Convoy
Sign in Start free
PostureObserveExposure proof

Every way in. The fewest fixes.

Posture is not a score. It's a live map of every way an attacker could get from an entry point to a crown jewel, kept current from your own data. You see the fewest fixes that close every path, how likely each path is, and which fixes the platform can apply itself.

Start free · 14 daysSimulate the plan
Collapse plan

3 fixes close all 7 breach paths.

F-1 Phishing-resistant MFA on the legacy portal · 2h · the platform can apply
F-2 Strip domain admin from SVC-11 · 30m · the platform can apply
F-3 Restrict WinRM to jump hosts · 1d · IT infra

Crown jewels in reach 3 → 0 · about 1.5 days

Try it live

Seven breach paths. Pick the fixes. Watch them close.

Every path here comes from the current map. Tick a fix and watch the paths close and the crown jewels drop out of reach. The platform can apply two of the three fixes in the plan itself.

PostureLarkspur Group
7Open breach paths
3Crown jewels in reach
72%Controls proven
3Fixes to zero paths

Collapse plan · 3 fixes close 7 of 7 paths

Enforce phishing-resistant MFA on the legacy admin portal

2h · the platform can apply
closes 3

Strip domain admin from SVC-11

30m · the platform can apply
closes 3

Restrict WinRM to jump hosts and enable telemetry

1d · IT infra
closes 2

Crown jewels in reach: finance · IdP · payments. About 1.5 days of work, 2 fixes by the platform.

Observe · Posture
Search across assets, identities, rules…⌘K
Convoy platform nominalUTC {{ utc }}Local {{ loc }}Tick T+0000
LG
Active tenantLarkspur Group1 act now· 1 decide todayRisk 27/100 · Guarded
SectorHealthcareRegionNAAssets2,746
Switch tenant⌘O
Posture · exposure proofKept current from your own data.{{ liveTxt }}
Open breach paths
7→{{ openN }}7
4 entries → 3 crown jewels
Crown jewels in reach
3→{{ jewels }}3
Finance · IdP · payments
Controls proven
72%
67 of 93 · 16 untested
Fixes to zero paths
3
About 1.5 days · 2 by the platform
Breach path mapNumber = open paths through node
ENTRY POINTFOOTHOLD GAPESCALATION GAPCROWN JEWELVPN concentratorUNPATCHED FIRMWARE{{ ncount_e1 }}Phishable identities214 USERS · PUSH MFA ONLY{{ ncount_e2 }}Vendor remote laneSHARED CREDENTIAL · 3 VENDORS{{ ncount_e3 }}Leaked CI tokenPUBLIC REPO · EXPOSED 6D{{ ncount_e4 }}Legacy admin portalNO MFA ENFORCED{{ ncount_g1 }}Flat networkVLAN 40 ↔ FINANCE{{ ncount_g2 }}Unmonitored WinRMNO LATERAL TELEMETRY{{ ncount_g3 }}Privileged svc acctSVC-11 · DOMAIN ADMIN{{ ncount_g4 }}Stale admin tokens41 TOKENS > 90D{{ ncount_g5 }}Agent write scopeA0147 · PAYMENTS:WRITE{{ ncount_g6 }}Finance databaseFIN-DB-03{{ ncount_t1 }}Identity providerIDP-02{{ ncount_t2 }}Payments railWIRE APPROVAL FLOW{{ ncount_t3 }}
{{ selTitle }}{{ selBody }}
Collapse planFewest fixes · most paths

{{ planN }} fixes close {{ planCloses }} of 7 breach paths.

Handed off · 2 to the platform · 1 approval requested
Enforce phishing-resistant MFA on the legacy admin portal
F-12hThe platform can applyRecommended
closes 3
Strip domain admin from SVC-11
F-230mThe platform can applyRecommended
closes 3
Restrict WinRM to jump hosts and enable telemetry
F-31dIT infraRecommended
closes 2
Segment VLAN 40 from the finance subnet
F-43dNetwork eng
closes 2
Patch the VPN-01 firmware
F-54hIT infra
closes 2
Remove payments:write from agent A0147
F-610mThe platform can apply
closes 2
Control proof67 of 93 proven · 7d
ProvenDriftedNever testedFailed
Identity
14/20
Endpoint
22/25
Email
9/10
Cloud
11/18
Network
6/12
Data
5/8
Path drift · 30dWhy posture changed
840
Day 9
Vendor remote lane onboarded with a shared credential
+2 pathsBP-05 · BP-06
Day 15
Mail server CVE patched, webmail path closed
−1 pathBP-00
Day 21
CI token committed to a public repository
+1 pathBP-07
Day 26
SVC-11 granted domain admin during a migration
+2 pathsBP-01 · BP-04
Now do it on your own tenant {{ stepHint }}

How it works

The platform never stops thinking like an attacker.

It starts at the entry points your data shows (an unpatched VPN, push-only MFA, a vendor lane on a shared credential, a token in a public repo), follows the foothold an attacker would take and the gap that lets them escalate, and stops at a crown jewel. What comes out is a list of paths, each with a likelihood and the one fix that cuts it.

Breach paths

Entry → foothold → escalation → crown jewel.

Four columns, every open path drawn between them, a number on each node for how many paths run through it. Start with the node the most paths run through.

Collapse plan

The fewest fixes that close the most paths.

Posture ranks fixes by paths closed per hour of effort and tells you which it can apply itself. Simulate the plan before you commit and watch the open count and the crown jewels in reach move.

Likelihood

The most likely way in gets fixed first.

Every path carries a likelihood, and every crown jewel shows how many paths still reach it. Close a path and the count drops on the same screen.

Control proof

Proven, drifted, never tested, failed.

Ninety-three controls across identity, endpoint, email, cloud, network and data, each one checked against evidence rather than assumed. The weakest control per domain is named: a DMARC policy still set to monitor only, tamper protection drifted on three hosts.

Find the fewest fixes that close your breach paths.

14 days on your own sources. Your breach paths and the fewest fixes that close them, always current.

Start free · 14 daysBook a briefing