Demo Tenants — Master Index
A quick reference to every SecurityV0 demo tenant: what it is, what it proves, and which conversation it fits. Read this first, then open the per-scenario doc for the tenant you'll show.
Two kinds of tenant:
- Seeded fixtures — synthetic, hand-authored data designed to exercise the product surface deterministically. Fast, stable, no live infrastructure. The findings are real evaluator output over seeded graphs.
- Real-data tenants — live connector scans of SecurityV0-owned environments. Slower to stand up, but the answer to "is this real?"
Which demo for which conversation
| If the buyer cares about… | Show… | Why |
|---|---|---|
| The whole product, in one walk | demo-w1 | Lights up every risk cluster and posture category on one tenant |
| Shadow AI / "who can reach my models?" | demo-w1 (AI-gateway convergence) | A real orphaned AI agent and an external gateway both reaching one production model |
| Partner audit (Atlassian + AWS / Itera) | demo-jira-aws (synthetic) or nimbus-cloud (real) | Jira tickets that run commands in production AWS, plus 8 enterprise gap patterns |
| Cloud / IAM architecture at scale | enterprise-nimbus (real) | Cross-account, cross-cloud authority paths with Entra→AWS federation |
| SOC / detection engineering | demo-microsoft-soc | A Sentinel playbook identity that escalated from read-only to endpoint isolation |
| Departed employees / offboarding | demo-w1 | Deleted owners whose automations keep running and exporting data |
| "Is this real data?" | contoso, nimbus-cloud, enterprise-nimbus | Live connector scans of real environments |
The tenants
Seeded fixtures
| Tenant | What it is | Best for | Detail doc |
|---|---|---|---|
demo-w1 | Broad-coverage fixture (Contoso Corp) across ServiceNow + Entra ID + Microsoft Foundry. Exercises every risk cluster and posture category, plus the incoming AI-gateway convergence. | Full-product walkthrough; Shadow AI; offboarding | sv0-platform/scripts/demos/demo-w1.md |
demo-jira-aws | Nordlys Energi — a Nordic energy utility using Jira Service Management as a production AWS control plane. Headline chain + 8 lettered gap patterns (A–H). | Atlassian + AWS partner audit; cloud IAM | sv0-platform/scripts/demos/demo-jira-aws.md |
demo-aws | Nimbus Cloud Inc. — synthetic AWS-only scan (the seeded counterpart to the live nimbus-cloud tenant). | AWS-only story without live infra | sv0-platform/scripts/seed-demo-aws.ts (header) |
demo-microsoft-soc | Contoso SOC — a Sentinel automation rule → Logic App playbook → managed identity that gained escalation-class actions across two scans. | SOC / Sentinel execution-authority expansion | sv0-platform/scripts/seed-demo-sentinel.ts (header) |
Real-data tenants
| Tenant | What it is | Best for | Detail doc |
|---|---|---|---|
contoso | Real Entra ID, ServiceNow, Microsoft Foundry, and Azure scans of SecurityV0's shared subscription. Doubles as SV0's own environment. | "This is real data"; cross-cloud identity + AI exposure | — |
nimbus-cloud | Real AWS scan of a single SV0-owned demo account (the real counterpart to demo-jira-aws). Live Jira → AWS Lambda → IAM → S3/ECS/SSM chain. | Real-data Jira → AWS audit | sv0-demo-labs/labs/nimbus-cloud/DEMO-NARRATIVE.md |
enterprise-nimbus | Real multi-account AWS + Entra ID scans with Entra→AWS federation. Cross-account, cross-cloud authority paths. | Cross-account / cross-cloud at scale | sv0-demo-labs/labs/enterprise-nimbus/DEMO-SCRIPT.md |
TrueFoundry / Shadow AI is not a standalone demo tenant. That story is told through demo-w1's AI-gateway convergence (an external gateway and a real orphaned Foundry agent both reaching one production Azure OpenAI backend). See the
demo-w1row above.
Cross-cutting honesty notes
These hold across every demo and are worth stating out loud — the product's credibility comes from being honest about what it can and can't yet observe:
- Seeded ≠ fake findings. On the seeded fixtures the company and data are synthetic, but the findings, clusters, severities, and authority paths are produced by the real evaluator running over the seeded graph. If a rule changes, the fixtures' findings change. That is why they double as regression baselines.
- The AI-gateway convergence fires MEDIUM on purpose. In
demo-w1, theexternal_invocation_authorityfinding (an external gateway reaching a managed Azure OpenAI backend) is MEDIUM, not HIGH — the connector cannot yet observe action severity (sv0-connectors#173). It asserts reachability, not a confirmed write. Present it that way; the convergence onto a shared production model is the story, not a fabricated capability. - Action severity is a known connector gap. Several demos surface
external_invocation_authority/ capability findings where the underlying severity isn't yet emitted by the connector. The product surfaces the gap ("manual review required") rather than guessing.
Where the source of truth lives
- Per-seed scenario docs (what's inside + what angle to show) live next to each seed in
sv0-platform/scripts/demos/so they stay in sync with the seed code. - Tenant identity/config is defined in
sv0-platform/src/domain/tenants/canonical-tenants.ts. - Real-data walkthroughs (with click-by-click "Show it" notes) live in
sv0-demo-labs/labs/<tenant>/. - This index is the human entry point; it summarizes and points, it does not duplicate the per-seed detail.