How does EchelonGraph's 30-second compliance re-scoring work?

Every cloud or Kubernetes change emits a signed webhook to /api/v1/compliance/notify. The compliance engine re-runs the affected control evaluators and upserts the score row within 15-30 seconds end-to-end. That's about 2,880x more frequent than the industry-standard nightly cron. Audit evidence stays accurate between audits, not just on audit day.

IndustryMay 15, 2026·14 min read

CSPM and PAM After Palo Alto Idira + Versa CSPM: What the Compliance Layer Does Next

Palo Alto Networks shipped Idira (next-gen PAM built on CyberArk) and Versa Networks shipped CSPM in the same week. Both confirm AI has changed the rules. We walk through what each launch gets right, and the compliance layer that now has to keep up — 30-second re-scoring, 21 EU AI Act obligations live, and 7 newly shipped CIS-AWS IAM controls.

EchelonGraph

Founder

TL;DR. In the same week, Palo Alto Networks shipped Idira — a next-generation Privileged Access Management (PAM) platform built on its CyberArk acquisition — and Versa Networks shipped CSPM. Both confirm that AI has fundamentally changed who and what has privilege in the enterprise. Neither answers the next question CISOs are about to face: *when identity controls flex in real time and posture scans run nightly, how is your compliance evidence supposed to keep up?* This post walks through what each launch gets right, where the gap lives, and the three engineering bets EchelonGraph just shipped — 30-second compliance re-scoring, 21 EU AI Act obligations scored live, and 7 newly wired CIS-AWS IAM controls — that close that gap.

Two AI-enterprise security launches this week

On May 12, 2026, Palo Alto Networks (NASDAQ: PANW) introduced Idira, pitched as the next-generation identity security platform built for the AI enterprise. It absorbs the CyberArk PAM portfolio Palo Alto acquired and extends it with agentic identity protection, Zero Standing Privilege, and just-in-time enforcement for human, machine, and AI identities.

The stat that landed loudest in the press release:

> "Machine and AI identities now outnumber humans 109 to 1, while 61% of privileged access requests are fulfilled with standing privilege rather than on-demand, leaving the enterprise even more vulnerable to identity threats."

One day later, on May 13, Versa Networks shipped CSPM — cloud security posture management as an extension of the VersaONE Universal SASE Platform, with 500+ rules across AWS, GCP, Azure, and OCI, and audit-ready reporting mapped to CIS, NIST, ISO 27001, SOC 2, and PCI-DSS.

Two different products. Two different vendors. One signal: in 2026, AI has changed the rules and the security stack has to catch up. Identity isn't a vault problem anymore. Posture isn't a quarterly review anymore.

What Palo Alto's Idira gets right about identity in the AI enterprise

Idira's framing is sharp. The product correctly identifies that identity has become the new battleground — adversaries are no longer breaking in, they're logging in. The 9-in-10 organizations breached via an identity vector, the 109:1 machine-to-human ratio, the 61% standing-privilege gap — these are real numbers and the kind of clarity the PAM space has needed for years.

The technical pillars are well-chosen:

Zero Standing Privilege (ZSP) — eliminate baseline access; grant just-in-time

Dynamic privilege controls — move from static role assignments to context-aware enforcement

AI-driven discovery — continuously surface every identity, entitlement, and access path

Agentic identity coverage — explicit support for autonomous AI agents that act on systems

For existing CyberArk SaaS customers, Idira's licensing tiers (Traditional PAM, Modern PAM, Workforce Access, Machine & AI Identity Security) make it easy to layer ZSP and agentic protection without a forklift migration. Idira ships with 300+ out-of-the-box integrations and 200+ alliance partners — concrete reach numbers, not just architecture diagrams.

This is the right direction for PAM. The Palo Alto / CyberArk combination has both the portfolio reach and PAM depth to deliver it. Will Townsend of LoneStar Advisory & Research called it well:

> "Over the past two decades, privileged access management was a vault problem. It is not anymore. The enterprise has become a sprawling mesh of human, machine, and agentic identities. To comprehend this complexity, identity must move from a checkpoint to an operating model."

If you're a CyberArk customer, Idira is an obvious upgrade path. If you're not, it's a credible alternative to Okta Identity Governance, Ping, SailPoint, and Microsoft Entra PIM.

What Versa's CSPM adds to the cloud security stack

Versa's CSPM launch is a different story: a SASE vendor expanding into adjacent territory. The play is reasonable — Versa already touches enterprise traffic at the network edge; adding posture management lets them sell a unified platform rather than asking customers to integrate a separate CSPM with their SD-WAN.

For Versa's existing SASE customers, the pitch is operational simplification: one vendor, one console, one bill. That's a real value proposition. The product itself ships 500+ rules across AWS, GCP, Azure, and OCI, with risk-based prioritisation (severity + exposure rather than alert volume) and continuous compliance mapping to CIS, NIST, ISO 27001, SOC 2, and PCI-DSS. For greenfield CSPM buyers, it puts Versa alongside Wiz, Orca, Lacework (now FortiCNAPP), Prisma Cloud, and CrowdStrike — credible but not yet differentiated.

What both Idira and Versa CSPM share is the underlying premise: AI has changed the threat model, and the security stack needs to evolve. We agree.

The gap both leave open: real-time compliance evidence

Here's the question neither product answers, and it's the one that lands hardest when an auditor walks in:

Is your compliance evidence current right now, or current as of last night's cron?

Idira controls *access*. When a privilege is granted, denied, or rotated, Idira enforces it in real time. That's the access layer.

Versa scans *posture*. It flags misconfigurations against frameworks like CIS, SOC 2, and HIPAA on whatever cadence the customer configures — typically daily.

But neither product owns the compliance evidence layer. When the auditor asks "show me proof that on August 2, 2026 (EU AI Act enforcement day), your high-risk AI system met the human-oversight obligation in Article 14," what artifact do you hand them?

The traditional CSPM answer is: "Here's the score from our last nightly scan, dated yesterday." That's 24 hours of drift. Between the scan and the audit window, identity privileges flexed (because Idira works as designed), cloud resources were created and destroyed, and Kubernetes deployments rolled. The score is stale before it's printed.

The traditional PAM answer is: "Here's the access log showing who had what privilege when." That's important — and Idira does this well — but it answers *who accessed what*, not *whether the configuration of the AI system meets the regulator's substantive requirements*.

The gap is real-time, evidence-grade, framework-mapped compliance scoring of cloud + Kubernetes + AI workload state. That's the gap we've been heads-down closing at EchelonGraph.

How EchelonGraph completes the picture

Three engineering bets, all live in production today.

30-second compliance re-scoring (the webhook contract)

Most CSPMs re-evaluate compliance on a 24-hour cron. EchelonGraph re-scores compliance evidence in under 30 seconds via a signed webhook on every cloud or Kubernetes change.

The technical contract:

A cloud event happens (IAM policy attached, new EKS deployment, S3 bucket public-flag toggled).

The relevant scanner emits the change to the EchelonGraph ingester.

The ingester writes to the asset inventory and POSTs a signed notification to /api/v1/compliance/notify.

The compliance engine re-runs the affected control evaluators against the new state.

The score row in the database is upserted with the fresh verdict, evidence, and timestamp.

End-to-end: typically 15-30 seconds. That's ~2,880× more frequently than a nightly cron.

The audit implication: when Idira rotates an agentic identity's privilege at 03:00 UTC, the compliance evidence reflects it before your morning standup. Not at the next audit window.

21 EU AI Act obligations, scored live

August 2, 2026 → 79 days as of this post. €35M or 7% of global revenue in fines per Article 99. The penalties make GDPR (4%) look polite.

EchelonGraph just shipped 21 EU AI Act obligations scored against live cloud + Kubernetes evidence. The coverage:

Article(s)	What it covers	EchelonGraph controls
Art 9	Risk management system	ART9-RM, ART9-FORESEEABLE, ART9-MISUSE
Art 10	Data governance	ART10-DATA-GOV
Art 11	Technical documentation	ART11-TECH-DOC
Art 12	Record-keeping / event logs	ART12-LOGGING
Art 13	Transparency to deployers	ART13-TRANSPARENCY
Art 14	Human oversight	ART14-HUMAN-OVERSIGHT
Art 15	Accuracy, robustness, cybersecurity	ART15-ACCURACY, ART15-ROBUSTNESS, ART15-CYBERSEC
Art 16	Provider obligations	ART16-RBAC, ART16-CORRECTIVE
Art 17	Quality management system	ART17-QMS
Art 19	Auto-generated log retention (≥6 months)	ART19-LOGS-RETENTION (shipped this week)
Art 26	Deployer obligations	ART26-DEPLOYER (shipped this week)
Art 27	Deployer FRIA before first use	ART27-FRIA (shipped this week)
Art 50	Transparency to natural persons	ART50-TRANSPARENCY
Art 61	Post-market monitoring	ART61-POST-MARKET
Art 72	Serious-incident reporting	ART72-INCIDENT
Art 85/99	Penalty awareness + leadership reporting	ART85-PENALTY

That's 21 controls across 16 distinct Articles. Each one mapped to live cloud + Kubernetes evidence — not a Q3 roadmap promise.

Plus NIST AI-RMF, ISO/IEC 42001, MITRE ATLAS, and OWASP LLM Top 10 — all mapped to the actual ML serving stacks teams already run: KServe, Kubeflow, Ray, Seldon, Run:ai.

7 newly shipped CIS-AWS IAM controls

If Idira controls access, EchelonGraph proves the AWS-native IAM posture also meets the regulatory bar — without manual evidence. This week we wired live scoring for seven CIS-AWS IAM controls that had been on procedural-credit status:

CIS-AWS-1.6 — Hardware MFA for root (not just any MFA — specifically hardware token)

CIS-AWS-1.8 — Password policy minimum length ≥ 14 characters

CIS-AWS-1.9 — Password reuse prevention (last 24 passwords)

CIS-AWS-1.13 — Each IAM user has at most one active access key

CIS-AWS-1.15 — No inline policies attached directly to users (use groups/roles)

CIS-AWS-1.16 — No AdministratorAccess attached to user principals

CIS-AWS-1.20 — Dedicated IAM Support role exists for incident response

All seven read from live AWS IAM telemetry via the tier-1 cloud scanner — no manual attestation, no policy template, no PDF. A new AWS_ACCOUNT_SUMMARY asset is synthesized per scan with the password policy, root MFA state, and support role detection. Per-IAM-user attributes track active access key count, inline policy count, and admin-attached status.

Tier-3 zero-knowledge eBPF runtime

For Kubernetes workloads in regulated environments, the EchelonGraph Tier 3 (EcheDeep) agent runs as an eBPF DaemonSet in the customer cluster, redacts PII at the kernel boundary, and submits envelope-encrypted findings sealed by a customer-controlled KMS key. We never see plaintext.

This matters for compliance frameworks that mandate data sovereignty — particularly EU AI Act Article 12 (record-keeping) and HIPAA §164.312(b) (audit controls). The Tier 3 architecture lets a healthcare or financial-services tenant get real-time eBPF visibility without surrendering custody of the underlying data to the SaaS vendor.

Live public research surfaces (proof, not brochure)

We publish three real-time research surfaces, open with no signup:

Shadow AI Radar — real-time Certificate Transparency log + Shodan stream of leaked internal AI infrastructure (RAG pipelines, LLM proxies, vector databases, MCP servers).

AI Security Index — 8,000+ AI services tracked globally, 1,100+ AI-related CVEs, severity drill-down by region and product.

AI Threat Map — live WebGL globe of unauthenticated vector databases (Milvus, Qdrant, ChromaDB, Weaviate, Ollama) verified via Shodan banner-grab.

These exist because the right way to prove a security claim is to publish what we're actually seeing, not to write a brochure.

Side-by-side: Palo Alto Idira vs Versa CSPM vs EchelonGraph

Capability	Palo Alto Idira	Versa CSPM	EchelonGraph
Primary product category	Privileged Access Management	Cloud Security Posture Management	Real-time compliance + security graph
Real-time re-scoring (≤30 s)	n/a — PAM product	❌ — typically daily cron	✅ — webhook on every cloud / K8s change
EU AI Act controls (live evidence)	partial via identity controls	❌	✅ — 21 obligations across Articles 9-17, 19, 26-27, 50, 61, 72, 85/99
NIST AI-RMF / ISO 42001 / MITRE ATLAS	❌	❌	✅ — all 5 AI frameworks (incl. OWASP LLM Top 10)
Zero Standing Privilege enforcement	✅ enforced	❌	✅ scored (CIS-AWS 1.13, 1.15, 1.16) — complements, doesn't replace
Agentic identity coverage	✅	❌	✅ via MITRE ATLAS + Tier-3 eBPF
Live attack-graph blast radius	❌	partial	✅
Multi-cloud (AWS / GCP / Azure)	identity layer only	✅	✅
Kubernetes-native scanning	partial (identity in K8s)	partial	✅ Tier-3 eBPF, zero-knowledge
Free public research surfaces	❌	❌	✅ Shadow AI Radar, AI Security Index, AI Threat Map
Pricing	Enterprise contract	Enterprise contract	Free tier + transparent enterprise pricing

The honest reading: Idira, Versa CSPM, and EchelonGraph are complementary, not substitutes. Idira controls access. Versa scans posture. EchelonGraph proves both meet the regulatory bar in real time, with evidence the auditor can verify.

If you're an enterprise running Idira or CyberArk PAM, EchelonGraph is the compliance evidence layer that proves your ZSP rollout actually moved your CIS-AWS-1.13 / 1.15 / 1.16 score line. If you're a Versa SASE customer, EchelonGraph adds AI-workload coverage (KServe, Kubeflow, Ray) and the 21 EU AI Act obligations Versa CSPM doesn't yet score.

Frequently asked questions

Is EchelonGraph an alternative to Palo Alto Idira?

Not directly. Idira is Privileged Access Management — it enforces who can access what, when, and for how long. EchelonGraph is real-time compliance + security graph — it proves, with live evidence mapped to frameworks (EU AI Act, NIST AI-RMF, CIS, SOC 2, etc.), that your access posture meets the regulatory bar. The two products are complementary: Idira controls, EchelonGraph evidences. Most enterprises run both.

Is EchelonGraph an alternative to Versa CSPM?

Closer to it, but with a different focus. Versa's CSPM bundles cloud posture management into the Versa SASE platform — useful if you've already standardised on Versa for SD-WAN. EchelonGraph is purpose-built for real-time, evidence-grade compliance scoring — including the 21 EU AI Act obligations, NIST AI-RMF, ISO/IEC 42001, MITRE ATLAS, and OWASP LLM Top 10 that no traditional CSPM ships out of the box. If your priority is regulator-ready AI workload compliance, EchelonGraph is the more direct match.

Can EchelonGraph work alongside CyberArk PAM or Palo Alto Idira?

Yes — that's the recommended pattern. CyberArk / Idira controls *access*; EchelonGraph monitors and scores the *posture* and *compliance evidence* of the cloud and Kubernetes resources those identities act on. The two integrate cleanly via IAM telemetry: as Idira flexes a privilege, EchelonGraph picks it up via the cloud-provider audit log and re-scores the affected compliance controls within 30 seconds.

What is Zero Standing Privilege (ZSP) and does EchelonGraph score it?

Zero Standing Privilege means no identity (human, machine, or agentic) has baseline access to resources. All privilege is granted just-in-time, for the minimum duration needed, then revoked. Palo Alto's Idira enforces ZSP at the access layer. EchelonGraph scores the *outcomes* of ZSP via three CIS-AWS controls in particular — 1.13 (each IAM user has at most one active access key), 1.15 (no inline policies attached to users), and 1.16 (no AdministratorAccess attached to user principals) — all live from AWS IAM telemetry.

When does the EU AI Act start enforcing?

High-risk AI system obligations under Annex III + Chapter III (Articles 8-17, etc.) start enforcing on August 2, 2026. Earlier provisions kicked in on February 2, 2025 (prohibited practices) and August 2, 2025 (general-purpose AI). Penalties for high-risk non-compliance reach €15 million or 3% of global annual turnover; prohibited-practice violations reach €35 million or 7%.

Which compliance frameworks does EchelonGraph score?

17 total, with attribute-level scoring (not just questionnaire checkboxes). The catalog covers: CIS AWS v3, CIS GCP v2, CIS Kubernetes v1.9, Pod Security Standards, SOC 2 Type 2, ISO 27001, HIPAA, PCI-DSS 4.0, GDPR, NIST 800-53, NIS2, DORA, CMMC 2.0 — plus the 5 AI-specific frameworks (NIST AI-RMF, EU AI Act, ISO/IEC 42001, MITRE ATLAS, OWASP LLM Top 10). Every passed control names the resource that earned it.