Findings without a subject
A misconfiguration with no link to the workload, image or repository that caused it has no owner.
Posture on the same graph
as your code.
A public bucket is a finding. A public bucket that a workload running a vulnerable image can write to, through a role anyone can assume, is an attack path. SecurityVault stores the second kind.
3
Cloud providers
AWS, Azure, GCP — agentless collectors.
CIEM
Identity edges
assumes · can_access · authenticates_as.
K8s
Cluster sensor
Inventory, topology, admission, eBPF runtime.
SLA
Posture SLAs
Drift and posture ageing with deadlines.
The problem
Why CSPM dashboards get ignored.
01
02
Snapshots, not change
Posture is reported as a list at collection time; what changed since yesterday is a diff nobody runs.
03
Identity in a separate tool
Who can reach the bucket is answered by a CIEM product that does not know about the CVE.
04
Kubernetes as a black box
Cluster findings stop at the namespace; nobody knows which image digest is actually running.
05
Frameworks bolted on
Compliance mapping is a report generated from the same list, one framework at a time.
06
Agents everywhere
Runtime visibility requires an agent fleet before the first result.
How SecurityVault does it
More edges on the same entities.
Collect
Agentless collectors for AWS, Azure and GCP register accounts, resources, principals, roles and policies as ontology entities with
hosted_in, assumes and can_access edges.Check
Native checks and benchmark rules produce misconfiguration findings that
affect the resource; drift detection produces change, not just state.Bind
The Kubernetes sensor and registry watchers bind workloads to image digests, so a container CVE and a cluster misconfiguration meet on the same workload.
Path
Attack paths start at exposure edges and traverse identities, roles and data stores. Chokepoints and interventions are ranked; empty results say why.
Age
Posture SLAs give findings deadlines by severity and asset tier; breaches escalate through chat and on-call.
Map
The same findings satisfy or violate controls across SOC 2, ISO 27001, NIST 800-53, PCI DSS, CIS and the rest through the cross-walk graph.
What it rests on
The platform underneath.
Cloud 360
Entity pages
Every account, resource and principal has a 360 view.
Image 360
Digest to workload
Registry watchers and sensors bind what runs.
DSPM · EASM
Data and edge
Data stores, classifications and external endpoints.
Attack paths
Pathfinder
Chokepoints and interventions.
Frameworks
Cross-walked
One finding, every dependent control.
Deployment
Your cluster or ours
Sensors and scan band can run in your environment.
See it on your stack
Connect one account and one cluster.
Watch a bucket finding become an attack path with a workload, an image digest and a commit on it.