StrataForge Robotics (a sample client) · PDF, 11 pages
Audit Sponsor Readout
What an attacker could reach today, the critical findings, the decisions the sponsor has to make, and the four weeks of hardening that follow.
The read-only engine
Pathfinder
The whole estate, read-only.
It surveys an AWS organization at a point in time: it inventories every in-scope resource, judges them against versioned rule packs, measures cost, compares the infrastructure as code you declared with what is running, and exports the facts a report reads. Every other tool in the suite stands on it.
What it does
How it works.
Inventories the estate.
Every in-scope resource becomes a typed record, compressed and encrypted under your key. Every attempted operation is in a collection log, and no raw API response is stored.
Judges it.
Versioned rule packs and framework crosswalks, with four answers only: pass, fail, not applicable, or insufficient data. A rule never passes on data it did not get, and finding ids are stable, so two scans diff.
Measures cost.
From your Cost and Usage Report and the AWS Price List: the spend, the priced alternatives, and the savings a report can be held to.
Reviews your infrastructure as code.
The same rules run against CloudFormation, Terraform, CDK, or Pulumi as declared. A fix becomes a pull request in your own IaC language that a person on your side merges.
Exports the facts.
One document per report part, each carrying its sources, its provenance, and its gaps, reviewed by a consultant before anything reaches a client.
By design
What it never does.
- Writes to a target account. A guard admits only read operations and refuses reads that expose secrets or customer data before a request is signed: no GetSecretValue, no GetPasswordData, no GetObject outside a named log bucket, no DynamoDB Query or Scan.
- Stores a raw API response.
- Passes a rule on data it did not get.
- Merges its own pull request.
Footprint
What it touches in your organization.
- Your accounts
- A read-only role in each in-scope account, which you deploy as a StackSet from your management account. It trusts only the scanner's worker role, with an external ID, and carries SecurityAudit plus explicit denies on secret-exposing reads.
- Where it runs
- A Step Functions state machine in an engagement account you create inside your own organization. You own the account, the stack, the bucket, and the key; Vantalect operates the run. Everything installed there ships as signed binaries, never source.
- Other read access
- Your Cost and Usage Report prefix, and your IaC repositories when the statement of work includes IaC review.
- Where the data lives
- Encrypted under your key, in your engagement account. Engagement evidence is held by Vantalect under the engagement terms. Acumen Defensive holds none of it.
In Vantalect’s engagements
See it at work.
StrataForge Robotics (a sample client) · PDF, 13 pages
Analysis Sponsor Readout
The baseline, the savings ranked, the decisions the sponsor has to make, and what the next four weeks put in place.
- AWS Security, Compliance & Governance Audit: Pathfinder is the primary tool. The application-security tool joins when the statement of work includes your IaC and pipeline code; continuous assessment keeps the gate measured afterward, and external testing proves what the audit found.
- AWS Cost Analysis & Optimization: Pathfinder is the primary tool. Continuous assessment holds the savings after the engagement ends.
- AWS Well-Architected Framework Review: Pathfinder is the primary tool. The application-security tool reads the reviewed workload's code.
- AWS Multi-Account Foundation: Pathfinder is the primary tool. Continuous assessment keeps the guardrails measured.
- AWS Incident Response and Breach Forensics: Pathfinder is the companion tool. The pursuit tool follows the intruder across the control plane, the forensics tool examines the machines it touched, and the survey supplies the estate snapshot and rescans what the intruder reached.
Put the tools to work
Engagements run through Vantalect.
Acumen Defensive builds the tools and runs no engagements of its own. Vantalect delivers every engagement that uses them, with the scope and price of each published at vantalect.com.
Start an engagement at vantalect.com
Vantalect, LLC is a separate company that licenses and operates these tools.