Mapping the SaaS Attack Surface: An Open-Source Identity Graph and Change-Detection Engine

Most companies I've worked with can name maybe half their SaaS apps from memory, and almost none can tell you who holds admin across all of them. Access is scattered across identity providers, groups, roles, and the third-party OAuth apps that quietly hold access, each in its own admin console. Kestrel is an open-source project I'm building that pulls users, groups, roles, permissions, resources, and OAuth grants out of each SaaS app and stitches them into one normalized identity graph, showing who has access to what and how it's all connected. Detections are plain Python policies you can read, test, and version in git, and every finding traces back to the raw data behind it. In this session I'll explain how it's built, demo it against test tenants, show the read-only connector framework for Okta, GitHub, Slack, and Google Workspace, and walk through the architecture tradeoffs (including the parts I got wrong the first time).