Integrations overview

Deep vs standard

Most integrations in Radius360 are one of two types. A further five are discovery and vendor-risk feeds (Have I Been Pwned, Bitsight, and three CASB lenses) that fill inventories rather than per-control evidence.

Standard integrations (18 of them) pull evidence on a schedule. When an auditor asks for proof that you have encryption enabled on a storage bucket, or that users are required to rotate passwords every 90 days, standard integrations provide the artifact. They're one-way: Radius360 reads, stores, and presents the evidence for audit.

Deep integrations (23 of them) do the same, plus they turn the signal into governance action. When your SIEM flags lateral movement, your vulnerability scanner finds a critical CVE, or your identity provider detects an impossible-travel login, a deep integration translates that event into a scored risk in your register, maps it to the NIST and CIS controls it touches, generates an owned mitigation task, and, if severity warrants, creates an incident record.

The 46 integrations

Organized by category, see the full list and connection docs for each on the integrations page.

SIEM / XDR

Splunk, Microsoft Sentinel, Sekoia XDR, Datadog. Deep integrations: their alerts feed directly into risk and incident records. Elastic Security connects as a standard integration.

EDR

CrowdStrike, SentinelOne. Deep integrations: endpoint detections become mapped risks and mitigation tasks. Microsoft Defender for Endpoint connects as a standard integration.

Cloud posture

AWS, Google Cloud, Wiz, Vercel, Supabase, MongoDB Atlas. Deep integrations: misconfigurations become risks with remediation guidance and owner assignment. AWS Security Hub, Microsoft Defender for Cloud, and GCP Security Command Center connect as standard integrations.

Identity

Okta, Microsoft 365, Google Workspace. Deep integrations: MFA coverage, privileged account review, and sign-in policy gaps become risks. Microsoft Entra ID connects as a standard integration.

Vulnerability & attack surface

Tenable, Akto, Cloudflare API Shield. Deep integrations: vulnerability findings map to risks with CVSS scoring and asset context. Rapid7 InsightVM and Qualys VMDR connect as standard integrations.

Engineering & ticketing

GitHub is deep: merged pull requests become change-management evidence. Jira, Linear, and ServiceNow are standard integrations for evidence collection and ticket/issue linkage.

Security awareness

KnowBe4 (deep and standard options) and Proofpoint Security Awareness (standard). Training completion rates and phishing-test results as evidence.

AI governance

Azure OpenAI, OpenAI, Anthropic. Deep integrations that write per-control evidence for your AI program.

Connecting your first integration

The full flow from Integrations → Connect:

1. 1
   Pick the integration. For a first one, Okta or Microsoft 365 is the highest-leverage choice: both are deep, both cover a wide control surface, and both light up evidence across SOC 2, ISO 27001, HIPAA, and NIST CSF immediately.
2. 2
   Authorize. Click "Connect" and paste the credentials the source system issues: an API token, a service account, or an app registration, depending on the tool. The connect form shows the exact read-only permissions to grant, and "Save & Connect" tests the connection before saving.
3. 3
   Configure scope. Each connection belongs to the Radius360 client you are working in. For AWS (and Supabase and Vercel) you can connect several accounts or projects to the same client, each as its own instance. A single Okta tenant can map to one client; if you manage multiple Okta tenants (one per customer), each maps to its own client.
4. 4
   First sync. Pick a sync schedule (every 6 hours, every 12 hours, daily, weekly, or manual only; daily is the default). Most first syncs finish in a few minutes, depending on how much data the source holds.

What happens after a sync

For a deep integration:

• Evidence flows into the Evidence Vault, automatically tagged with source, collection time, and which framework controls it satisfies. Cross-framework auto-mapping is the default: one finding writes evidence rows for every framework in its controlMappings, so a SOC 2 row also satisfies the matching ISO 27001, NIST CSF, CIS, CMMC, or HIPAA controls. The Vault filters visibility to your active frameworks; the rest stays ready for when you activate a new one.
• Detected issues become risks with Impact, Likelihood, and a 4×4 matrix risk_score pre-populated. The risk is flagged auto_assessed = true and surfaces a violet "Auto-assessed by Radius360" banner with a Confirm button on the Risk Detail page.
• High-severity events become incidents with timelines and assigned responders
• Each risk gets an associated mitigation task. Owned by whomever you've configured (or a round-robin if no default owner). When an AI proposal is later approved against that risk, this task is updated in place with the proposal's specific remediation steps, so no duplicate is created.

AI Discovery

The Microsoft 365, Google Workspace, and Okta deep syncs additionally extract service principals / OAuth grants / SSO-assigned apps and pipe them through discover-ai-systems. That edge function matches each candidate against a curated 44-vendor AI catalog and inserts matches into ai_assets with discovery_source, discovery_confidence, and discovered_at populated. Inventory rows render with a violet "Auto-discovered" pill on /ai-governance. EU AI Act tier, NIST AI RMF profile, and ISO 42001 evidence mappings are pre-tagged at insert.

For a standard integration, just the first two happen (evidence and some detected issues), but no automatic incident or task creation.

Security & data handling

All integration traffic uses TLS 1.2+. Credentials are encrypted with AES-256 at rest. Radius360 uses row-level tenant isolation, so a misconfigured connection in one client's tenant can't leak evidence into another client's view.

We request the narrowest scope that enables the integration's value. Read-only wherever possible. We never request write scopes unless the integration explicitly requires them for a feature the customer has opted into.

Where Radius360 stops

Worth making this explicit because it's the most common misunderstanding:

• Radius360 does not detect threats. Your SIEM, XDR, EDR, and cloud-posture tools do that.
• Radius360 does not remediate vulnerabilities. Your patch management, IaC, and engineering teams do that.
• Radius360 does not run your incident response. Your IR team does. Radius360 tracks the incident record.

What Radius360 does is translate what those systems find into the governance artifacts your program needs: scored risks, mapped controls, owned tasks, evidence your auditors can verify, and reports your board can read. Detection stays with your tools. Governance runs in Radius360.