Identity Security
Identity Folding™: How We Solved the Million-Edge Problem
How we solved the million-edge problem in identity security graphs.
Editor's note, October 2026: Identity Loom, the single graph across on-prem AD, Entra ID and SaaS applications, is planned and not yet available.
Take a 10,000-user environment. On-prem AD, Entra ID, or both. It doesn't matter. Count the individual permission entries. Every ACE, every role assignment, every delegated right, every OAuth grant. You are looking at millions of individual permission edges across your identity infrastructure. Try to visualize that as a graph. Try to run a risk query against it. Try to get a meaningful risk count out of it. You can't. So we built something new.
The Problem with Raw Permissions
Active Directory stores permissions as individual ACEs. Entra ID adds role assignments and OAuth grants. A typical enterprise with 10,000 identities can easily have 5-10 million individual permission edges across both platforms. When you try to build a graph from that raw data, two things break: the graph becomes unreadable, and the risk counts become meaningless. Dangerous permissions like WriteDACL or Global Administrator get buried under the sheer volume of benign entries.
Most tools deal with this in one of two ways. They show you the raw firehose: millions of edges, good luck finding the real threats. Or they collapse everything into abstract risk scores that strip out the detail you need to actually fix anything. Neither works.
We needed a third option. Reduce the noise without losing the signal.
What Identity Folding Does
Identity Folding consolidates all individual permission entries between the same two identities into a single composite edge. The individual ACEs are preserved inside the edge as structured data. Nothing is lost. The graph goes from millions of edges to a clear picture of who can do what to whom.
The consolidation is severity-aware. Every permission type is assigned a severity tier derived from real-world attack research: Critical for full-control permissions like GenericAll and DCSync, High for escalation primitives like ForceChangePassword, and so on through Medium and Low. The composite edge inherits the severity of its most dangerous permission. The result: 60-80% fewer edges in the graph with zero loss of security-relevant detail.
Identity Loom™: One Graph Across Environments
Edge consolidation solved the volume problem inside a single directory. It did not solve the cross-platform problem. The same user exists in on-prem AD, Entra ID, and multiple SaaS applications. Different permission models. Different identity objects. All the same person. Some tools can show cross-platform attack paths, but the edges from each source still use different models and scoring. The consolidation and weighting need to work the same way regardless of where the permission came from.
Identity Loom normalizes permissions from on-prem AD, cloud Entra ID, and SaaS applications into a single unified graph. Same user, same node, every permission source stitched together. You see what each identity can actually do across your entire environment. Not fragments. Not platform snapshots. The whole picture.
Access Gravity™: Risk by Weight, Not by Count
Even with consolidated edges, permission counting is still broken if every edge is treated equally. A user with hundreds of benign permission entries can rank higher than a user with WriteDACL on Domain Admins, simply because the count is larger. That math is wrong.
Access Gravity assigns severity weights based on what attackers actually do with each permission type. Permissions that enable direct privilege escalation carry heavy weights. When Identity Folding consolidates edges, Access Gravity computes a composite risk score from the underlying permissions. The most dangerous relationships surface first. Not buried under volume. At the top of the list where they belong.
What This Gets You
The result is a graph that is accurate enough to trust and small enough to act on. That is what we set out to build, and we think it changes what security teams can expect from their identity tools.
We filed a second patent to protect this work. It complements our first filing, which covers Tiered Fidelity and safe remediation. Two patents, one goal: close the gap between finding a risk and fixing it.