529
reports
The research pass that showed the same access-path shape repeating.
About Pathros
Your access risk was never flat.
You built your company through Okta, Entra, AWS, GitHub, Snowflake, service accounts, contractors, CI/CD trust, break-glass roles, and data systems. The danger is not one box. It is the path between them.
Pathros exists for the security teams asked to prove control when their tools hand them noise.
You should not need 4,000 findings to discover the 3 paths that matter.
You should not need three weeks of screenshots to answer one board question.
You should not need to trust a black-box score when the source policy line can be shown.
Identity becomes provable, and the noise goes away.
The page is about you
This is not really a page about us.
It is about the question you carry.
- Which identity can reach production data?
- Which service account still has a path nobody reviewed?
- Which GitHub workflow can assume a role it should not touch?
- Which inherited permission will become obvious only after an incident?
Most identity tools answer with inventory.
Most cloud tools answer with findings.
Most dashboards answer with volume.
You need something quieter and more useful: a path, the evidence behind it, and the expected impact of fixing it.
That is the work Pathros was built for.
Where Pathros began
We studied the system before we named the product.
3
physics textbooks
Where the geometric instinct behind hierarchical access risk came from.
1
surviving thesis
The first durable form of the hierarchy-aware ranking idea.
Pathros began with a refusal to accept the dashboard as reality.
We studied 529 reports and 3 physics textbooks. The pattern kept repeating. Access risk did not behave like a flat checklist. It behaved like a hierarchy.
User to group. Group to role. Role to policy. Policy to resource. Resource to data.
Across cloud, SaaS, CI/CD, and data systems, the shape was the same. The dangerous path was rarely the loudest finding. It was the transitive one. The inherited one. The one hidden behind normal access.
So we built around one thesis:
Pathros turns that thesis into an access-path intelligence engine.
Exact graph reasoning explains every finding. Machine learning ranks and discovers. The source systems remain the truth. Every fix is simulated first.
The doctrine
The doctrine is simple.
Security teams ought to be able to prove control, not guess at it.
1
Every risk has an evidence path.
A finding without evidence is an opinion. Pathros ties each risk back to the identities, policies, roles, grants, and trust relationships that created it.
2
Every evidence path has provenance.
You see where the data came from. Okta. Entra. AWS IAM. GitHub. Snowflake. No mystery layer.
3
Exact graph reasoning explains.
The graph is not decoration. It is the structure of the environment. Pathros uses it to show how access actually travels.
4
Machine learning ranks and discovers.
The model does not replace proof. It helps surface the paths most likely to matter inside a hierarchy too large to inspect by hand.
5
Every recommendation shows expected impact.
Before a permission changes, you see what breaks, what remains reachable, and what risk is removed.
6
Read-only by default.
Pathros does not write to your environment without explicit approval. No irreversible automation. No blind fixes.
Who Pathros is for
Built for the people who have to answer.
Board receipt
For the CISO
You walk into the board meeting with more than a risk score.
You bring a one-page provenance receipt that shows which access paths mattered, what changed, what the change prevented, and why the company is safer now.
Not vibes. Not vendor language. Evidence.
Policy diff
For the IAM Security Architect
You get a graph you can interrogate.
You see the identity, the trust relationship, the effective permission, and the downstream data system. You see the diff before the fix. You keep control.
No black box. No one-click gamble. No dashboard pretending that volume is clarity.
Incident queue
For the team on call
You get the next thing to look at.
Not 4,000 critical findings. Not another Monday morning export.
The three or four paths with real blast radius, ranked and explained.
What we refuse to become
Restraint is part of the product.
Pathros is early. We will say that plainly.
Pathros does not claim production connector coverage today. In this stage, there will be edges to sharpen, connectors to harden, workflows to improve, and cases the system must learn from. That is not a weakness if it is handled with discipline.
The real danger is not being early.
The danger is pretending certainty where there is none.
So we will keep the constraint visible:
- Pathros does not hide a guess behind the word AI.
- Pathros does not call an alert useful until it has an evidence path.
- Pathros does not remediate what it cannot simulate.
- Pathros begins read-only. No write happens without explicit approval.
- Pathros does not make itself the hero of your security story.
You are the one responsible for the company.
You are the one who has to answer.
Pathros exists to help you answer with proof.
From the founder
A note from Dominic
To the security leader reading this,
I do not think a company earns trust by speaking loudly about itself.
A company earns trust by becoming useful before it asks to be believed.
Pathros began from a simple frustration: serious people were being asked to stake their names on guesses. A CISO would be asked, Are we exposed? An architect would be handed thousands of findings. Somewhere inside the noise there might be one path that could reach production data. But the system did not show it plainly.
That felt wrong.
Security should not depend on a lucky search through a dashboard. Identity should be explainable. Access should be traced. A recommendation should show what it will change before it changes anything.
We are early, and I will not pretend otherwise. Some parts of Pathros will need sharpening. The work ahead is real. But the principle is already settled: every risk should have evidence, every fix should be simulated first, and every customer should leave with more control than they came with.
That is why Pathros exists.
Not to replace your judgment. To give your judgment the proof it deserves.
Dominic
Founder, Pathros
What happens next
A small first step is enough.
-
1
Connect read-only
Connect Pathros read-only to your identity and cloud systems. No writes.
-
2
See the access graph
See the access graph across Okta or Entra, AWS IAM, GitHub, and your data systems.
-
3
Review the highest-blast-radius paths
Review the three or four paths with the highest blast radius.
-
4
Simulate least-privilege fixes
Simulate least-privilege fixes before anything changes.
-
5
Export provenance receipts
Export provenance receipts your team can use for audit, board review, and remediation tracking.
You do not need another dashboard.
You need the path, the proof, and the calm to act.