Toxic Combinations: Data Access Entitlement Risk Simulator (2D)

Access Sprawl

Entitlement breadth 35%

Filter by Sensitivity

Posture

Toxic combinations

Principals remediated

Aggregate risk score

How it works

A DSPM access graph joins two layers: identities (users, service accounts — some holding wildcard/admin grants instead of scoped read access) and data stores (buckets, databases — each with a sensitivity class, an internet-facing flag, and an encryption state). Every line is one entitlement. The outer ring below is the data stores; the inner ring is the identities — drag the graph to rotate it.

risk(store) = sensitivityWeight × exposureMult × accessMult × encryptionMult

sensitivityWeight: Public=1, Internal=2, Confidential=4, Restricted=8
exposureMult      = internet-facing ? 2.5 : 1
accessMult        = 1 + 0.12 × (#principals with access) + (any over-privileged? 1.5 : 0)
encryptionMult    = encrypted ? 0.6 : 1

A store becomes a toxic combination — flagged red and pulsing — only when three conditions converge at once: sensitivity ≥ Confidential, the store is internet-facing, and at least one principal holds an over-privileged (wildcard/admin) grant to it. Any single condition alone is not dangerous; the combination is.

Entitlement breadth — resamples which identities can reach which stores, simulating access sprawl as more grants accumulate over time.
Auto-Remediate — enforces least privilege: it walks the toxic stores and downgrades one over-privileged grant at a time to scoped read, until no toxic combination remains.
Run Entitlement Scan — a fresh audit: regenerates identities, store attributes and the entire access matrix from scratch.

The strip beneath the graph traces the aggregate risk score over time, so a remediation run visibly bends the curve down. This is the access-monitoring pillar of DSPM: discovery and classification tell you sensitive data exists; the entitlement graph tells you who can actually reach it, and from where.

Over-privileged principal Scoped-access principal Toxic combination

drag to rotate

Aggregate risk — trend