# Subimage: The Open-Core Security Graph

> Subimage (from the team behind Cartography) is an open-core security graph, investigation tool, and CNAPP for your infrastructure.

Canonical HTML page: https://www.subimage.io/

---

See what's exposed. Trace what it can reach.

[Book a demo](https://cal.com/team/subimage/chat-with-subimage)
[Cartography on GitHub](https://github.com/cartography-cncf/cartography)

Demo video: You are in the graph explorer, talking to the agent, and each answer is drawn on the graph. You ask whether demo.subimage.io fronts a running container and have it trace that hostname to the image and the repository that built it, then ask which secrets the role on the backend container can reach. That finding becomes an issue, is routed to its owner, and the agent opens a pull request that removes the exposure.

## Built for security engineers

### [Security Investigation](https://www.subimage.io/product/explorer.md)

Ask complex questions that static rules can't cover, and explore the evidence yourself.

### [Vulnerability Management](https://www.subimage.io/product/vulnerability-management.md)

Detect, auto-triage, and fix vulnerabilities in your codebase, in built images, and at runtime.

### [Attack Paths](https://www.subimage.io/product/attack-path-analysis.md)

A deterministic engine that maps every route from the internet to your assets. Built for red and blue teams.

### [Identity & Access](https://www.subimage.io/product/ciem.md)

Follow any user or service account across chained trust boundaries.

### [Agents & MCP](https://docs.subimage.io/docs/agents/connect_via_mcp)

Bring the graph to your own tools and workflows.

## How it works

### Ingest constantly

Subimage scans hourly and uses read-only access to pull data across cloud resources, identities, code, devices, and more.

- **Read-only access.** You provision and own the role that ingests your data.
- **Bring your own data.** Missing an integration? Extend the graph with declarative schemas. We're built on Cartography, so there's no vendor lock-in.
- **Deploy on your terms.** Stay in your environment. We support on-prem or cloud deployments.

### Connect and investigate

What we collect lands in one graph for analysis. A host, an identity, and a repository stay linked, so you can inspect relationships instead of reconciling tools.

- **Query it yourself.** The graph is open to your team, not locked inside a report.
- **First-class visualization.** Powered by a best-in-category graph traversal engine and explorer.
- **Issues you can act on.** Our scanners identify issues and take them as far as you ask: a contextualized report, a remediation plan, a ticket to the owner, or the pull request.

### Operationalize

We scan for issues, auto-prioritize them, suggest fixes, and deliver tickets and reports to the workflows you already use.

- **Sources stay attached.** Validate raw data and see how findings were derived.
- **Built for agents.** Plug in your clanker of choice.
- **Flexible integrations and open APIs.** Query directly, or connect with MCP, and automate your workflows.

## Security on a platter

Subimage delivers issues, tickets, and pull requests. You dive in when you want to.

### Prioritized issues

Every security finding kicks off both our attack path engine and our triage agent in parallel, so you get the best of both deterministic and agentic reasoning.

- **Triage Analyst.** Investigates and scores issues.
- **N2 Analyst.** Updates issues on new context.
- **Attack Path Engine.** Deterministic blast radius.

### Tickets assigned to the right person

Subimage uses hints such as commit history, CODEOWNERS, and org charts to make the best guess about who should be assigned to the ticket.

- **Linear and Jira.** Auto-route tickets and ownership.
- **Slack.** Auto-route notifications.
- **Webhooks.** Custom integration.
- **MCP.** Agentic integration.

### Remediation and auto-close

We deliver context, generate action items, and can automatically open pull requests. Issues auto-close when the underlying signals resolve.

- **Investigation Agent.** Creates pull requests.
- **Action Items.** Report built from static analysis.

## Get started

Give your security team an unfair advantage.

Attackers think in graphs. You should too.

[Get started](https://cal.com/team/subimage/chat-with-subimage)

## Pages

- [Graph Explorer](https://www.subimage.io/product/explorer.md)
- [Vulnerability Management](https://www.subimage.io/product/vulnerability-management.md)
- [Attack Path Analysis](https://www.subimage.io/product/attack-path-analysis.md)
- [Cloud Security Posture Management](https://www.subimage.io/product/cspm.md)
- [Identity Security](https://www.subimage.io/product/ciem.md)
- [Modules](https://www.subimage.io/modules.md)
- [Pricing](https://www.subimage.io/pricing.md)
- [Support](https://www.subimage.io/support.md)
- [Mission](https://www.subimage.io/mission.md)
- [Trust center](https://www.subimage.io/trust.md)
- [Blog](https://www.subimage.io/blog.md)
- [Documentation](https://docs.subimage.io)