Live
Cloud Inventory
EC2, VPC, security groups, subnets, S3, RDS, Lambda and IAM — recorded with how each asset is reachable and what it is worth.
The platform
Twelve modules, one asset graph.
Every card says whether it is collecting today. The coverage table at the bottom says what is not built yet.
Live
Posture / CSPM
Hundreds of configuration checks per account, normalised into one finding model so posture and risk speak the same language.
Live
Attack Paths
Graph search from every internet entry point to anything worth stealing, with prose explaining the route and a control keyed to each hop.
Live
Risk Engine
Context-adjusted scoring that returns each factor, its multiplier and a sentence justifying it — never a bare number.
Live
Compliance
CIS, PCI DSS, NIST 800-53, NIST CSF, ISO 27001 and SOC 2, rolled up per control from the same scan.
Live
Alerts
What changed since the last scan, and which of those changes opened or closed a route.
Partial
CIEM / Identity
Identities and privilege scoring are built. Effective-permission evaluation across policies, boundaries and SCPs is not.
Partial
Remediation
Lifecycle and exceptions with mandatory expiry. Nobody can declare a fix — only a re-scan confirms remediation.
Model present · ticketing not wired
Planned
Cloud Graph
The asset graph as a thing you can query and walk, rather than only the paths the engine chose to surface.
Design partners shape the order
Planned
DSPM
What sensitive data sits where, and which of the paths above end at it.
No collector yet
Planned
Runtime / CWPP
Workload protection at runtime, to close the gap between a posture snapshot and what is executing.
No collector yet
Planned
Vulnerabilities
Host and image CVEs folded into the same risk model, so a vulnerability on a path outranks one that is isolated.
No collector yet
Compliance
Seven frameworks, rolled up per control.
The same scan that builds your attack paths produces framework coverage, so posture and audit evidence never disagree with each other. Failed controls link to the findings that caused them.
CIS 3.0PCI DSS 4.0NIST 800-53 Rev 5NIST CSFISO 27001SOC 2
Coverage
What is built, and what is not.
A security console that shows an empty chart for a scanner that never ran is telling you the most expensive lie it can. Modules without a collector say so, in the product and here.
| Capability | State | Detail |
|---|---|---|
| AWS onboarding | Live | Cross-account role, external ID, STS validation. |
| Cloud inventory | Live | EC2, VPC, security groups, subnets, S3, RDS, Lambda, IAM. |
| Posture (CSPM) | Live | Hundreds of configuration checks, normalised into one finding model. |
| Attack paths | Live | Graph search with prose explanation and a control per hop. |
| Risk engine | Live | Context-adjusted scoring with per-factor justification. |
| Compliance | Live | Per-framework rollup across all six, surfaced in the console. |
| CIEM / identity | Partial | Identities and privilege scoring built. Effective-permission evaluation is not. |
| Remediation | Partial | Model and lifecycle present. Ticketing integrations not wired. |
| Azure, GCP, Oracle | Planned | No connector yet. AWS is the only provider today. |
| DSPM, runtime, Kubernetes, IaC | Planned | Scoped in the console, not collecting. Design partners shape the order. |
We are taking on a small number of design partners.
Early AWS teams who will point Defyve at a real account, tell us where it is wrong, and get the roadmap bent towards their estate. Hands-on onboarding, direct line to the people building it, and pricing that reflects the stage we are at.