Toxic Access Combination Detector

Detection Scope

Sensitivity threshold ≥ 3

Live Risk Engine

Toxic combinations

Total risk score

Datasets in scope

0 / 6

Accounts flagged

Highest risk: —

Accounts Roles Sensitive datasets (color = sensitivity) Toxic combination (live blast path)

How it works

Every account inherits the union of permissions granted by all roles it holds. A toxic combination is the segregation-of-duties violation DSPM/IAM tools flag first: an account that can both read a sensitive dataset and destroy or exfiltrate it (delete or export), so a single compromised credential — not an attack chain — is enough to cause loss.

effective(u,d) = ⋃_{r ∈ roles(u)} perms(r,d)
toxic(u,d)  ⇔ read ∈ effective(u,d) ∧ (delete ∈ effective(u,d) ∨ export ∈ effective(u,d))
severity     = 3·[delete] + 2.5·[export]
risk(u,d)    = sensitivity(d) × severity      if sensitivity(d) ≥ threshold
TotalRisk    = Σ risk(u,d) over all toxic (u,d) pairs

Sensitivity threshold — the engine only scores datasets at or above this classification tier, the same triage real risk-scoring systems use to fight alert fatigue.
Grant redundant role — simulates privilege creep: a second role stacked onto an account that already had safe read-only access, the most common real-world cause of new toxic combinations.
Enforce least privilege — simulates an automated remediation workflow: destructive rights are revoked from every account that also holds read access to the same sensitive dataset, exactly the "toxic combo" fix DSPM remediation engines apply.
Pulsing red paths are the live "blast radius" — a direct account→dataset line traced only for pairs the engine currently classifies as toxic.

Account Role Low-sensitivity data High-sensitivity data

⚠ Couldn't load the 3D engineThree.js failed to load from the CDN. Check your connection and reload.