267+ Security Validations
We believe in complete transparency about what we check and how we count. Here's the exact breakdown of every security validation we perform.
And always improving — we add new checks as threats evolve
Complete Breakdown
Every number is verifiable. Our check definitions are derived from industry standards and real-world attack patterns we've seen in breach investigations.
Security Assessment Checks
Configuration audits against industry frameworks
App Intelligence Database
Known good and malicious OAuth applications
MITRE ATT&CK Coverage
Threat framework mappings for context
Attack Pattern Detection
Real-time threat detection rules
Built on Industry Standards
Our checks aren't arbitrary — they're derived from authoritative security frameworks trusted by enterprises and government agencies.
CISA SCuBA
Secure Cloud Business Applications
Federal security baselines for M365
CIS Benchmarks
Center for Internet Security
Microsoft 365 Foundations v3.1.0
NIST 800-53
Security & Privacy Controls
Mapped for compliance reporting
MITRE ATT&CK
Adversary Tactics & Techniques
Cloud-specific threat mappings
Active Threat Detection
Compliance checklists catch misconfigurations. Our threat intelligence catches active attacks and indicators of compromise.
Malicious OAuth App Detection
19 known bad apps in our database
We maintain a database of OAuth applications known to be used in attacks, including consent phishing tools and BEC malware.
Known Good App Whitelist
44 verified safe applications
Reduces false positives by recognizing legitimate enterprise applications so you can focus on truly suspicious activity.
Custom Attack Patterns
Proprietary detection from real breaches
Detection rules developed from our incident response work, catching attacks that compliance checklists miss.
MITRE ATT&CK Mapping
Industry-standard threat framework
Every finding is mapped to MITRE ATT&CK techniques, giving security teams context for prioritization.
Our Transparency Commitment
Unlike competitors who inflate their check counts with vague marketing, we publish exactly what we check and how we count. Every number on this page is derived directly from our codebase. When we improve, we update this page.