We read every account in your organization using a role that is mechanically incapable of changing anything, and hand back a report you can forward to your auditor, your insurer, or your largest customer's security review.
Not through negligence. Through velocity. A security group opened for a demo in 2023. A NAT gateway serving traffic nobody profiles. A bucket made public on purpose, by someone who has since left. An RDS snapshot from a migration that finished.
None of it shows up in a dashboard, because a dashboard shows you what you asked it to watch. The things that hurt are the things nobody thought to watch.
Every finding names the resource, the region and the account. Where something could not be assessed — missing permission, disabled service, unavailable API — the report says NOT ASSESSED rather than scoring it as a pass. A gap you know about is worth more than a clean number you can't trust.
The cost section states plainly what it did not price, every time. AWS's own Savings Plans, Reserved Instances, right-sizing and Graviton recommendations depend on your account having opted into Cost Optimization Hub — if it hasn't, the report says so instead of implying there was nothing to find. A handful of areas — CloudWatch Logs retention, S3 storage class and lifecycle waste, and data transfer beyond NAT gateway processing — aren't priced at all yet, and the report names each one outright. A low total should read as exactly what was measured, never as "nothing to fix."
A limited IAM role and an API guard prevent changes to your account.
# Every AWS call is checked
ALLOW Describe* Get* List* Head*
DENY Create* Update* Delete* Put* Modify*
DENY Attach* Detach* Run* Terminate*
DENY GetSecretValue GetSessionToken *Credentials*
# Unknown calls are denied by defaultInspect or tighten the CloudFormation template before deploying it.
Secret values, session tokens and credentials are blocked.
You generate the ExternalId. Delete the stack to revoke access; no access keys are issued.
No bucket objects, database rows or queue messages are read.
Thirty minutes. How many accounts, which regions, who owns access, what you're actually worried about. You get a single fixed number at the end of it — not a range.
30 min · your timeWe hand you a CloudFormation template (or a StackSet for an organization). Your team reads it, your security team reviews it, you deploy it. We never hold a credential of yours.
1–2 hrs · your teamAutomated, read-only, and it produces a reproducible evidence file rather than a screenshot. The same evidence can regenerate the same report a year from now.
~30 min · automatedThe slow part, and the part you're actually paying for. False positives filtered out, severity assigned by real exposure, business context added, and the findings ordered so that acting on the first six already pays for the engagement.
Several days · our timeYou get the document and an hour to walk through it. Then you decide whether to fix it yourself or scope the work with us. The report is written so that either choice is genuinely open.
1 hr · your team