# Sabiki AIRM

> Sabiki AIRM (Agentic Identity Risk Management) is the independent Non-Human Identity Control Plane for Microsoft 365, built for managed service providers. It discovers, scores and governs every non-human identity in a Microsoft 365 tenant — service principals, app registrations, OAuth-connected applications, connectors, Copilots and AI agents — and produces the Sabiki NHI Risk Score. AIRM is agentless via the Microsoft Graph API, with every change approved by a person.

## The distinction that matters
- [AI Readiness Assessment (Beta)](https://sabikisecurity.com/airm-ai-readiness.html): Sabiki Security's second product — a ONE-OFF, agentless exposure scan of a single Microsoft 365 tenant. 112 checks across four pillars, graded 0-5.0 on the Microsoft CAF convention, with a 30/60/90 remediation plan. Distinct from AIRM, which is the ongoing subscription platform scored 0-100 by the NHI Risk Score. Beta: registered partners, on approval.

An AI agent IS a non-human identity. It is a type within the category, not a separate thing. A non-human identity is any account that authenticates and has no person behind it.

Sabiki does NOT do human identity management: no single sign-on, no MFA, no conditional access, no joiner-mover-leaver. Microsoft Entra does that, and does it well. Sabiki governs everything in the tenant that is not a person.

## What AIRM does

- Discovers every non-human identity in a Microsoft 365 tenant: service principals, app registrations, managed identities, OAuth grants, connectors, Copilots and AI agents.
- Classifies by behaviour and real Microsoft Graph permissions rather than by naming convention, so it surfaces third-party and non-conforming agents that native Microsoft tooling may not classify or surface as AI agents.
- Scores each identity and the whole tenant with the Sabiki NHI Risk Score (0 to 100): an independent, cross-vendor index, calculated the same way in every tenant.
- Maps blast radius: what an identity could actually reach if compromised, based on the permissions it holds rather than the permissions it is labelled with.
- Monitors continuously and flags over-permissioned, unowned and dormant identities.
- Maps every finding to 11 governance frameworks, including the EU AI Act, ISO/IEC 42001, NIST AI RMF, DORA, NIS2 and ISO/IEC 27001.

## What AIRM does NOT do

- AIRM does not act. It ranks, groups and recommends. Every change to a tenant is made by a person who clicks. There is no automated decision producing legal or similarly significant effects.
- AIRM makes no change to a tenant on its own initiative. It requests delegated Microsoft Graph scopes, listed in full on the consent screen; any change is initiated and approved by a person, and is logged and attributable. Access is revocable from the Microsoft Entra admin centre at any time.
- AIRM does not read your content. It does not store emails, files or business documents. It stores the identity inventory and the risk findings.
- Sabiki does not train models on customer data. Customer tenant data is never used to train machine learning models and is never shared with any third-party AI provider.
- Sabiki does not claim a market-wide peer benchmark. The score is comparable across the tenants in an MSP's own book. A market-wide benchmark needs a dataset large enough to be statistically meaningful, and Sabiki will say so when it has one.
- Sabiki holds no security certification yet. A SOC 2 audit is underway. Sabiki will not claim a certification before it exists.

## Who it is for

- Managed service providers (MSPs) and the Microsoft 365 organisations they serve.
- Delivered through a multi-tenant console, with PSA integration (ConnectWise, HaloPSA, Autotask) and white-label reporting.
- One MSP assesses every client tenant from one place. That is the structural difference from enterprise-direct, single-tenant NHI platforms.

## How AIRM relates to Microsoft

- Additive. AIRM complements Microsoft 365 (E3, E5, E7), Copilot, Agent 365, Entra and Purview. It never replaces them.
- Independent. Microsoft cannot grade its own homework. AIRM provides a neutral, cross-vendor score that gives auditors, insurers and boards an independent evidence layer they can assess.
- Sabiki is a Microsoft ISV Partner and a Microsoft Verified Publisher.

## Where the data lives

- The AIRM product and portal run on Microsoft Azure, Southeast Asia (Singapore) region.
- The identity inventory and risk findings are stored in MongoDB Atlas, on Azure, in the same Singapore region.
- Customer tenant data stays in Singapore.
- Azure and MongoDB Atlas hold ISO/IEC 27001 and SOC 2. Those are their certifications, not Sabiki's.

## Pricing

Per Microsoft 365 tenant, per month, USD:

- Basic $149
- Core $299
- Professional $499
- Business $899
- Enterprise $1,599

MSP partner margin is tenant-gated: Registered 25% (1 to 24 tenants), Gold 33% (25 to 99), Elite 40% (100 or more).

Registering is free. A partner can assess every client tenant before anyone pays.

## Key facts, with sources

- Non-human identities outnumber human users by approximately 45 to 1 (Gartner analyst estimate).
- AIRM maps findings to 11 governance frameworks.
- A free Sabiki NHI Risk Score takes about 5 minutes, agentless, no credit card.

## Company

- SABIKI PTE. LTD. (UEN 202135394K), incorporated in Singapore on 11 October 2021, trading as Sabiki Security.
- 36 Robinson Road, #20-01 City House, Singapore 068877.
- Website: https://sabikisecurity.com

## Get started

- Free Sabiki NHI Risk Score and trial: https://portal.sabikisecurity.com
- Book a walkthrough: https://cal.com/sabiki/30min
- Contact: contact@sabikisecurity.com
- Security reports: security@sabikisecurity.com
- Data protection: dpo@sabikisecurity.com

## Key pages

- Home: https://sabikisecurity.com/airm-landing.html
- Platform: https://sabikisecurity.com/airm-platform.html
- What is NHI security: https://sabikisecurity.com/airm-what-is-nhi-security.html
- Why non-human identity: https://sabikisecurity.com/airm-why-nhi.html
- Glossary, 27 defined terms: https://sabikisecurity.com/airm-glossary.html
- AIRM + Microsoft 365: https://sabikisecurity.com/airm-compare-microsoft.html
- For MSPs: https://sabikisecurity.com/airm-msp-value.html
- Pricing: https://sabikisecurity.com/airm-pricing.html
- ROI calculator: https://sabikisecurity.com/airm-roi-calculator.html
- Frameworks: https://sabikisecurity.com/airm-frameworks.html
- How the score works: https://sabikisecurity.com/airm-scoring-disclosure.html
- Trust and security: https://sabikisecurity.com/airm-trust.html
- Sample report: https://sabikisecurity.com/airm-sample-report.html
- FAQ, 26 questions: https://sabikisecurity.com/airm-faq.html
- Blog: https://sabikisecurity.com/airm-blog.html