# Subimage

> Subimage is an open-core security graph, investigation tool, and CNAPP for your infrastructure. Built by the people who made CNCF Cartography, it maps cloud, SaaS, identity, and vulnerability data into a graph so security teams can understand exposure, find attack paths, and prioritize remediation.

Every page on the Subimage website has a LLM-friendly markdown twin. Where possible, the links below lead to the markdown twins instead of the human-friendly version.

## Primary Links

- [Home](https://www.subimage.io/index.md)
- [Pricing](https://www.subimage.io/pricing.md)
- [Mission](https://www.subimage.io/mission.md)
- [Documentation](https://docs.subimage.io)
- [Cartography](https://github.com/cartography-cncf/cartography)
- [Book a demo](https://cal.com/team/subimage/chat-with-subimage)

## Product Areas

- [Modules](https://www.subimage.io/modules.md): A list of sources and integrations from which Subimage ingests objects, configuration, logs, trails, findings, and more.
- [Graph Explorer](https://www.subimage.io/product/explorer.md): Ask complex questions that static rules can't cover, and explore the evidence yourself.
- [Vulnerability Management](https://www.subimage.io/product/vulnerability-management.md): Cloud vulnerability management that ranks every CVE by whether it's exploitable in your environment, routes it to its owner and opens the fix as a PR.
- [Attack Path Analysis](https://www.subimage.io/product/attack-path-analysis.md): Attack path analysis that chains exposed services, CVEs, IAM roles, Okta and GitHub into paths to your secrets, then opens the fix PR. Find yours first.
- [Cloud Security Posture Management](https://www.subimage.io/product/cspm.md): Cloud security posture management (CSPM) for AWS, GCP and Azure that ranks every misconfiguration by what an attacker can reach. See what to fix first.
- [Identity Security](https://www.subimage.io/product/ciem.md): CIEM and identity security posture management on one graph: every person, service account and key that can reach prod. Connect Okta and AWS in minutes.

## Other Links

- [Support](https://www.subimage.io/support.md)
- [Skills](https://skills.subimage.io)
- [Status](https://status.subimage.io)
- [Careers](https://www.ycombinator.com/companies/subimage/jobs)

## Trust Center

- [Trust Center](https://www.subimage.io/trust.md)
- [Privacy Policy](https://www.subimage.io/trust/privacy.md) (legal)
- [Terms of Use](https://www.subimage.io/trust/terms.md) (legal)
- [Data Processing Agreement (DPA)](https://www.subimage.io/trust/dpa.md) (legal)
- **SOC 2 Type II** (compliance). Not published. Request access from founders@subimage.io.

## Blog

- [Blog](https://www.subimage.io/blog.md)
- [How Corelight automated security alert triage with Subimage](https://www.subimage.io/blog/corelight-case-study.md) (2026-07-22): Corelight's autonomous triage agent had 30 tools to choose from. It used the Subimage graph twice as often as anything else.
- [Adding Scaleway to Cartography without rewriting vulnerability management](https://www.subimage.io/blog/full-chain-vulnerability-management-2026.md) (2026-07-21): How shared graph concepts let a new cloud provider reuse the existing path from a running container to a CVE, fix, source repository, and owner.
- [Screwing up vulnerability management at scale, and building a startup to fix it](https://www.subimage.io/blog/screwing-up-vuln-mgmt-at-scale.md) (2026-07-13): Introducing Subimage Issues: the vulnerability remediation loop I always needed but could never build
- [What it's like being the only security company in your YC batch](https://ventureinsecurity.net/p/what-its-like-being-the-only-security) (2026-06-18 on Venture in Security): Alex Chantavy's guest post on Venture in Security about building Subimage through YC and why security startups follow a different playbook.
- [Shift-right: attack path analysis that never wastes a good incident](https://www.subimage.io/blog/shift-right-attack-paths.md) (2026-04-09): Each incident response should leave fewer attack paths than the last
- [Cartography inventories AI agents in cloud environments](https://cartography.dev/blog/aibom) (2026-03-12 on Cartography): Alex Chantavy's Cartography post on using AIBOM scans and infrastructure graph context to find AI agents, the tools they use, and what they can reach.
- [How Veriff Evaluated React2Shell Risk Across 600 Repos in Minutes With Subimage](https://www.subimage.io/blog/veriff-case-study.md) (2026-01-20): 7 million findings and a different approach
- [How we used Subimage to fix React2Shell on our own infrastructure](https://www.subimage.io/blog/react2shell.md) (2025-12-08): How we used Subimage to fix React2Shell on our own infrastructure
- [We've raised $4.2M](https://www.subimage.io/blog/funding.md) (2025-10-20): We're funded, and here's where we're going next!
- [Unifying the Graph: Why We Introduced an Ontology in Cartography](https://blog.jychp.me/unifying-the-graph-why-we-introduced-an-ontology-in-cartography-33b9301de22d) (2025-06-16 on Medium): How Cartography's ontology adds a shared semantic layer for correlating users, devices, vulnerabilities, and other entities across data sources.