01 — What is 8Layers?
8Layers is the integrated platform for securing the modern identity lifecycle and automating regulatory compliance.
By unifying Identity Security Posture Management (ISPM) and Identity Threat Detection and Response (ITDR) with Continuous Compliance Validation, 8Layers allows organizations to proactively reduce their attack surface, detect and respond to identity threats, and maintain a state of constant audit readiness.
The objective is simple: Secure your identities, detect threats, and prove it 24/7.
The Problem We Solve
Identity is the new perimeter, and it's the least protected one. Endpoints have EDR. Networks have NDR. But the credentials, sessions, service accounts, and OAuth apps that hold the keys to everything remain a blind spot.
That blind spot is exactly where attackers operate. They don't break in; they log in, then move slowly: a credential stolen in January, an escalation in June. Traditional tools usually can't connect those dots. And while security teams chase fragments, compliance teams scramble to prove controls they can't continuously verify.
The Three-Module Architecture
8Layers delivers value through three integrated modules that share a common data plane:
- Octagon — Active Identity Security. The engine for security posture and remediation (ISPM).
- Thor — Identity Threat Detection and Response. The engine for detection, investigation, and containment (ITDR).
- Compass — Continuous Compliance. The engine for audit readiness and governance.
02 — Octagon
Active Identity Security. The Engine for Security Posture & Remediation.
Octagon is an ISPM platform that inventories every human and non-human identity across all your IdPs, including AI agents. It continuously scores risk, prioritizes exposures, and remediates them directly from the console, with a full audit trail for every decision.
Octagon addresses the security incident response lifecycle from the standpoint of preparation. It unifies IASM (Attack Surface Management) and CAASM (Continuous Monitoring) to detect and fix risks before they can be exploited.
Features:
- 360° Identity Visibility: Consolidates all Human and Non-Human Identities (NHI) from IdPs including Okta, Google Workspace, Microsoft Entra ID, AWS IAM and AWS Identity Center. It enriches every profile with AI-driven tags, roles, and permissions context including third-party OAuth apps, tokens and scopes. Full Multi-IdP support aggregates identities across multiple tenants and subsidiaries into a single source of truth.
- Continuous Risk Detection: Calculates a dynamic Risk Score (1-100) for every identity and the organization as a whole. It automatically detects misconfigurations, dormant accounts, and excessive privileges using Out-of-the-Box (OOB) Baselines enriched by continuous baseline evaluation.
- Active Remediation & Tracking: Turn observation into immediate action. Eliminate security findings instantly with "One-Click" Remediations. For complex scenarios, the platform empowers response analysts with prescriptive, step-by-step guides.
- Containment Actions: Stop attacks in their tracks — blocking users, terminating sessions, and resetting credentials — without ever leaving the console. For Non-Human Identities, containment actions are tailored by subtype.
- Posture Reporting: Generate comprehensive, AI-assisted posture reports summarizing identity risk exposure, baseline compliance status, and remediation progress. A dedicated report viewer offers Summary and Actions reports with full run history; reports generate automatically, can be scheduled per organization (incremental or extensive), and are delivered straight to your notification channels (Email, Jira).
03 — Thor
Identity Threat Detection and Response. The Engine for Detection, Investigation & Containment.
Thor is a real-time ITDR platform that detects identity threats across your full activity history. When a threat fires, it delivers a full timeline, a causality graph, and direct response actions.
Thor addresses the security incident response lifecycle from the standpoint of detection and response. It equips analysts with a unified workspace to hunt, detect, investigate, and contain identity-based threats.
Features:
- Detection Engine: A growing library of OOB detections, each mapped to MITRE ATT&CK, covering the full identity kill chain: brute force, credential abuse, session hijacking, impossible travel, privilege escalation, publicly exposed files, and protocol anomalies. Grouped detections automatically cluster correlated signals into consolidated alerts, while custom rules and exclusion lists let analysts express complex multi-stage conditions.
- Alert Triage & Lifecycle: Structured alert workflows — assign, investigate, escalate, and close — with full audit trails, alert activity feeds, watchers, inline commenting, AI-powered alert enrichment, and ticketing to Jira / ServiceNow.
- Automated Response: Detection rules can trigger immediate containment actions — suspend user, revoke sessions, reset credentials, or total isolation.
- Activity, Investigation & Hunt: A visual activity timeline and identity graph (nodes, edges, events, remediation, role/group/token context) for reconstructing attack paths, plus Threat Hunting with the IQL query language (filter by integration, actor, geolocation) and aggregation.
- Identity Inventory & Search: A unified inventory (Registry) of every identity and entity — including applications, roles, groups, devices, files and IPs — queryable with natural-language search and saved searches for fast investigation and reporting.
- SIEM Integration: Native alert forwarding via HTTP JSON to Splunk, Sentinel, and HEC-compatible platforms.
04 — Compass
Continuous Compliance. The Engine for Audit Readiness & Governance.
Compass maps your controls once against ENS, NIS2, ISO 27001 and SOC 2, validates them continuously, and generates audit-ready evidence automatically. When an auditor arrives, the work is already done.
Features:
- Multi-Framework Mapping: "Test once, comply many." Compass maps technical controls to multiple standards simultaneously (ENS, ISO 27001, NIS2, SOC 2). A single check automatically satisfies requirements across distinct regulations.
- Automated Evidence Collection & Audit Mode: Replaces manual screenshots with automated, timestamped evidence logs. Compass validates technical controls 24/7 and generates exportable reports for auditors instantly, with a dedicated audit mode and AI-assisted report generation for executive-ready documentation.
- Hybrid Governance: Supports both automated checks and Manual Validation Workflows for non-technical requirements (policies, HR reviews), ensuring full coverage of the Identity Protection Framework.
05 — Why Unified? The Platform Advantage.
By running Octagon, Thor, and Compass on a single platform, 8Layers bridges the gap between Security Operations (SecOps) and Governance (GRC):
- Unified Source of Truth: No data discrepancies. The same inventory data used to identify vulnerable identities in Octagon and detect threats in Thor is used to prove compliance in Compass.
- Smart Risk Acceptance (Waivers): A centralized waiver system applies across all modules. If you accept a risk in Octagon, Compass automatically reflects this exception in your compliance report.
- Real-Time Context: Compliance drifts (e.g., "MFA disabled for Admin") instantly surface as actionable findings, allowing teams to fix the root cause rather than just reporting the failure.
Technical Specifications
- Architecture: 100% SaaS, Agentless.
- Deployment: Connects via API in minutes.
- Integrations: Native support for Okta, Google Workspace, Microsoft Entra ID, AWS IAM and AWS Identity Center (Read/Write capabilities; credentials updatable in place).
- Multi-Tenancy (MSSP): Dedicated MSSP portal with per-tenant context and metrics, role-based access control (RBAC), and a management API — operate Octagon, Thor and Compass across multiple tenants.
- Data API: Programmatic access to identities, IdP roles/groups, signals and events, enrichments, tags and containment actions.
- SIEM Integration: Native alert forwarding via HTTP JSON to Splunk, Sentinel, and HEC-compatible platforms.
- Notification Channels: A single place to configure how security alerts are delivered and routed — Email, Jira, Microsoft Teams, ServiceNow, and generic HTTP collectors (webhooks to Torq, Cortex XSOAR and custom endpoints), with a configurable default method.
- Data Model: OCSF-based, ensuring interoperability with SIEMs, data lakes, and third-party platforms.