Skip to content
open.securityopen.securityBeta

One person, eight systems, three shared keys.

Nothing in the schema says the HR record and the directory account are the same person. 52 of the 127 tasks cross at least one boundary and have to infer it — 11 span three platforms or more, 75 stay inside a single system.

Identity Security Posture Management

127 identity-security questions over Osbench Labs, a frozen synthetic enterprise spanning eight platforms. Every task is classified by theme, scope, and structural complexity, over the platforms it touches, and every answer comes from the environment’s own data, so there is a right answer to check against.

Published modality
Text-to-SQL

The first public contract gives the agent a frozen relational snapshot and records each read-only query as evidence.

Native-vendor modality
The same world, through APIs and CLIs.

The framework keeps the environment, tasks, and answer criteria fixed while the interrogation surface changes. Request traces then play the evidentiary role of SQL traces.

Composition

every bar is a share of 127 tasks

Theme

Auth posture33
Privilege & exposure28
Lifecycle & offboarding17
Credential hygiene16
Cross-vendor exploration16
Dormant & stale11
Inventory & visibility6

Scope

Single-platform75
Cross-platform52

Complexity

a scale, not a ranking

Easy64
Medium37
Hard26

Platforms

a task can span several

AWS61
Okta47
Google Workspace35
BambooHR21
GitHub16
Azure6
GCP4
MongoDB Atlas3

Run the benchmark yourself.

One binary ships the task set, the pinned dataset, and the grader. The score you see locally follows the same public contract as the board.