Collect
Read-only adapters per tool. Every record keeps its source ID, the run that brought it and how fresh it is.
Open-source security CMDB
What your security tools know, together.
Custodia reads every tool you already run, joins their records with explicit rules and tells you what none of them sees alone: who has privileged access without a healthy device, which identities collide, where coverage is unknown.
No sign-up. A fictional company, Acme Corp, running entirely in your browser.
Reads from
CyberArkconnected
Netskopeconnected
BigIDnext- CrowdStrikenext
- Cortex XDRnext
- Tenablenext
- Firewallsnext
How you use it
Ask questions no single tool can answer.
Each answer shows the rule that produced it and the records behind it, so you can check it before you act.
Who has privileged access but no device we can see?
Alice Morgan is a member of a CyberArk Safe with a service account. Netskope sees her user, but no device in a complete capture.
GapSee it in the demo →Whose devices stopped reporting?
Bob Chen has two devices. ACME-INF-OLD has been silent for 12 days. That is not proof of abandonment, so it stays partial.
PartialSee it in the demo →Are these two accounts the same person?
Eve Taylor has two active identities with one email. Custodia does not pick one for you; coverage stays unknown until someone decides.
UnknownSee it in the demo →What does each tool actually say?
Every CyberArk and Netskope record as the tool delivered it, with its source ID, its run and the link Custodia proposes, kept apart.
Raw recordsSee it in the demo →How it works
Collect, join, conclude. In that order, in writing.
Join
Explicit join rules, such as an exact and unique email. Ambiguity stays visible for a person to decide.
Conclude
Versioned rules produce verdicts with their evidence. An old or partial capture gives “unknown”, never a false gap.
Inside the demo
Crossings on one side, each tool on the other.
The demo interface is in Spanish for now.
A system you can read
Color says who asserts it and what is concluded.
Each color has one job and never stands alone: a two-letter seal names the source, a shape names the verdict and a stroke tells how a record was joined.
Provenance
- CyberArk
- Netskope
- BigID
Verdict
- Covered
- Partial
- Gap
- Unknown
Join
- exact email
- ambiguous: never joined on its own
- absence or no signal
Status
An honest prototype.
- Done
Demo with a fictional companyCrossings, verdicts with evidence, per-tool inventory and stale or partial capture scenarios. No server.
- In progress
Go backend with PostgreSQLExisting rules move to Go with their regression tests.
- Next
Real adapters and sign-inCyberArk and Netskope first; sign-in through Switchboard or generic OIDC.
- Later
Data, endpoint, vulnerabilities, firewallsBigID, CrowdStrike, Cortex XDR, Tenable. Each new source arrives with its contract and its rules.
CyberArk, Netskope and BigID logos and names are trademarks of their owners and identify the products Custodia reads from. Custodia is not affiliated with them.