Integrations overview

Deep vs standard

Every integration in Radius360 is one of two types.

Standard integrations (18 of them) pull evidence on a schedule. When an auditor asks for proof that you have encryption enabled on a storage bucket, or that users are required to rotate passwords every 90 days, standard integrations provide the artifact. They're one-way: Radius360 reads, stores, and presents the evidence for audit.

Deep integrations (20 of them) do the same, plus they turn the signal into governance action. When your SIEM flags lateral movement, your vulnerability scanner finds a critical CVE, or your identity provider detects an impossible-travel login, a deep integration translates that event into a scored risk in your register, maps it to the NIST and CIS controls it touches, generates an owned mitigation task, and, if severity warrants, creates an incident record.

The 46 integrations

Organized by category, see the full list and connection docs for each on the integrations page.

SIEM / XDR

Splunk, Microsoft Sentinel, Elastic, Sekoia XDR. Deep integrations, their alerts feed directly into risk and incident records.

EDR

CrowdStrike, SentinelOne, Microsoft Defender. Deep integrations, endpoint detections become mapped risks and mitigation tasks.

Cloud posture

AWS, Google Cloud Platform. Deep integrations, misconfigurations become risks with remediation guidance and owner assignment.

Identity

Okta, Microsoft Entra (Azure AD), Google Workspace. Deep integrations. MFA coverage, privileged account review, inactive user cleanup, and impossible-travel alerts become risks.

Vulnerability & attack surface

Tenable, Rapid7, Qualys, Akto. Deep integrations, vulnerability findings map to risks with CVSS scoring and asset context.

Productivity & ticketing

Microsoft 365, Jira, Linear, ServiceNow. Standard integrations, evidence collection and ticket/issue linkage.

Awareness & email

KnowBe4, Proofpoint. Standard integrations, training completion rates, phishing-test results, and email security posture as evidence.

Edge / network

Cloudflare. Standard integration. DNS, WAF, and network posture as evidence.

Connecting your first integration

The full flow from Integrations → Connect:

1. 1
   Pick the integration. For a first one, Okta or Microsoft 365 is the highest-leverage choice, both are deep, both cover a wide control surface, and both light up evidence across SOC 2, ISO 27001, HIPAA, and NIST CSF immediately.
2. 2
   Authorize. Most integrations use OAuth. Click "Connect," log into the source system, approve Radius360's read-only scopes. A few (like on-prem SIEM deployments) use service-account credentials or API keys instead.
3. 3
   Configure scope. For multi-tenant systems (Microsoft 365, Google Workspace, AWS), pick which tenant/account maps to which Radius360 client. A single Okta tenant can map to one client; if you manage multiple Okta tenants (one per customer), each maps to its own client.
4. 4
   First sync. Most deep integrations complete their first sync in 2–5 minutes. Standard integrations may take 10–30 minutes depending on how much historical data exists.

What happens after a sync

For a deep integration:

• Evidence flows into the Evidence Vault, automatically tagged with source, collection time, and which framework controls it satisfies. Cross-framework auto-mapping is the default — one finding writes evidence rows for every framework in its controlMappings, so a SOC 2 row also satisfies the matching ISO 27001 / NIST CSF / CIS / CMMC / HIPAA controls. The Vault filters visibility to your active frameworks; the rest stays ready for when you activate a new one.
• Detected issues become risks with Impact, Likelihood, and a 4×4 matrix risk_score pre-populated. The risk is flagged auto_assessed = true and surfaces a violet "Auto-assessed by Radius360" banner with a Confirm button on the Risk Detail page.
• High-severity events become incidents with timelines and assigned responders
• Each risk gets an associated mitigation task. Owned by whomever you've configured (or a round-robin if no default owner). When an AI proposal is later approved against that risk, this task is hydrated in place with the proposal's specific remediation steps — no duplicate created.

AI Discovery

The Microsoft 365, Google Workspace, and Okta deep syncs additionally extract service principals / OAuth grants / SSO-assigned apps and pipe them through discover-ai-systems. That edge function matches each candidate against a curated 44-vendor AI catalog and inserts matches into ai_assets with discovery_source, discovery_confidence, and discovered_at populated. Inventory rows render with a violet "Auto-discovered" pill on /ai-governance. EU AI Act tier, NIST AI RMF profile, and ISO 42001 evidence mappings are pre-tagged at insert.

For a standard integration, just the first two happen — evidence and some detected issues — but no automatic incident or task creation.

Security & data handling

All integration traffic uses TLS 1.2+. Credentials are encrypted with AES-256 at rest. Radius360 uses row-level tenant isolation, so a misconfigured connection in one client's tenant can't leak evidence into another client's view.

We request the narrowest scope that enables the integration's value. Read-only wherever possible. We never request write scopes unless the integration explicitly requires them for a feature the customer has opted into.

Where Radius360 stops

Worth making this explicit because it's the most common misunderstanding:

• Radius360 does not detect threats. Your SIEM, XDR, EDR, and cloud-posture tools do that.
• Radius360 does not remediate vulnerabilities. Your patch management, IaC, and engineering teams do that.
• Radius360 does not run your incident response. Your IR team does. Radius360 tracks the incident record.

What Radius360 does is translate what those systems find into the governance artifacts your program needs: scored risks, mapped controls, owned tasks, evidence your auditors can verify, and reports your board can read. Detection stays with your tools. Governance runs in Radius360.