Cloud posture
Your cloud accounts, checked. Your data, left where it is.
Connect AWS with a read-only role; Google Cloud and Azure are in development. orta reads configuration, checks every enabled region and maps each finding to the frameworks you track. Your objects, backups and secret values are never read.
Read-only by design
A cross-account role with the SecurityAudit policy in AWS. Posture never changes anything, and no agent runs on your instances.
Configuration, not content
Posture reads configuration only. orta never reads objects in your buckets, opens backups or fetches secret values.
Vulnerabilities without an agent (in development)
For EC2 instances without the orta agent, a temporary disk snapshot is scanned by a scanner that runs inside your own account, under a role that can only create and delete snapshots orta tagged. Only the list of installed packages leaves your account; the snapshot is deleted after the scan.
Exposed and vulnerable, first
A known vulnerability on an instance the internet can reach is the attack path that matters most. orta joins the two and puts it at the top of the list.
Hundreds of checks
Compute, identity, storage, databases, keys, Kubernetes and logging: EC2, S3, RDS, IAM, KMS, EKS and CloudTrail, from critical to informational.
Mapped to your frameworks
Each finding updates the orta controls it belongs to, and with them every framework that maps there.
Inventory and attack paths
Resources, exposure and the links between them, so you fix what an attacker would reach first.
Open to the internet, ranked first
Public IPs, internet-facing load balancers, public databases, buckets and snapshots are marked as exposed, and a risky port such as SSH, RDP or a database open to the world turns a finding high.
Open to the internet is what makes it urgent.
The same open port is a footnote inside the VPC and an emergency when the whole internet can reach it. orta marks what faces the internet, ranks those findings first and shows them closed after the fix.
Every finding, where it lives.
The account as a map: regions, VPCs, subnets and the resources in them, each ringed by its compliance state. The failing ones are where you look first.
Works with what you run.
Connects to
- AWS
In development
- Google Cloud
- Azure
Checks in AWS, for example
- EC2
- IAM
- RDS
- KMS
- S3
- EKS
- ECS
- Lambda
- CloudTrail
- GuardDuty
- and 40 more services