Cloud Security Beta · Security Platform

One pane for every cloud.

Continuous misconfiguration scanning correlated with live agent telemetry, native ingest from each cloud's security-findings service, and ephemeral sandbox detonation in your tenant's compliance region. Cross-cloud, cross-source, single-priced.

Not available yet. This page describes the Security Platform we are building; ACOG is the product you can use today.

Talk to us See what's available now

What CSPM means in Tessarac

Misconfiguration findings that know what your hosts actually do.

The competition's CSPM tells you what's open. Tessarac's tells you what's open AND whether anything legitimate has used it in the last 30 days. The difference is the agent telemetry — when CSPM and Sentinel agree on the lockdown recommendation, you can ship it without breaking workloads.

  • Network exposure, IAM hygiene, encryption gaps, logging gaps, resource hygiene — across every account in every cloud
  • Cross-source correlation — one finding, evidence from cloud state + agent telemetry + audit log
  • IPv6 readiness rules — flag dual-stack-incapable VPCs against the OMB M-21-07 federal mandate
  • Cost anomaly detection with IAM principal attribution — not just 'spending went up' but 'this role's spending went up'
  • Drift detection vs. your own Terraform / Pulumi / CDK state — surface manual changes that bypassed change control

Built into the platform — not bolted on

Every CSPM finding lands in the same audit log, severity model, and approval workflow as the rest of Tessarac. One incident response surface, every cloud.

  • Native ingest from cloud security suites

    Every major cloud's posture / threat-detection / security-findings service — Tessarac pulls findings, deduplicates across sources, and merges them into a single per-tenant view.

  • Ephemeral sandbox detonation

    Suspect file? We spin a sandbox in your tenant's compliance region, detonate, capture the indicators, then tear it down. Pay-per-detonation, near-zero idle cost, no cross-tenant data exposure.

  • Cross-cloud workload identity

    Workloads in every major cloud all enroll with the same Tessarac identity broker. No more per-cloud IAM acrobatics; one policy plane, every cloud.

  • Compliance-aware regional placement

    Per-tenant compliance presets are designed to route detonations, log shipping, and LLM analysis to the appropriate region, including US-only inference for federal tenants once that environment exists, without operator config.

Compliance

Designed to be sovereign-ready.

The Federal plan is designed for a sovereign US-only environment built to the FedRAMP High baseline: STIG-hardened images, FIPS 140-3 validated cryptography, and smart-card sign-in for every operator account. None of this is available or authorized today.

  • FedRAMP High — on the roadmap; no assessor or sponsoring agency is engaged yet
  • DoD IL5 — on the roadmap; it would follow FedRAMP High
  • CMMC 2.0 L2 / L3 — on the roadmap; not started
  • ITAR / CJIS / IRS Pub 1075 — designed for deployment inside the customer's own boundary

See your cloud surface end-to-end

The Security Platform is in beta. Talk to us about connecting a read-only IAM role as a design partner.

Get a demo Read the docs