Cloud governance · Available
Every cloud, one inventory, fixes you can prove
Connect Azure, AWS and Google Cloud read-only and get one inventory, ranked findings with an owner and a fix, and changes that run only after approval and are proven by the next scan.
- 3 clouds
- one normalized inventory
- 26 controls
- CIS, NIST, ISO 27001, SOC 2
- every fix
- verified by the next scan
What Cloud governance covers
Inventory and change
- Multi-cloud inventory in one normalized model
- AWS Organizations and Azure subscription auto-discovery
- Configuration drift and change history
- Business context from tags: owner, application, environment, criticality
- Saved views and group-by on findings, inventory, cost by resource, savings, remediation and identity
Security and identity
- Posture findings with evidence, owner, effort and first/last detected
- Cloud-native findings ingested from the providers' own scanners (AWS Security Hub: GuardDuty and Inspector) and mapped into CloudVision findings; Microsoft Defender for Cloud and Google SCC next
- Known-CVE detection on discovered end-of-life components (databases, Kubernetes), agentless
- Identity risk: missing MFA, standing privilege, guests, inactive accounts, old keys
- Contextual risk scoring you can tune
- Risk exceptions with expiry and four-eyes approval
Zero Trust and compliance
- 29 Zero Trust controls across 8 pillars
- 26 common controls mapped to CIS, NIST CSF, NIST 800-207, ISO 27001, SOC 2, PCI DSS and HIPAA, plus Gulf packs: NCA ECC and CCC, SAMA CSF, UAE IA and Qatar NIA
- Procedural requirements flagged for evidence
- Executive and technical reports in PDF, Excel, CSV and HTML
FinOps
- 60 days of daily cost by service, forecast and 3σ anomalies
- Native and rule-based savings with change risk and security impact
- Savings lifecycle from estimated to verified
- Budgets, showback and chargeback by tag
- Verified outcomes report for quarterly reviews: fixes confirmed by rescan and savings verified after the change, with a bill cross-check and a fingerprint recorded in the audit trail
Governed remediation
- 12 remediation actions across AWS, Azure and GCP
- Break-glass emergency access: time-boxed, approved privilege brokered through Entra PIM or Tenable, auto-revoked and fully audited
- Separate write identity, dry run, approval by a second person
- Remediation SLAs by risk level, automatic ownership routing, and exception expiry warnings
- A downloadable, tamper-evident evidence pack per finding: its triage history, the exception and approver, remediation requests and the verifying audit-chain entries
- Tickets in Jira and ServiceNow, read back when closed
- Alerts to e-mail, Teams, Slack, signed webhooks, Splunk and Sentinel
Ask CloudVision
- Questions answered from your tenant's own data, with citations
- Optional AI phrasing through the CloudVision AI gateway
- Never invents resources, numbers or causes
- Self-hosted models only: customer data never goes to an external AI provider
How it works
Connect read-only
Grant a least-privileged reader role per cloud. Terraform modules for each provider show exactly which permissions are requested and why.
Get the first assessment
An eight-stage scan builds inventory, findings, identity risk, Zero Trust and compliance scores, cost and savings within minutes of connecting.
Fix what matters first
The Fix first list ranks work by risk and cost together. Each item explains why, who owns it and what it takes.
Change under control
Remediation uses a separate write identity, a dry run and a second person's approval. The next scan verifies the result.
Capabilities in depth
Cloud security
Posture, exposure and identity risk across clouds, ranked by real business context.
Zero Trust
Measure Zero Trust maturity across identity, devices, networks, data and governance.
Identity and access
Human and machine identities across Entra ID, AWS IAM and Google IAM.
Compliance
Continuous control evidence mapped to the frameworks your auditors ask for.
FinOps
Cost, forecast, savings and allocation that security and engineering can act on.
Cloud inventory
One normalized inventory across Azure, AWS and GCP, with drift and ownership.
Remediation and automation
Fixes that run through policy, approval, execution and verification.
CloudVision AI
AI answers grounded in your own data, through a gateway you govern.
Works with
- Microsoft Azure
- Amazon Web Services
- Google Cloud
- Microsoft Entra ID
- Jira
- ServiceNow
- Microsoft Teams
- Slack
- Splunk
- Microsoft Sentinel
- Webhooks
- OpenID Connect
- SAML 2.0
Deployment
- Hosted for you in our cloud
- Private deployment on your own Kubernetes or Docker host
- PostgreSQL with row-level security per tenant
Check where you stand
Free, about five minutes, scored in your browser. Nothing is sent unless you ask for the report.
Cloud Security Assessment
How well you see and control risk across your cloud accounts. 8 questions, about 5 minutes.
Zero Trust Assessment
Where you stand across the Zero Trust pillars. 8 questions, about 6 minutes.
Cloud Cost Assessment
How much of your cloud spend is visible, allocated and optimized. 8 questions, about 4 minutes.
Compliance Readiness Assessment
How ready you are for SOC 2, ISO 27001 and similar audits. 8 questions, about 5 minutes.
Questions people ask
What access does Cloud governance need?
Read-only roles for discovery and assessment. Remediation is optional and uses a second, separately granted identity, so turning it off removes all write access.
Does it replace our cloud provider's native security tools?
No. It uses their recommendations where they exist and adds cross-cloud context, risk scoring, ownership, compliance mapping and governed remediation.
Can managed service providers use it for several customers?
Yes. In the service-provider console you work across customers through delegated access, which each customer's admin can see and revoke. Staff open a customer from My Apps, every visit lands in that customer's audit trail, and provider accounts can never manage the customer's people or sign-in settings.
Where is our data stored?
In a tenant-isolated PostgreSQL database with row-level security enforced by the database. Secrets are encrypted with tenant-bound keys. Private deployment keeps everything in your environment.
See it on your own estate
Walk through your clouds, identities and devices with a specialist in 30 minutes, or get a scored report from a free assessment.