変更履歴

The AI Exposure Check reads only the public DNS records of a domain you enter and returns an exposure score from 0 to 100, how many services are visibly connected to it, and how many of those have AI features. No account is needed. It does not contact the domain’s servers itself, never names the services, and a saved result is deleted after 24 hours; copies can stay in our encrypted backups for up to about 56 days. The formula is published at /check/methodology, and the Terms (4A), Privacy Policy (2A) and Acceptable Use Policy (3A) describe what it does.

Connect Okta in minutes with a read-only API token (no OAuth app to register) and scan your organization for identity-security risks: users without MFA, Super Admin sprawl, weak password and session policy, AI / OAuth apps with user-data access, dormant "zombie" apps, deactivated users that still hold access, and legacy authentication. AI agent and machine-to-machine apps flow into Agent Guard. Read-only by design.

A new AI accountability overview at /ai-liability explains the 2026 legal shift — courts and regulators increasingly hold the company deploying AI responsible for what its agents do — and positions 8200.dev as the proof layer: visibility, governance, and audit-ready evidence. Informational only, not legal advice.

Write your own detection rules with a no-code visual builder — combine resource and identity attributes with AND/OR logic to flag exactly what matters to your organization. Ships with ready-made templates, a dry-run tester, and JSON import/export. Available on Business and Enterprise plans.

A dedicated center unifies every external exposure — public links, external collaborators, and external domains — with risk ranking and batch approve/revoke. An approval workflow suppresses reviewed shares on future scans, and trusted-domain controls reduce noise from partners you trust.

Each team member gets an educational 0–100 awareness score from real signals — two-factor status, sharing hygiene, and stale OAuth grants — with a leaderboard, a personal self-view, badges, and encouraging nudges. The score is educational only and is never used for HR decisions.

Per-user behavioral baselines flag anomalies over time — sharing spikes, bulk access, new external domains, dormant-account reactivation, OAuth bursts, and off-hours activity. A behavior heatmap and confidence scoring help you focus on the changes that matter.

The /docs/api reference now documents the full Developer API — more than 40 endpoints across 16 categories, each with copy-paste examples in curl, Python, Node.js, and Go, plus ready-to-use TypeScript and Python SDK snippets. Webhook event payloads ship with HMAC signature-verification examples, alongside an authentication guide, rate limits, an error reference, and a versioning policy. Programmatic access is available on Business and Enterprise plans.

Manage many client organizations from one consolidated partner dashboard, with consent-based organization linking, portfolio rollups, and partner-level billing. Built for managed service providers running security across a fleet of tenants.

Track SOC 2, ISO 27001, GDPR, HIPAA, and NIST CSF 2.0 side by side, with cross-framework gap analysis, per-control ownership and notes, and a gap-analysis export. This maps your evidence to each framework — it is not, and never claims to be, a certification.

Enterprise SAML single sign-on gained downloadable service-provider metadata, one-click IdP metadata import for Okta, Azure AD, Google Workspace, and OneLogin, and configurable attribute mapping. We also added just-in-time provisioning controls, SAML assertion replay protection, and enforcement and disconnect controls. (Update, 2026-09-26: SSO is paused for a security fix and is coming soon again.)

Scan findings are grouped into a real-time alerts feed with severity routing, suppression rules, quiet hours, and alert analytics. You see what changed without the noise of one notification per finding.

Generate an auditor-ready evidence package (SOC 2 / ISO 27001 / GDPR oriented) as a downloadable ZIP — one folder per control, populated with the product data that backs it. Secrets are never included, and monthly auto-generation is available.

Push findings into Jira, Linear, GitHub Issues, Asana, or a generic webhook. Tickets are created automatically for new findings, and two-way status sync resolves a finding when its ticket is closed.

A unified chronological security feed sits alongside a documented incident-response workflow — open, investigating, contained, resolved, closed — with severity, assignees, and an append-only investigation log. Export a documented incident as a PDF for your auditors.

A new blog publishes practical guides to Google Workspace security, OAuth audits, data security posture management, and compliance, with full SEO and an RSS feed.

The Google Workspace scan now covers Shared Drives (Team Drives) — drive-level membership and restrictions, external members, open-sharing detection, and stale-drive detection — all under the same read-only metadata scope, with no new permissions.

Custom roles gained fine-grained, per-feature permissions and ready-made templates — Compliance Officer, SOC Analyst, External Auditor, and IT Admin — on top of the built-in Owner, Admin, and Viewer roles.

Generate a board-ready executive summary of your security posture as a polished PDF, written for leadership rather than practitioners.

An interactive data-flow map visualizes how information moves and is shared across your connected sources, making risky external flows easy to spot at a glance.

Define proactive “watch for X, do Y” rules that act on new findings within each scan cycle — alert in-app, by email, by webhook, or in Slack. Detection windows are honest: the platform connects read-only, so prevention is scan-based, not real-time interception.

A dedicated dashboard inventories every AI agent and service account, maps what each can reach, and surfaces over-privileged and sensitive access so non-human identities are governed like any other.

A positive “what do I have” view of users, files, and Shared Drives — searchable, filterable, and exportable — complements the findings view so you can see your whole estate, not just what is wrong.

A public status page shows uptime history and incident updates, backed by automated health checks that run every five minutes.

Enterprise network controls let you restrict access to allowlisted IP ranges and set session maximum-duration and idle-timeout policies, with safeguards against locking yourself out.

Two-factor authentication (TOTP with backup codes) is available to every user, with optional organization-wide enforcement and trusted-device memory so people are not prompted on every login.

Install the 8200.dev Slack app to receive finding alerts and run quick security queries directly from your workspace.

Compare your posture against anonymized peers in your industry and company-size band. Privacy-preserving minimum bucket sizes ensure no individual organization is ever identifiable.

A self-serve billing portal provides a usage dashboard, invoice history, and self-serve cancellation, so owners can manage their plan without contacting anyone.

A searchable in-app help center with real articles and contextual links throughout the product helps teams find answers without leaving the app.

Guided spotlight tours and an activation checklist help new teams reach their first scan faster.

An in-app assistant grounded in the product knowledge base answers setup, pricing, and security questions in your language, without inventing features it does not have.

The interface ships in 13 fully-maintained languages, with on-the-fly translation for 20 more — 33 in total — plus automatic language detection and full right-to-left support.

New public pages — how-it-works, use-cases, features, and a data-access transparency page — explain what the product does and exactly what it can and cannot see.

Full security headers (HSTS, CSP, frame-deny), global API rate limiting, request access logging, and branded error pages across the platform.

Transactional email for welcome onboarding, connector-health alerts, the weekly posture summary, and plan-limit warnings — each with a per-category opt-out in Settings.

Plan limits (connected sources, scan rate, features) are now enforced per organization, with a 30-day grace window so existing orgs are never broken by the rollout.

A full pricing page with a feature-by-tier comparison table and a frequently-asked-questions section, so you can self-serve the right plan.

Generate an access-control evidence report (SOC 2 / ISO 27001 / GDPR oriented) for your organization; paid tiers can export it as a polished PDF.

A platform analytics view (organizations, connector health, scan activity, onboarding, support usage) for operators.

A guided four-step setup at the top of the dashboard — connect your first source, run a scan, and review your posture score.

An in-app assistant grounded in the product docs that answers setup and security questions in your language.

Detect AI agents and service identities across your sources, map what they can access, and (opt-in) enforce least-privilege policies.

Connected sources are now monitored continuously, with automatic recovery of stalled syncs and alerts when a source loses access.

Connect Google Workspace for a read-only permission scan that builds your access graph, surfaces risky exposure as findings, and computes a posture score.