Cloud security
Read-only audits.
Real CIS controls.
Audit every cloud account with read-only keys that never leave your server. Each finding names the CIS control it fails, so your cloud team knows exactly what to change.
AWS production account
Read-only audit ยท eu-west-1, us-east-1
| CIS control | Check | Result |
|---|---|---|
| 1.4 | No access keys on the root user | Pass |
| 1.10 | MFA for every console user | Fail |
| 2.1.4 | Block public access on S3 buckets | Fail |
| 3.1 | CloudTrail enabled in all regions | Pass |
| 5.2 | No security group open to 0.0.0.0/0 on admin ports | Fail |
CIS AWS Foundations Benchmark v3.0
What it does
- AWS, Azure and Google CloudOne audit per account, subscription or project.
- Identity firstIAM users, roles and policies, including privilege escalation paths.
- ExposurePublicly reachable storage, databases and services.
- CIS on every findingEach finding names its CIS benchmark control, for example CIS AWS Foundations 2.1.4.
- Read-only by designThe audit never creates, changes or deletes a resource.
- Keys stay sealedCredentials are encrypted with AES-256-GCM per project and never shown in a browser.
What you get
- Findings with the failing CIS control
- A report per account
- Posture history across scans
- Findings in the same tracker as every other scan
Mapped to
- CIS AWS Foundations
- CIS Azure Foundations
- CIS Google Cloud Foundations
How it works
- Grant read-only accessAn access key, a service principal or a service account key.
- Run the auditOne account at a time, as often as you like.
- Fix by controlEvery finding tells you the control and the change.
Documentation
Read the details
Setup, every option and the API, on docs.cerberon.dev.
Common questions
What access does a cloud audit need?
Read-only permissions. The audit sees only what the credential allows and never changes anything.
Where are my cloud keys stored?
On your server, encrypted with AES-256-GCM, and passed only to that scan's worker.
See it on your own systems.
A 30-minute demo on your targets, or install it yourself and start scanning this afternoon.