Security posture management for cloud, SaaS & on-prem
See the risks
your SIEM can't.
Cloudefend reads the security configuration of 75 systems — from AWS and Microsoft 365 to FortiGate, Veeam and CyberArk — and shows what an attacker could exploit before anything happens. Read-only. Agentless. Evidence included.
The blind spot
A risky setting is silent until someone uses it
SIEMs watch events: they tell you what happened. But a sharing link open to anyone, an admin without MFA or a backup that ransomware can delete produce no log at all — until they are abused. Many SaaS and on-prem products can't even send logs to a SIEM, or only on premium licences. Cloudefend reads the configuration itself, so you see the exposure first.
Cloudefend complements your SIEM — it is not a real-time threat detection tool.
| SIEM | Cloudefend | |
|---|---|---|
| Question it answers | What happened? | What could happen? |
| Data source | Logs and events | Live configuration via read-only APIs |
| Products without log export | Not visible | Covered through their APIs |
| Dormant accounts, missing controls | Absence of logs raises no alert | Reported as findings |
| Its own health | Rarely notices missing data | Checks SIEM feeds, DLP, scanners, backups |
| Time to value | Pipelines, parsers, rules | API key, first scan in minutes |
Real checks
Findings no log would have told you about
- HighPower BI'Publish to web' is enabled for the entire organization
- HighGoogle WorkspaceSuper admins without 2-Step Verification
- HighVeeamNo immutable or hardened backup repository
- HighGoogle SecOpsAn ingestion feed is in a failed state
- HighMicrosoft 365Inbox rules forward mail to external domains
- MediumF5 BIG-IPDefault SNMP community is configured
- MediumLucidAdministrator uses a consumer e-mail domain
- MediumOktaSMS and security-question authenticators are enabled
- MediumAkamaiWAF attack groups only alert on production
Why Cloudefend
Built to be trusted by security teams
Beyond the cloud
Cloud, SaaS, identity, PAM, firewalls, DLP, backup, device management and social media in one finding and scoring model — not just AWS, Azure and GCP.
Watches the watchers
Detects silent failures of your security stack: failing SIEM feeds, stale vulnerability scanner plugins, untriaged DLP incidents, failed backup jobs.
Honest results
Missing data, permission errors and unlicensed features are never shown as 'passed'. Blind spots are reported as clearly as findings.
Read-only by design
Enforced in code: GET-only HTTP client, allow-listed read endpoints, an AWS guard that blocks anything but Describe/List/Get. No agents, no changes.
Minimal data
Only what a decision needs is stored. No e-mail or DLP incident content, no vault item titles, passwords, connection strings or device serial numbers.
Vendor scores, one view
Microsoft Secure Score, Salesforce Health Check and Supabase Security Advisor results next to Cloudefend's own checks, in one transparent risk score.
Audit-ready evidence
Every finding shows observed vs. expected values, remediation steps and framework mappings, with deduplication, history and regression tracking.
Minutes to value
Connect with a read-only key and run the first scan. No log pipelines, parsers or detection rules to write.
How it works
From API key to prioritised findings
- 1
Connect
Add a read-only credential. Secrets are envelope-encrypted and never shown again.
- 2
Validate
A real API call checks permissions; missing ones are named, not ignored.
- 3
Assess
Assets and settings are collected and evaluated against 663 deterministic policies.
- 4
Track & report
Findings are deduplicated, resolved only by a successful re-check, and exported as PDF/CSV reports.
Coverage
75 sources and growing
Cloud & data platforms
- AWSAWS
- AzMicrosoft Azure
- Google Cloud
- Cloudflare
- Akamai
- DigitalOcean
- Vultr
- Huawei Cloud
- Firebase
- Supabase
- MongoDB Atlas
- RxRackspace
- CloudAMQP
- OCIOracle Cloud (OCI)
- Teradata Vantage
Collaboration & SaaS
- 365Microsoft 365
- TMicrosoft Teams
- BIPower BI
- SFSalesforce
- SlSlack
- Jira Cloud
- nowServiceNow
- Zendesk
- Claude
- AIOpenAI / ChatGPT
- Google Gemini
- Lucid
- WP Engine
- Dropbox
- Figma
- UiPath
- Asana
- Atlassian & Rovo
- Box
- Intercom
Identity, secrets & privileged access
- IDMicrosoft Entra ID
- Okta
- Google Workspace
- CACyberArk
- HashiCorp Vault
- KVAzure Key Vault
- LastPass
- 1Password
- FBFireblocks
Development & endpoints
- GitHub
- GitLab
- DOAzure DevOps
- InMicrosoft Intune
- JJamf Pro
- Cursor
- TmTestmo
- Linear
- GitBook
Network, security & DLP
- FortiGate
- FortiMail
- F5 BIG-IP
- QRIBM QRadar
- Google SecOps
- TnTenable Security Center
- FpForcepoint DLP
- SySymantec DLP
- Cortex XSOAR
- Palo Alto Firewall
- Prisma Cloud
- Cisco Secure Email
- SEPSymantec Endpoint Protection
Observability, virtualisation, backup & social
- Grafana
- Elastic
- VMware vSphere
- Veeam
- 24Site24x7
- SSLTheSSLStore
- Facebook & Instagram
- inLinkedIn
- TikTok
Logos are trademarks of their owners and identify integrations only. Integration maturity (available / partial) is shown in the product for every source.
Mapped to the frameworks your auditors use
- CIS Controls v8
- NIST SP 800-53 Rev. 5
- Microsoft Cloud Security Benchmark
- CIS AWS Foundations
- CIS Microsoft Azure Foundations
- CIS Google Cloud Foundation
- CIS Google Workspace Foundations
- CIS Microsoft 365 Foundations
Mappings are evidence references, not a certification.
Trust
A security product should be secure itself
Envelope encryption
Credentials are encrypted with AES-256-GCM and a key per secret; the master key stays outside the database (KMS in production).
Tenant isolation
Every query is scoped to your organization and verified by automated tests.
Role-based access
Owner, Admin, Analyst and Viewer roles, checked on every request.
Audit trail
Connections, scans, exports and permission changes are logged.
Safe outbound calls
Customer-supplied endpoints are validated against SSRF; TLS verification can never be turned off.
Deploy your way
Multi-tenant SaaS, a dedicated instance, or self-hosted inside your network.
Frequently asked questions
Does Cloudefend replace our SIEM?
No. It complements it: the SIEM detects attacks as they happen, Cloudefend shows the configurations that make them possible — including in products whose logs never reach the SIEM.
Will it change anything in our systems?
No. Cloudefend only reads. Where a vendor offers read-only credentials we require them; where it doesn't, the documentation says so and the connector still sends read requests only.
What data do you store?
Configuration values needed to evaluate a policy, plus identifiers for evidence (for example a username). Message contents, files, secrets and incident payloads are never collected.
What if a permission or licence is missing?
The affected checks are reported as 'not evaluated' with the reason, so you know exactly what was and wasn't covered.
Can it run on-premises?
Yes. Cloudefend can be self-hosted for environments with strict data residency or outsourcing rules.
See your security posture after the first scan
Free pilot: connect a few critical systems read-only and review the first findings and executive summary together with our team.
- Agentless
- No changes to your systems
- Encrypted credentials