Agentless inventory in minutes
Connect a read-only role and Vault maps accounts, projects, subscriptions, and clusters: no agents, no sidecars, no change windows. Full first graph in under an hour on most estates.
[ VS-01 → VS-04 / Platform ]
Four modules, one graph
Point tools disagree because they each see a slice. Every Vault module reads and writes the same graph of your estate, so a detection knows its blast radius, an entitlement knows its exposure, and every control knows its evidence.
[ Architecture ]
From read-only access to audit-ready proof
The pipeline is deliberately boring: connect, model, rank, prove. What makes it work is that no step ever leaves the graph: context compounds instead of fragmenting across consoles.
-
STAGE 01
Connect
Read-only API role, 15 minutes, no agents
-
STAGE 02
Graph
Every resource, identity, and path: one model
-
STAGE 03
Prioritize
Attack paths ranked by real blast radius
-
STAGE 04
Prove
Evidence collected continuously, mapped to 27 frameworks
[ VS-01 / Posture Graph ]
Agentless cloud posture & attack paths
One graph of everything you run (every resource, identity, network path, and data store across AWS, Azure, GCP, and Kubernetes) built agentlessly from read-only API access. Vault correlates misconfigurations with exposure and identity so you fix the nine paths that matter, not triage 40,000 alerts.
- Deployment
- Agentless: read-only API role
- Graph rebuild
- Nightly full · ~2 min event deltas
- Coverage
- AWS · Azure · Google Cloud · Kubernetes
Attack-path analysis
The graph traces real chains: internet-exposed workload → over-privileged role → production data store, and ranks them by blast radius, so 'critical' means reachable, not just misconfigured.
Toxic-combination prioritization
A public bucket is a finding. A public bucket holding PHI, writable by a stale contractor key, is an incident waiting. Vault scores the combination, not the checkbox.
IaC scanning at the gate
Terraform plans are evaluated against the same policy set before apply: findings arrive as pull-request comments with the exact resource block and a suggested fix, in under 90 seconds.
Drift detection
Event-driven deltas land in the graph within about two minutes of a change, with a diff against the last known-good state and the identity that made it.
Data exposure classification
Sampled, in-region scanning tags stores that hold PII, PHI, or payment data, so exposure findings carry data context without your data leaving your cloud.
[ VS-02 / Runtime Detect ]
Cloud detection & response
Detection that starts from your control plane, not another appliance. Vault watches cloud audit logs agentlessly for every tenant, and an optional lightweight eBPF sensor adds process-level runtime signal where the stakes justify it, with containment actions that always ask a human first, by default.
- Deployment
- Agentless default · optional eBPF sensor
- Detection library
- 600+ managed rules · ATT&CK-mapped
- Containment
- Human-approved by default
Control-plane detections, agentless
Cloud audit and network flow logs are streamed and evaluated against a managed library of 600+ detections mapped to MITRE ATT&CK: live for every connected account from day one.
eBPF runtime sensor (optional)
A single sensor per node adds process, file, and network telemetry with a measured 0.6% p95 CPU budget. Agentless-first is the default; the sensor is for the clusters that earn it.
Findings with the whole story
Every detection lands pre-joined to the Posture Graph: the workload, its exposure, the identity involved, and what that identity could reach next. No pivoting across four consoles.
Guarded containment actions
Isolate a node, revoke a session, quarantine a key: one click, logged, and human-approved by default. Auto-containment is opt-in, per rule, per environment.
Forensic timeline
A reconstructed sequence of control-plane and runtime events around any finding, exportable for IR retainers and post-incident review.
On-call routing
Detections route by severity and ownership to your paging and chat tools with deduplication: the same alert never pages two teams.
[ VS-03 / Identity Map ]
Cloud identity & entitlements
Policy documents lie by omission. Identity Map computes effective permissions: what every human and non-human identity can actually do once groups, inheritance, and assumable roles resolve, then shows you the privilege nobody has used in 90 days and drafts the policy that removes it.
- Usage window
- 90-day exercised-permission analysis
- Remediation
- Policy PRs via your source control
- Elevation
- JIT grants · auto-expiry · full audit trail
Effective-permission computation
Vault resolves the full chain (group membership, role assumption, resource policies, permission boundaries) into the true blast radius of each identity, per cloud, in one view.
Unused-privilege detection
Every permission is compared against 90 days of actual usage. On typical estates, 60–80% of granted privilege is never exercised: Vault lists it, ranked by risk.
One-click least-privilege PRs
For IaC-managed identities, Vault drafts the reduced policy as a pull request against your repo: reviewed, versioned, and revertible like any other change.
Non-human identity inventory
Service accounts, access keys, and workload identities with age, rotation status, and last use: the 3 a.m. incident review, available at 3 p.m. instead.
Third-party access register
Every external principal with access into your estate: vendors, SaaS integrations, former contractors, with what they can reach and when they last did.
Just-in-time elevation
Standing admin becomes request-based: time-boxed grants with approval workflows, automatic expiry, and a complete audit trail the Evidence Engine picks up for free.
[ VS-04 / Evidence Engine ]
Continuous compliance automation
Audits fail on evidence, not intent. The Evidence Engine maps your live environment to 27 frameworks (SOC 2, ISO 27001, HIPAA, PCI DSS 4.0, FedRAMP and more) collects timestamped artifacts continuously, and gives your auditor a scoped, read-only workspace so screenshot season never happens again.
- Frameworks
- 27 mapped · cross-framework reuse
- Evidence
- Timestamped · auto-recollected
- Auditor access
- Scoped read-only workspace
Continuous control monitoring
Controls are tested against the live graph on a schedule, not sampled once a year. When a control drifts out of conformance, the owner is paged before the auditor notices.
Satisfy once, map everywhere
One piece of evidence (encryption at rest, say) is automatically cross-mapped to every framework that requires it. Adding a framework reuses most of what you already prove.
Evidence freshness SLAs
Screenshots rot. Every artifact carries a collection timestamp and an auto-recollection schedule, so nothing you hand an auditor is older than its framework allows.
Auditor workspace
A scoped, read-only seat where your auditor pulls their own evidence: logged, watermarked, and limited to the engagement window. Field work shrinks from weeks to days.
Gap register with owners
Every failing control becomes a tracked gap with an owner, a due date, and a remediation link: exportable to your ticketing tool, reportable to your board.
Questionnaire answering
Security-questionnaire answers drafted from your live control state, with citations to the underlying evidence: review, edit, send.
[ Keep reading ]
See it against your reality
[ Next step ]
See your own estate in the graph
A 45-minute demo on your environment, run by a named solutions engineer: no slideware. Or let the comparison tool tell you honestly whether you should buy us at all.