-identity governance, and an executive page with the downstream footprint.

Salesforce Security Posture Kit — the platform where the 2025–2026 breach wave actually landed, and the kit whose risk model differs: three entry points, with the unauthenticated guest user and the OAuth connected app weighted above the compromised account; a Health Check-aligned baseline; Shield governance; and the one-day-retention detection finding.

GitHub / GitLab Security Posture Kit — the pipeline behind all of it, where the supply-chain incidents needed no compromised identity at all: third-party Actions and elevated-context triggers weighted highest, both CIS benchmarks cited, secrets-in-history governance, the Advanced Security licensing finding, and a dual-audience executive page for the engineering team as well as the board.

Why the set: the Okta kit sees the grant, the suite and CRM kits see what happened after it, and the pipeline kit sees how the code that runs on all of them got there. The full attack chain needs every layer. And the executive summary template in each kit is the same page, so a client gets one board-ready output with five columns rather than five reports that disagree.