Cloud & containers
Read-only posture across a cloud account, container images, Kubernetes and your infrastructure-as-code, where every answer is pass, fail, or unknown.
What people come here for
CSPM
S3, EC2, IAM and CloudTrail settings, read-only. With no cloud credentials available it reports unknown and the reason, instead of folding a missing answer into a clean result.
Full definition →CIEM
Eighteen privilege-escalation paths in AWS, each needing a conjunction of conditions before it fires. With no AWS identity configured the check is declared skipped — not passed.
Full definition →Kubernetes Security
Talks to a live API server over REST with mutual TLS or a token, without kubectl, to read effective RBAC, registered admission webhooks and running pods.
Full definition →IaC Scanning
Terraform, CloudFormation, Kubernetes manifests and Docker Compose checked before the thing is built, rather than after it is running.
Full definition →Drift Detection
What has changed in configuration since the previous observation, so a change nobody can explain becomes visible instead of becoming normal.
Full definition →Everything else in this surface
Each name opens its own one-line definition in the capability catalogue.
What this does not do
Read-only throughout: nothing here modifies a cloud account. Unknown is a real answer this product prefers over a comforting one.
Everything this product does not do →