Continuous security posture management across Active Directory, Microsoft 365, Azure, AWS, FortiGate and more.
SSO, RBAC, and full audit trails
Per-tenant database isolation, never pooled
Read-only collection, AES-256 encrypted
MSSP multi-tenancy built in
Cloud, identity and network configuration each have their own tool and their own idea of what "fixed" means. Retrievy audits all three from one read-only connection and scores them on one scale.
Cloud estates grow faster than anyone can review them, and the account nobody owns is the one that leaks. Retrievy connects AWS, Azure, GCP, OCI, and Cloudflare read-only, inventories what is actually running, and ranks the misconfigurations by the exposure they create.
Explore CSPMRulebases outlive the people who wrote them. Policy X-Ray reads the running FortiGate configuration and shows where inspection is switched off, which rules are shadowed or unused, and what else breaks if you remove one.
Explore X-RayPosture is hard to report because every tool counts differently. The Retrievy Score consolidates cloud, identity, and network into one measure that moves only when risk is actually removed, and every point of it traces back to the findings behind it.
Risk-accepted and pending-verification findings are excluded by design, so the number cannot be improved by closing tickets.
Privilege accumulates through group nesting, delegation, and Group Policy nobody has opened in years. Retrievy resolves effective permissions across Active Directory and Entra ID, then names the accounts behind every path to Tier Zero.
Explore ISPMA list of a thousand findings is not a plan. The Hardening Kanban gives each one an owner, a documented fix, and evidence, and marks it resolved only after a later scan confirms the change.
Every finding carries its mapping to CIS, NIST CSF, ISO 27001, PCI DSS, MITRE ATT&CK, SOC 2, HIPAA, and FedRAMP. Control coverage becomes a report you export, not a project you run each quarter.
Connect one Data Source and run a scan. The first results arrive in minutes, on your environment, with nothing to install in production.
Connections are read-only and use each provider's own audit interfaces. Nothing sits in the traffic path, and a Data Source can be disconnected at any time.
Domain, OU, and Group Policy configuration, with effective permissions resolved.
Directory roles, conditional access, MFA coverage, and privileged assignments.
Tenant security settings, sharing defaults, and admin role exposure.
Host configuration measured against the CIS Windows benchmarks.
Full running configuration, policy inspection coverage, and rule hygiene.
Subscriptions, IAM assignments, network exposure, and storage posture.
Accounts and organizations, IAM, public exposure, logging, and encryption.
Projects, service accounts, and network and storage configuration.
Compartments, identity policies, and tenancy-level hardening checks.
Zone, DNS, and account security settings across your properties.
Findings from every connection land in the same workspace and the same score, so a firewall rule and an over-privileged directory account are ranked against each other rather than in separate reports.
The team that finds a misconfiguration is rarely the team that fixes it. Retrievy gives each of them the same evidence, scoped to what they are allowed to see.
Findings arrive ranked by severity and real exposure, mapped to MITRE ATT&CK, and grouped so one change closes many. The queue is short enough to work through, and it stays short because closure is verified by the next scan.
Keep Active Directory, Group Policy, and Windows Server inside a known-good baseline. When something moves off it, you see which policy changed, which objects it reaches, and when the drift started.
Every new account, subscription, project, or landing zone is audited against CIS and NIST from its first scan, so a shortcut taken during a launch is caught while it is still a setting and not yet an architecture.
Evidence is collected continuously instead of assembled the week before an audit. Control coverage across CIS, NIST CSF, ISO 27001, PCI DSS, and SOC 2 is a report you export, with the finding behind each control attached.
One workspace across on-premises and cloud, with single sign-on, role-based access, and an audit trail of who changed what. Roles can be limited to named Data Sources, so a regional team sees its own estate and nothing else.
Run every customer from one platform, each in its own database rather than a shared table with a tenant column. Scope analysts per client, and hand over reports that carry the customer's posture and not your other accounts.
Retrievy connects read-only to your cloud accounts, Active Directory, Microsoft 365 and firewalls, audits them on a schedule you set, and ranks every finding by the exposure it creates. Six things move once it is running.
Public storage, permissive firewall rules, unused policies, and stale accounts are the paths that get used. Retrievy lists each one with the exposure it creates, so the work goes where an attacker would actually go.
Shadow administrators, nested privilege, delegation nobody remembers granting, and accounts without MFA. Every gap is reported with the identities behind it, so it lands on a person rather than on a counter.
Evidence is collected continuously instead of assembled the week before an audit. Findings carry their framework mappings, exceptions carry a reason and an owner, and the whole picture exports as an executive or technical report.
Every scan is compared against the last. You see what changed, which objects or accounts it reaches, and when it started, which is usually the difference between a five-minute rollback and a week of archaeology.
Scans run on the schedule you set, not when somebody remembers. New findings raise an alert, the score moves only when risk does, and a daily snapshot keeps the trend honest over months rather than over one screenshot.
Every finding ships with the fix for the exact platform it was found on, an owner, and a verification step, so the gap between detection and closure is measured instead of assumed.
Research, methodology, and framework references from the team building the platform. Written for the people who have to implement the control.
View all insights
A numbered operator playbook for hardening FortiGate firewalls, covering admin surface reduction, TLS hygiene, policy cleanup, logging, and how to verify each step without breaking production.
AD operators running Active Directory Certificate Services need more than default logging to catch template abuse. This guide maps the critical Event IDs, shows how to aggregate CA logs, and gives detection rules you can deploy today.
FortiGate configurations accumulate unused address objects for years, creating policy noise and audit risk. This checklist walks operators through identifying zero-reference objects, safely purging them, and preventing future bloat.
Source evidence, severity, framework mapping, exceptions, and what closes a finding.
CIS Benchmarks, NIST CSF, and the boundary between mapping a control and certifying it.
Per-tenant databases, read-only collection, credential handling, and retention.
The questions that come up most during an evaluation, answered without a sales call. Anything not covered here, ask us directly.
The trial runs the full platform against your own environment, read-only, with no agent in the data path and no card required. If you stop there, the report is still yours.
Questions before you start? Talk to us.