Security and status
What we can do in your account, and what we cannot.
You are being asked to let a young company read your cloud. The honest answer to that is a short, checkable list — followed by a ledger of what is actually proven.
Access model
What we can do inside your account, and what we cannot.
You are being asked to let a young company read your cloud. The honest answer to that is a short, checkable list.
Read-only, by construction
Onboarding creates one role with SecurityAudit, ViewOnlyAccess and a short list of read-only additions. No write action is ever requested, so no write action can be taken — including by us.
External ID on the trust policy
The role trusts our platform account only under an external-ID condition unique to your tenant, which is what stops a confused deputy from assuming it on someone else's behalf.
No agents, nothing deployed
Discovery is API-only. There is nothing to install on your hosts, nothing to patch, and no runtime component of ours in the path of your production traffic.
Tenant isolation, under test
Cross-tenant isolation is covered by the test suite rather than asserted in a brochure. Database row-level security to back the application layer is on the list before we take regulated data.
Where we actually are
No customer logos, because there are none yet.
Most platform pages put a wall of quotes here. We are early enough that anything in this space would be manufactured, so here is the ledger instead, and we will walk you through any line of it on a call.
Proven
- Inventory against mocked AWS, under test
- Attack-path search, including cycle termination
- Risk calibration against a fixed table
- Posture parsing and framework mapping
- Cross-tenant isolation
Not yet proven
- A scan against a live AWS account, end to end
- Posture checks running inside the scan worker
- Effective-permission evaluation
- Any provider other than AWS
How you can check
- Every risk score opens to the factors behind it
- Every attack path names the control that breaks it
- 122 automated tests, run on every change
- Design partners get a walkthrough of the engines
We are taking on a small number of design partners.
Early AWS teams who will point Defyve at a real account, tell us where it is wrong, and get the roadmap bent towards their estate. Hands-on onboarding, direct line to the people building it, and pricing that reflects the stage we are at.