How Normos Works

Identifies user accounts operating without multi-factor authentication. Covers all account types including administrative and developer accounts.

Identifies user accounts that have not been active within your defined window. Dormant accounts are a persistent attack vector — they retain access but receive no security scrutiny.

Detects service accounts that are misconfigured or operating outside your defined service account policy. Distinguishes between human and non-human identities.

Measures the proportion of commits reaching your main branch via an approved pull request process. Identifies direct pushes and unreviewed merges.

Detects events where branch protection rules were bypassed — including administrator overrides, forced pushes, and protection rule modifications.

Verifies that pull request approvals are granted by reviewers independent of the code author. Detects self-approval patterns and insufficient reviewer separation.

Validates that commits merging to protected branches carry the required approval signatures. Identifies commits that bypassed the approval gate.

Scans for credential patterns, API keys, tokens, and other secrets committed to your repositories. Covers current state and detects patterns indicative of historical exposure.

Audits the configuration of branch protection rules across your repositories. Identifies repositories with missing, weakened, or misconfigured protection settings.

Identifies review patterns where the same individuals consistently review each other's code, creating a closed loop that compromises the independence of the review process.

Verifies that data stores and volumes have encryption at rest enabled and correctly configured. Identifies unencrypted resources across your connected infrastructure.

Identifies IAM policies and role bindings that use wildcard permissions, granting broader access than intended or required by the principle of least privilege.

Audits whether logging and audit trails are enabled across your connected systems. Identifies resources where logging has been disabled or was never configured.

Detects resources that are unintentionally exposed to the public internet. Covers storage buckets, databases, APIs, and compute resources with unrestricted public access.

Identifies network security groups and firewall rules with overly permissive ingress or egress rules — including unrestricted 0.0.0.0/0 rules on sensitive ports.

Detects organisations with more owner-level accounts than the policy maximum. Organisation owners have unrestricted access to all repositories, settings, and billing.

Identifies outside collaborators with write or admin access to repositories. Outside collaborators bypass normal organisation membership controls and are a consistent audit finding.

Detects teams with admin-level permissions on repositories where write access is sufficient. Team admin grants all members the ability to override branch protection and modify repository settings.

Identifies repositories with more admin-level collaborators than the policy maximum. Repository admins can override branch protection and all access controls.

Identifies GitHub Actions workflows that reference actions by mutable tag (e.g. @v4) rather than an immutable commit SHA. Mutable tags can be silently redirected to malicious code.

Detects GitHub Actions from publishers who have not completed GitHub's verified creator programme. Unverified publishers have not been subject to GitHub's identity and security review.

Surfaces open GitHub Secret Scanning alerts — detected credentials that have not been remediated. Operates in zero-footprint mode: no credential values are read or stored, only alert metadata.

Identifies vendors whose SOC 2, ISO 27001, or other compliance reports have passed their validity period. Tracks report expiry across your entire vendor population.

Analyses vendor compliance reports for disclosed material weaknesses, exceptions, and qualified opinions. Surfaces adverse findings that require your attention and response.

Identifies vendors in scope for your compliance programme who have not provided current compliance evidence. Surfaces gaps in your third-party assurance coverage.

Monitors the age and relevance of vendor compliance evidence on a continuous basis. Identifies evidence that is technically within its validity period but approaching staleness — before it expires.