# Archos

*/Startups/Archos*

## Startup Overview

The system ingests and translates multi-cloud Identity and Access Management configurations into deterministic access graphs. Cloud security teams use this engine to map exactly which human and machine identities hold permissions to specific infrastructure assets across distinct cloud environments. Instead of relying on probabilistic alerts or manual audits of dense policy files, administrators query the graph to trace absolute privilege paths and expose hidden administrative escalations.

Legacy cloud security posture managers like Wiz and Palo Alto Prisma treat access as a subset of generalized vulnerability scanning, generating broad risk scores that require extensive manual validation. This engine abandons broad risk scoring in favor of a strictly read-only execution model that computes mathematical certainty for every permission path. By remaining fully deterministic in its access mapping, the architecture guarantees engineers can prove infrastructure isolation holds true without executing intrusive modifications.

## Startup Founding Hypothesis

**Approach**: that normalizes multi-cloud IAM policies into deterministic access graphs
**Competitors**:
- [Wiz](/Competitors/Wiz)
- [Palo Alto Prisma](/Competitors/Palo_Alto_Prisma)
- [Manual AWS IAM audits](/Competitors/Manual_AWS_IAM_audits)
**Differentiator2x2**: fully deterministic in access mapping and completely read-only in execution

## Startup Solution Coordinate

**Solution**: [Archos Policy Graph](/Software/Archos_Policy_Graph)

## Startup Position2x2

```mermaid
quadrantChart
    title IAM Mapping vs Execution
    x-axis Active Modification --> Read-Only Execution
    y-axis Heuristic Alerting --> Deterministic Graph
    quadrant-1 Safe & Exact
    quadrant-2 Intrusive & Exact
    quadrant-3 Intrusive & Probabilistic
    quadrant-4 Safe & Probabilistic
    Archos: [0.90, 0.85]
    Wiz: [0.70, 0.40]
    Palo Alto Prisma: [0.20, 0.45]
    Manual AWS IAM audits: [0.85, 0.10]
```

## Startup Customer Journey

```mermaid
flowchart LR
A[Developer Tutorial] --> B[Open-Source CLI]
B --> C[IAM Access Graph]
C --> D[Starter Map Tier]
D --> E[Enterprise Security Platform]
E --> F[Reference Architecture]
```

## Startup Proof Points

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**Pilot Goals**:
- A 14-day read-only deployment on a single cloud environment mapping up to 5,000 IAM identities, targeting proof of completely deterministic access path accuracy without false positives.
- A 30-day multi-cloud integration across AWS and GCP covering up to 25 accounts, aiming to validate the successful generation of automated compliance reports and custom policy drift alerts.
**Target Metrics**:
- Aim: 100 percent elimination of false-positive access alerts compared to probabilistic risk scoring incumbents.
- Aim: Sub-10 minute generation times for deterministic cross-account trust policy maps.
- Target: 0 write-access permissions required to generate pipeline-ready IAM JSON fixes.
- Target: 100 percent normalization of ephemeral session tokens back to static root identity patterns.
**Target Case Studies**:
- Target: Mid-market fintech Cloud Security Architects mapping complex AWS cross-account trust policies in under 10 minutes to eliminate manual path validation.
- Target: Enterprise healthcare Compliance Officers validating zero-trust access boundaries across 25,000 identities via automated deterministic reporting instead of manual quarterly audits.
- Target: Cloud-native SaaS DevSecOps Leads identifying undetected privilege escalation paths and outputting exact minimum-privilege IAM JSON for pipeline remediation.
**Testimonial Targets**:
- Cloud Security Architect expressing relief that the mathematical determinism of the map removes heuristic guesswork from access auditing.
- DevSecOps Engineer detailing how easily they feed the Archos-generated minimum-privilege IAM JSON directly into their existing Terraform pipelines without granting write access.
- Chief Information Security Officer highlighting the platform's ability to maintain a clean and performant visual graph even when processing millions of ephemeral tokens.

## Startup Top Risks

**Risks**:
- Severity: existential · Description: Cloud providers restrict API access to IAM policy metadata or fundamentally alter their proprietary evaluation logic, breaking the deterministic graph generation. · Mitigation Status: unmitigated
- Severity: high · Description: Incumbents like Wiz or Palo Alto Prisma adopt deterministic graph mapping natively alongside their existing automated remediation suites, nullifying the primary differentiator. · Mitigation Status: in-progress
- Severity: high · Description: Enterprise security teams reject the purely read-only execution model because they require automated write-enabled remediation to instantly revoke overly permissive access. · Mitigation Status: unmitigated
- Severity: moderate · Description: Cross-cloud access graph complexity for massive enterprise environments consumes disproportionate compute resources, causing unacceptable latency in mapping query paths. · Mitigation Status: in-progress

## Startup Competitors

- [Wiz](/Competitors/Wiz) — Incumbent CNAPP
- [Palo Alto Prisma](/Competitors/Palo_Alto_Prisma) — Incumbent Cloud Security
- [Manual AWS IAM audits](/Competitors/Manual_AWS_IAM_audits) — Status Quo
- [Sonrai Security](/Competitors/Sonrai_Security) — Identity Graphing
- [Tenable Cloud Security](/Competitors/Tenable_Cloud_Security) — Incumbent CIEM

## Startup Token Hero

**Genre**: founding-hypothesis
**Rendered**: Every quarter, cloud security teams struggle with manual policy audits. Archos maps multi-cloud IAM into deterministic graphs so you can prove infrastructure isolation holds true.
**Mechanism**: spine-derived-v1
**Template Id**: spine-founding-hypothesis
**Vocab Fingerprint**: 1126b5a734923e76

## Startup Token Positioning

**Genre**: moore-positioning
**Rendered**: Deterministic Cloud Access Mapping for cloud security leads at fintechs. Unlike Wiz and Palo Alto Prisma — mathematically prove every access path without executing intrusive modifications.
**Mechanism**: spine-derived-v1
**Template Id**: spine-moore-positioning
**Vocab Fingerprint**: fc8d0b8fffeecc2a

## Startup Token Pitch Deck

**Genre**: pitch-deck
**Rendered**: Problem: Manually auditing AWS IAM and GCP policy files leads to hidden administrative escalations that Wiz and Prisma miss.
Solution: Every quarter, cloud security teams struggle with manual policy audits. Archos maps multi-cloud IAM into deterministic graphs so you can prove infrastructure isolation holds true.
Customer: cloud security leads at fintechs
Unlike: Wiz and Palo Alto Prisma
**Mechanism**: spine-derived-v1
**Template Id**: spine-pitch-deck
**Vocab Fingerprint**: 9b8216b0ade658f7

## Startup Token M E D D P I C C

**Pain**: Manually auditing AWS IAM and GCP policy files leads to hidden administrative escalations that Wiz and Prisma miss.
**Metrics**: Target: Cloud infrastructure isolation is mathematically proven, and hidden administrative escalations are exposed and neutralized in minutes.
**Rendered**: Pain: Manually auditing AWS IAM and GCP policy files leads to hidden administrative escalations that Wiz and Prisma miss.
Economic buyer: Cloud Security Architect
Metrics: Target: Cloud infrastructure isolation is mathematically proven, and hidden administrative escalations are exposed and neutralized in minutes.
Competition: Wiz and Palo Alto Prisma
**Mechanism**: spine-derived-v1
**Competition**: Wiz and Palo Alto Prisma
**Economic Buyer**: Cloud Security Architect
**Vocab Fingerprint**: 80423a869c74eac4

## Startup Token Cold Email

**Genre**: cold-email
**Rendered**: Subject: Deterministic Cloud Access Mapping for cloud security leads at fintechs

cloud security leads at fintechs — Manually auditing AWS IAM and GCP policy files leads to hidden administrative escalations that Wiz and Prisma miss. Every quarter, cloud security teams struggle with manual policy audits. Archos maps multi-cloud IAM into deterministic graphs so you can prove infrastructure isolation holds true.
**Mechanism**: spine-derived-v1
**Template Id**: spine-cold-email
**Vocab Fingerprint**: 5c373b39ce6d3a24

## Startup Token Agent Spec

**Genre**: ai-agent-spec
**Rendered**: Deterministic Cloud Access Mapping. Every quarter, cloud security teams struggle with manual policy audits. Archos maps multi-cloud IAM into deterministic graphs so you can prove infrastructure isolation holds true. Serves cloud security leads at fintechs.
**Mechanism**: spine-derived-v1
**Template Id**: spine-ai-agent-spec
**Vocab Fingerprint**: 828dc16e4e9b690e

## Neighborhood

### Candidate solutions

- [Centralized Procurement Realization](/Problems/Centralized_Procurement_Realization) — candidate solution for · Problems
- [Unbillable Tax Data Extraction](/Problems/Unbillable_Tax_Data_Extraction) — candidate solution for · Problems

### What it offers

- [Archos Policy Graph](/Software/Archos_Policy_Graph) — offers · Software

### Composed of

- [Deterministic Graph Service](/Services/Deterministic_Graph_Service) — composes · Services
- [Read Only Auditing API](/Agents/Read_Only_Auditing_API) — composes · Agents
- [IAM Ingestion Agent](/Agents/IAM_Ingestion_Agent) — composes · Agents
- [Access Mapping Worker](/Agents/Access_Mapping_Worker) — composes · Agents
- [Policy Normalization Engine](/Agents/Policy_Normalization_Engine) — composes · Agents

### Competitors

- [Tenable Cloud Security](/Competitors/Tenable_Cloud_Security) — competes with · Competitors
- [Wiz](/Competitors/Wiz) — competes with · Competitors
- [Palo Alto Prisma](/Competitors/Palo_Alto_Prisma) — competes with · Competitors
- [Manual AWS IAM audits](/Competitors/Manual_AWS_IAM_audits) — competes with · Competitors
- [Sonrai Security](/Competitors/Sonrai_Security) — competes with · Competitors

### Embodies

- [Software](/Theses/Software) — embodies · Theses

### Similar Startups

- [Frontierhaven](/Startups/Frontierhaven) — similar · Startups
- [Domill](/Startups/Domill) — similar · Startups
- [Dalatigue](/Startups/Dalatigue) — similar · Startups
- [Puonarch](/Startups/Puonarch) — similar · Startups
- [Weldedrock](/Startups/Weldedrock) — similar · Startups
- [Incisive Software](/Startups/Incisive_Software) — similar · Startups
- [Aegispark](/Startups/Aegispark) — similar · Startups
- [Accirm](/Startups/Accirm) — similar · Startups
- [Rigavanna](/Startups/Rigavanna) — similar · Startups
- [Accibe](/Startups/Accibe) — similar · Startups
- [Leap](/Startups/Leap) — similar · Startups
- [Direridian](/Startups/Direridian) — similar · Startups
- [Unitecrown](/Startups/Unitecrown) — similar · Startups
- [Accault](/Startups/Accault) — similar · Startups
- [Posept](/Startups/Posept) — similar · Startups
- [Daloblem](/Startups/Daloblem) — similar · Startups
- [Spaceintractable](/Startups/Spaceintractable) — similar · Startups
- [Atonyx](/Startups/Atonyx) — similar · Startups
- [Florix](/Startups/Florix) — similar · Startups
- [Novia](/Startups/Novia) — similar · Startups