BreachLens
Book a technical demo
Cloud Security Posture

Your cloud misconfigurations, found, evidenced, and correlated.

BreachLens checks your AWS, Azure, and GCP accounts against hundreds of CIS-aligned posture controls — then ties each finding to the code and containers around it, so a public bucket shows up next to the app that reads from it.

Book a technical demo Read the docs
AWS · Azure · GCPAgentless · read-onlyRuns on your infrastructure
breachlens · cloud
A real BreachLens cloud account — an Azure subscription with 205 posture findings, showing CRITICAL and HIGH misconfigurations like disabled Entra security defaults and a privileged user without MFA, each with the exact rule that failed.
Evidence, not a wall of alerts

A cloud posture list nobody reads.

Most CSPM tools hand you thousands of findings with no link to what's actually exposed. BreachLens attaches the exact resource and the reason it fails, and correlates it with the rest of your stack — so a misconfig becomes part of an attack path, not another row.

Connect

Read-only, per account

Connect an AWS, Azure, or GCP account with read-only access. BreachLens only ever reads posture — it changes nothing.

Assess

Hundreds of checks

CIS-aligned posture controls run across your account, each producing a finding with the resource and the reason it failed.

Correlate

Part of the attack path

Cloud findings join the same correlation engine as code and containers — an exposed resource next to the asset that touches it.

Remediate

The fix, with a safety check

BreachLens generates the concrete fix — the CLI or config change — plus an AI review of what it will do before you run it. A human approves; it never changes your cloud on its own.

What you get

Cloud findings a team can act on — with the receipts.

AWS · Azure · GCP

One posture, three clouds.

  • · The same checks and the same view across all three providers.
  • · Multi-account, grouped by application.
  • · No per-cloud dashboard-hopping.

Hundreds of checks

CIS-aligned coverage.

  • · Identity, storage, network, logging, encryption, and more.
  • · Mapped to recognised control frameworks.
  • · Consolidated per rule, so one policy gap isn't a hundred rows.

Findings with evidence

The exact resource, and why.

  • · The specific resource that fails, not a vague category.
  • · The reason it fails, in plain language.
  • · Enough detail to fix it without a scavenger hunt.

Correlated with the stack

Misconfig, meet attack path.

  • · A public resource shows up next to the app that uses it.
  • · Cloud findings join cross-tier attack chains.
  • · Posture you can prioritise, not just enumerate.

The fix, reviewed

Remediation you approve — not automation you fear.

  • · A concrete remediation — the CLI or config change — generated per finding.
  • · An AI before-you-apply review of what the change will actually do.
  • · A human always approves; BreachLens never changes your cloud on its own.

Catch it in the Terraform

Shift-left and posture, one platform.

  • · BreachLens also scans your IaC — Terraform, Kubernetes, and cloud config.
  • · The misconfiguration is flagged before it ever reaches the account.
  • · Prevent it in code and detect it live, without a second tool.
breachlens · attack-paths
A BreachLens cross-tier attack path that includes a cloud misconfiguration correlated with the code and container findings around it, scored and carrying an AI verdict.
A cloud misconfiguration, correlated into a cross-tier attack path — sitting next to the code and container findings around it.
Straight answers

What a cloud team asks about CSPM.

Which clouds are supported?
AWS, Azure, and GCP — the same posture checks and the same correlated view across all three.
What access does it need?
Read-only. BreachLens reads posture and never modifies your cloud. Keyless and federated onboarding — role assumption and workload identity — are on the roadmap; today it takes read-only credentials.
Are the checks tied to a framework?
Yes — the controls are CIS-aligned and consolidated per rule, so a single policy gap surfaces as one finding across all the resources it affects rather than a thousand near-duplicate rows.
Does it remediate the misconfigurations too?
It generates the concrete fix — the CLI command or config change — with an AI review of what it will do before you run it. A human always approves; BreachLens never changes your cloud on its own. Auto-apply isn't the default, by design: you stay in control of every change to your environment.
Where does it run?
On your infrastructure. Your cloud metadata and findings stay inside your deployment — it can run fully air-gapped against the accounts you connect.
See your cloud posture

See a misconfig become part of an attack path.

Book a 30-minute technical demo. We'll connect a read-only cloud account and show you the findings, the evidence, and how they correlate with the rest of your stack.

Book a technical demo Read the docs
Self-hosted · air-gap capable · your data never leaves your network