Skip to content

Cloud Security Posture ManagementAvailable

Posture management that never phones home.

kaveo is a cloud security posture manager that finds and evidences misconfigurations across your clouds, for teams whose data cannot leave their own environment.

Book a demoTalk to us
Data egress
None
IAM access
Read-only
Deployment
Your own environment
Findings
Evidence-backed

Architecture

One container. Your VPC. No vendor data plane.

kaveo deploys inside your own environment. It assumes a read-only role per account, snapshots configuration through the provider APIs, evaluates detection rules locally, and writes findings to a store you own. Collection, the reachability graph and detection all run on a provider-neutral model, so AWS, Azure, GCP and Kubernetes produce the same finding shape. There is no SaaS control plane, no outbound tunnel, and nothing to allow-list.

Read-only by construction

The scanner role carries AWS-managed SecurityAudit and ViewOnlyAccess policies, constrained by a per-install external ID. It cannot write, remediate, or mutate anything.

Findings you can trace

Every finding stores the raw API responses that produced it — timestamped, replayable, exportable as an audit packet.

Air-gap capable

Runs with zero outbound connectivity. Detection content updates arrive as signed bundles you move across the boundary yourself.

The trust policy kaveo installs — diff it before you deploy
{
  "Version": "2012-10-17",
  "Statement": [{
    "Effect": "Allow",
    "Principal": {
      "AWS": "arn:aws:iam::YOU:role/kaveo-scanner"
    },
    "Action": "sts:AssumeRole",
    "Condition": {
      "StringEquals": {
        "sts:ExternalId": "<per-install>"
      }
    }
  }]
}

Coverage

Deep on AWS, honest about the edges.

On AWS — the deepest coverage — that means IAM, S3, EC2, VPC, RDS, KMS, CloudTrail and the services misconfigurations actually hide in. Azure, GCP and Kubernetes collectors are opt-in and register their own detectors. The console shows what was checked and what could not be, per account and per service — no implied 100%.

Identity and access

Over-broad policies, unused credentials, missing MFA, risky trust relationships.

Data exposure

Public buckets, permissive snapshots, unencrypted stores, cross-account grants.

Network paths

Open security groups, unintended internet-facing surfaces, flat VPC peering.

Logging and detection

CloudTrail gaps, missing data events, disabled or unmonitored alarms.

Deployment

Deployed in an afternoon, verified line by line.

Terraform module

A reviewable module that creates the role, external ID, and scanner in one plan.

CloudFormation template

The same footprint for CloudFormation shops, parameterized per account.

docker-compose

For evaluation: run it on a laptop against a sandbox account in minutes.

See kaveo against your architecture.

Book a demoTalk to us