See what's exposed.
Trace what it can reach.
Subimage (from the team behind Cartography) is an open-core security graph, investigation tool, and CNAPP for your infrastructure.
Demo video: You are in the graph explorer, talking to the agent, and each answer is drawn on the graph. You ask whether demo.subimage.io fronts a running container and have it trace that hostname to the image and the repository that built it, then ask which secrets the role on the backend container can reach. That finding becomes an issue, is routed to its owner, and the agent opens a pull request that removes the exposure.
Built for security engineers.
Security Investigation
Ask complex questions that static rules can't cover, and explore the evidence yourself.
Vulnerability Management
Detect, auto-triage, and fix vulnerabilities in your codebase, in built images, and at runtime.
Attack Paths
A deterministic engine that maps every route from the internet to your assets. Built for red and blue teams.
Identity & Access
Follow any user or service account across chained trust boundaries.
Agents & MCP
Bring the graph to your own tools and workflows.
Subimage scans hourly and uses read-only access to pull data across cloud resources, identities, code, devices, and more.
What we collect lands in one graph for analysis. A host, an identity, and a repository stay linked, so you can inspect relationships instead of reconciling tools.
We scan for issues, auto-prioritize them, suggest fixes, and deliver tickets and reports to the workflows you already use.
Security on a platter.
Subimage delivers issues, tickets, and pull requests. You dive in when you want to.
