The Problem
Non-human identities, reused local admins, default credentials, and Active Directory attack paths are the real fuel of lateral movement — and they're invisible to vulnerability scans framed around CVEs. The accounts attackers actually ride through your estate never show up on a severity-sorted finding list.
What It Does
Janus builds a content-first inventory of every identity in the estate — human and non-human — via a 3-pass content sweep. It flags non-expiring, privileged, guest-enabled, and machine identities, then surfaces what attackers love most: credential reuse, default and blank credentials, AD attack-path exposure, and the coverage gaps (blind hosts) where it can't see at all.
Key Capabilities
- Identity discovery + classification — a 3-pass content sweep over plugin output finds human and non-human identities alike — service accounts, machine identities, the NHI population no CMDB tracks.
- Risk flags from identity plugins — non-expiring passwords, privileged and guest-enabled accounts, default/blank credentials, and password-auth SSH, each flagged from specific plugin evidence.
- Correlation layer — names your crown-jewel identities (privileged accounts on KEV/critical-exposed hosts) and surfaces credentials reused across five or more hosts.
- Provenance columns — every identity claim traces back to the plugin that produced it, so IAM teams can verify before acting.
- Coverage-gap headline — blind and uncredentialed hosts lead the report rather than hiding in a footnote.
- Gated tagging — identity risk becomes taggable, routable work — proposed and human-approved.
How It Works
Janus runs against the local navi.db built from your Tenable data: the vulns plugin family and output, plus specific identity plugins. All writes are proposed, human-approved, and logged.
Who It's For
IAM and identity-security teams who need visibility beyond the directory; AD admins hunting reuse and default creds; threat teams tracing the accounts attackers would actually use.
Proof Points
Discovers and classifies identities across a reference environment of 268 mixed RHEL/Windows assets — including the non-human identities no CVE list mentions — correlates privileged identities with KEV/critical exposure to name crown-jewel identities, and flags credentials reused across 5+ hosts. Signals depend on the relevant plugins being present; blind and uncredentialed hosts are called out, not hidden.
Works Better With
Janus is Fenrir's biggest feeder — its credential weaknesses become the lateral-movement pivots in ranked attack paths — and it drives Anubis ACR calibration so identity-critical assets get the priority they deserve.