Sabiki AIRM
Free NHI Risk Score
Non-human identity security · Microsoft 365

The control plane for every non-human identity in Microsoft 365.

AI agents, Copilots and service principals now outnumber your people. AIRM (Agentic Identity Risk Management) discovers, scores and governs every one.

Purpose-built for Microsoft Entra, Microsoft 365, Copilot and AI agents. It puts the administrator back in control of AI agent sprawl, with the evidence to prove it. Start with a free Sabiki NHI Risk Score™ on any tenant.

Get your free Sabiki NHI Risk Score →See the platform
5 minutesMicrosoft 365No credit card
Questions first? Book 30 minutes →
Blast radius
CRITICAL
Sabiki NHI Risk Score
Needs attention
Blast radius: Critical
Northwind Trading
Last scan 13 Jul 10:01
Identities foundAI apps, service accounts, connectors
431
Need reviewNot approved, or nobody owns them
419
↓
AIRM sorts themBy publisher trust, permission reach and ownership
Need a humanCan change your data, or nobody owns them
8
Routine, approve togetherTrusted publisher, owned, limited reach
411
EU AI Act
Art. 14, Oversight
Demo tenant. Real product, real scan, names changed.
Why you should care

AI agents are becoming your newest employees. Nobody hired them.

They never sleep, never ask permission, never resign. They are non-human identities, logins with no person behind them, and no one owns them.

In a typical Microsoft 365 tenant, non-human identities already outnumber people, and AI is minting more every week.
1 human to ~45 non-human identities
Human usersNon-human identities (service accounts, OAuth apps, workload IDs)AI agents & copilots: the new, fastest-growing slice
Machine-to-human identity ratio approximately 45:1 (Gartner). Service accounts, OAuth apps and workload identities already dominate; AI agents and copilots are the newest and fastest-growing part, and the one almost no tenant governs today.

Shadow AI Agents

Copilot connectors, Power Automate flows, and third-party AI tools operate continuously with permissions nobody reviews. If compromised, the damage is catastrophic.

Why non-human identity →

Unmanaged Credentials

Service principals accumulate over time with aged credentials, no owners, and permissions far beyond what they need. A quiet app with write access to your entire tenant.

What NHI security is →

Invisible Compliance Risk

EU AI Act, DORA, ISO 42001: regulators are asking who owns the non-human identities in your tenant, and what your AI agents can reach. Most organisations can't answer those questions yet.

The 11 frameworks →

If one of them is compromised, it already has standing access to your mail, your files and your data.

Machine-to-human identity ratio ~45:1 (Gartner analyst estimate); some vendor telemetry runs higher (Entro Labs, NHI & Secrets Risk Report, H1 2025: up to 144:1). Third-party research cited for context; Sabiki is not affiliated.

Scope, stated plainly

Microsoft Entra manages your people. Sabiki governs everything that isn't one.

Sabiki does not do human identity. We do not touch single sign-on, MFA, conditional access or joiner-mover-leaver. Entra does that, and it does it well. Sabiki governs the non-human identities in the tenant, the service accounts, app registrations, OAuth-connected apps, service principals, connectors, Copilots and AI agents, which now outnumber your people and which no one is watching.

×
Not usHuman identity, SSO, MFA, conditional access, password policy, joiner-mover-leaver. That is Microsoft Entra.
✓
UsEvery identity that isn't a person. Discovered, scored and governed, whichever platform created it.
How it works

Discover. Score. Govern.

One continuous loop on every Microsoft 365 tenant, from the first read-only scan to a score that keeps climbing. See the full Sabiki Adoption Loop →

01 · Discover

Find every one

By behaviour and real Graph permissions, not naming. Nothing hides.
  • Every AI agent, Copilot, service principal and NHI
  • Third-party agents native Microsoft tooling may not classify or surface as AI agents
  • Agentless, read-only via Microsoft Graph
How discovery works →
02 · Score

Know the real risk

One independent 0 to 100 index for the tenant, benchmarked against its peers.
66/100Needs attention
This tenant66
Blast radiusCritical
  • Blast radius: what it could actually reach
  • Ownership, dormancy and over-permissioning
How the score works →
03 · Govern

Take back control

Prioritised fixes, approved by a human, with evidence you can hand over.
  • Guided remediation, ranked by real risk
  • Mapped to 11 governance frameworks
  • Nothing changes without human approval
Govern and comply →
In the product

419 NHIs to review. 8 need a human.

AIRM decides what matters. You decide what happens.

AIRM does the triage before your team ever opens the tenant. It ranks by publisher trust and permission reach, batches the safe ones, and surfaces the handful that actually carry risk. Then it stops, and waits for a person.

Run it with the team you already have. A level one technician can clear a tenant. Your senior person gets pulled in for the eight that matter, not the four hundred that don't.
One tenant, one scan
Identities foundAI apps, service accounts, connectors
431
Need reviewNot approved, or nobody owns them
419
↓
AIRM sorts themBy publisher trust, permission reach and ownership
Need a humanCan change your data, or nobody owns them
8
Routine, approve togetherTrusted publisher, owned, limited reach
411
OperatorDecide what to do
Operator
🔔9A. Chen ▾
431identities

Here's what's running in Northwind Trading

13 AI apps and 421 other identities. 419 need review, not yet approved or ownership not assigned.
AI appsNHIs
These need review 419 not approvedList allGroup
Critical0
Threat-intel matches, or unverified apps that can reach your whole tenant. Act on these first.
Open →
Needs attention8
Apps that can change your data, or that have no accountable owner. Worth reviewing.
Open →
Routine411
Trusted publishers with an owner and limited reach. The safe batch, most operators approve these together.
Approve all 411
Open one of the eight
PP
PnP-Provisioning-SvcUnverifiedMedium risk
Acts for userswrite Groupsread Directoryread UsersOrg-wide consentNo owner
LookOwnerDisableApprove

  • The triage is already done.Sorted by publisher trust, permission reach and whether anyone owns it. The judgement call a security analyst would make, made before your technician logs in.

  • 411 decisions become one click.Trusted publisher, has an owner, limited reach. Batched on purpose, not to save you the reading.

  • The decision is still yours.Look, assign an owner, disable, approve. AIRM recommends. Your administrator decides, and clicks.

Power stays with your team

Nothing moves in your tenant unless a person clicks.

AIRM ranks, groups and recommends. It does not act. The judgement is automated so the decision does not have to be, and the decision belongs to your administrator.

  • Read-only by default.AIRM cannot change a tenant on its own. It reads through Microsoft Graph and reports.

  • Every action is a click a human makes.Approve. Assign an owner. Disable. Four buttons, one person, one accountable decision.

  • Agentless. Revoke at any time.Nothing is installed. Consent can be withdrawn, and AIRM goes dark.

Get your free Sabiki NHI Risk Score → See both views → Both views included · Every tier · Read-only
Northwind Trading is a fictional demo tenant. The product, the scan and the numbers are real. The company and the identity names are not.

Every finding comes with a prioritised action and a mapping to the frameworks your auditors ask about. You decide what gets fixed, and when.

See the full report a client receives → Try the live demo →
Why you can trust it

Built on Microsoft. Evidence you can hand over.

And independent of it. The Sabiki NHI Risk Score is cross-vendor, so it is not Microsoft assessing Microsoft. That gives auditors, insurers and boards an independent evidence layer they can assess.

Microsoft ISV PartnerCertified Microsoft partner Microsoft Verified PublisherPublisher identity verified 11Frameworks mappedAutomatically, on every finding ~5minTo your first scoreRead-only, no credit card

“By 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur.”

Gartner, “Applying Uniform Governance Across AI Agents Will Lead to Enterprise AI Agent Failure”, May 2026
Gartner
EU AI ActISO/IEC 42001NIST AI RMFDORANIS2ISO 27001+ 5 more · 11 frameworks
See a full sample report

The actual NHI risk report a client receives: findings, actions and compliance mapping.

Open sample report →
See a real attack scenario

An AI email-assistant compromise, minute by minute, and how AIRM catches it.

Read the scenario →
Read the technical docs

Signals, scoring, blast radius, integrations and compliance in the Knowledge Base.

Open the Knowledge Base →

Machine-to-human identity ratio approximately 45:1 (Gartner analyst estimate).

Where to next
For security leaders

The questions you're being asked

Are we ready for AI? What is Shadow AI doing in our tenant? Are we compliant? How AIRM answers each one.

For security leaders →
Go deeper

Proof, docs and a real attack

An AI email-assistant compromise minute by minute, the full sample report, and the technical docs.

Read the attack scenario →
The MSP opportunity

A new service line that makes you money.

Not a cost to carry. A recurring, high-margin service you sell into every Microsoft 365 client, with zero infrastructure to run.

5
client tenants
~$32k
Year 1 revenue
25
client tenants
~$168k
Year 1 revenue
50
client tenants
~$336k
Year 1 revenue
Open the ROI calculator → See the full MSP opportunity →

Illustrative, USD. Assumes ~$5,100/tenant/yr in services (onboarding $1,500 + governance $250/mo + posture $150/qtr) plus partner-tier licence margin (Registered 25% → Gold 33% → Elite 40%, by tenants adopted). See assumptions & model your own →

Get started

Assess your entire client base, free.

Register once and run a full AIRM risk report on every Microsoft 365 tenant in your book, at no cost, see exactly what AI is running, scored, with the actions to fix it.

Get your free Sabiki NHI Risk Score → Open the ROI calculator
Questions first? Book 30 minutes →
Free on every client tenantA full report on eachRead-only Day 111 governance frameworks