Cloud misconfigurations, ranked by where they lead
Severity says how bad a misconfiguration is anywhere. Reach says how bad it is in your cloud. IMDSv1 on a box behind a public load balancer with an admin role outranks IMDSv1 on an internal batch node. Findings on an attack path go to the top. Approve the fix and it opens as a Terraform pull request.
Checks that name the resource and the reason
- EC2 instances that still allow IMDSv1, one SSRF away from leaking role credentials
- Public EBS snapshots, RDS snapshots and AMIs
- IAM roles that trust external AWS accounts
- Root users without MFA or with access keys
- GitHub workflows running unpinned third-party Actions
- GuardDuty switched off, Security Hub missing from active regions, and CloudTrail that doesn't cover every region
Every cloud, checked the same way
A public bucket is a public bucket, wherever it lives.
- GCP firewall rules that open SSH or RDP to the world, and projects still on the default network
- Azure storage accounts with public blob containers, and SQL servers that accept TLS below 1.2
- Public buckets in S3, GCS, Cloudflare R2, Scaleway and Supabase
- Internet-exposed RDS, Cloud SQL, Azure SQL and Cosmos DB
Frameworks your auditor already asks for
- CIS AWS, CIS GCP, CIS Kubernetes and CIS Google Workspace
- SOC 2, ISO 27001 and NIST AI RMF
- A daily score, with the exact rule that moved it
- Every result and accepted exception exportable, with the reason attached
Write your own rules in Cypher
If you can ask it of the graph, you can check for it every hour. Turn "every laptop runs Tailscale" or "no S3 bucket goes public again" into a Cypher rule that reruns after each sync. Your agents can read findings and write new rules over MCP.
Why teams switch from other CSPM tools
- 56 read-only integrations in one graph, so findings show what they touch and land in Slack, Linear or Jira with an owner attached
- Every built-in check is open-source Cypher in Cartography, the CNCF project our team created and still maintains
- Single-tenant or in your own cloud, on fixed annual pricing
- Keeping your current CSPM vendor? Subimage imports Wiz and Orca findings onto the same graph and adds the owner, the code and what the resource can reach.