Our posture
What we touch, and what we never do.
Every tool is built so that letting it in is a small, legible risk: it reads, it logs every call, anything it puts in your account is a template you deploy and can delete, and none of your data ever reaches us. We make the tools. Vantalect runs the engagements. You own every stack, role, key, and output in your accounts.
Invariants every tool keeps
A tool that cannot keep one does not ship.
Read-only unless a signed authorization says otherwise.
The survey, continuous-assessment, and pursuit tools run every call through a guard that admits only read operations, and their roles carry SecurityAudit plus explicit denies. Only two tools act: the external-testing tool, only inside its double key, and the forensics tool, only on your own forensic account and the copies in it, never on the suspect machine. No tool runs containment or remediation on its own: containment is proposed and you approve it, and fixes are pull requests a person merges.
One identity model.
Every tool names a cloud resource the same way: its ARN, with its account, Region, tags, relationships, and the infrastructure as code that declares it. A join that cannot be made is recorded as a gap, never guessed.
One judgment vocabulary.
Pass, fail, not applicable, or insufficient data. A rule never passes on data it did not get, and finding ids are stable, so scans diff and annotations survive a rescan.
A missing number is a gap.
Every number carries its sources and provenance. An unavailable fact is never shown as a zero, an empty list, or a pass.
Versioned methodology.
Scores come from a versioned methodology. Accepted risk, remediation, and suppression never turn a failure into a pass; an adjusted view carries its own identity beside the raw one.
Compiled where it runs in your account.
Everything installed in your account ships as signed binaries, never source. The templates you deploy are plain CloudFormation you can read.
Acumen Defensive holds no client data.
No shard, finding, capture, key, or log from a client estate ever reaches an Acumen system. We test against sample clients we invent, and against fixtures only when a client has consented and Vantalect has sanitized them.
Read-only by construction
The guard sits before the signature.
The read-only tools share one rule, enforced three ways.
In the SDK.
Every AWS call passes a guard before the request is signed, so no code path goes around it. It admits only Describe, List, Get, Lookup, Search, BatchGet, Filter, Download, and Simulate operations; it refuses reads that expose secrets or customer data; and it fails closed on any name that looks like secret material. A test walks every operation in the installed SDK to keep it honest.
In the log.
Every attempted operation is written down, and the report lists exactly what was touched.
At IAM.
The roles you deploy carry the AWS SecurityAudit policy plus explicit denies on the same secret-exposing reads, so the boundary holds even if our code were wrong.
Interceptor adds three narrow, named exceptions: reading objects from your log bucket and prefix, receiving and deleting messages on its own queue, and running SELECT-only CloudTrail Lake queries.
Who holds what
Your data flows between you and Vantalect, never to us.
| Concern | Acumen Defensive | Vantalect | You |
|---|---|---|---|
| Source code, rule packs, methodology | Builds, versions, and signs them | Reports defects and needs | — |
| Engagements, scans, cases, tests | Never | Always | Authorizes, approves, deploys roles |
| Client relationship, statement of work, pricing | — | Owns | Signs |
| Footprint in your accounts | Writes the templates | Specifies what to deploy | Owns and deploys every stack and role |
| Client data and keys | None | Engagement evidence, under the engagement terms | Your accounts, keys, and outputs |
| Containment and remediation | — | Proposes runbooks and opens pull requests | Approves, runs, and merges |
A footprint you own
Every tool, side by side.
| Tool | What it needs from your environment | Where the data lives |
|---|---|---|
| Pathfinder | Your accounts. A read-only role in each in-scope account, which you deploy as a StackSet from your management account. It trusts only the scanner's worker role, with an external ID, and carries SecurityAudit plus explicit denies on secret-exposing reads. Where it runs. A Step Functions state machine in an engagement account you create inside your own organization. You own the account, the stack, the bucket, and the key; Vantalect operates the run. Everything installed there ships as signed binaries, never source. Other read access. Your Cost and Usage Report prefix, and your IaC repositories when the statement of work includes IaC review. | Encrypted under your key, in your engagement account. Engagement evidence is held by Vantalect under the engagement terms. Acumen Defensive holds none of it. |
| Sentinel | Your accounts. The same read-only roles the survey uses (one StackSet serves both), and a stack in an account you own. Everything is plain CloudFormation you can read. Vantalect's access. One read-only role you grant, scoped to the export prefix, with no bucket policy: an identity-based Allow, Block Public Access on all four settings, and default SSE-KMS. | In your own account: your key, your bucket, your outputs. It leaves only when the role you granted is assumed. |
| Interceptor | Forwarder. A CloudFormation StackSet you deploy to every member account and Region, plus a stack in the management account and a forwarder in us-east-1 in every account. Central bus and queue. In your audit account: an event bus that accepts only your organization's forwarders, and an encrypted queue. Roles. A read-only role it assumes; a containment role that SSM assumes only after your approver approves and that cannot edit its own policies; and an operator policy that can start only the containment documents you registered, at a pinned version. | One case file on the Vantalect consultant's machine, with every AWS call written beside it, held under the engagement terms. Acumen Defensive holds none of it. |
| Drydock | Your forensic account. An isolated account inside your own organization: no internet egress, its own KMS keys, evidence in S3 Object Lock, and a clean analysis image built from a recipe you can read. Vantalect operates there through a role you grant in that account only. Affected accounts. No credential of its own. Operators may start only the forensic documents you registered, at a pinned version; your approver approves, and Systems Manager runs them under your role, which can capture, snapshot, copy, and share and cannot edit its own policies. | Every disk and memory image stays in your forensic account. The custody record and hashes are kept by Vantalect, and only reviewed findings reach Pavilion. Acumen Defensive holds none of it. |
| Red Cell | Your accounts. None. It holds no credential into your AWS accounts. Your endpoints. Only targets admitted by both keys, from Vantalect-controlled test infrastructure whose egress addresses are named in the rules of engagement, inside the permitted windows. | Captured evidence is your data: isolated per client, encrypted at rest, and destroyed at engagement close under Vantalect's data-handling policy. Acumen Defensive holds none of it. |
| Aegis | Your accounts. None. It never connects to a cloud account. Your code. Read access to the repositories you grant, scanned from Vantalect's environment, or a signed runner you place in your own CI. | With the engagement, held by Vantalect under the engagement terms. Acumen Defensive holds none of it. |
| Overwatch | Your accounts. None. It touches no client account itself; the tools it starts work under the roles you deployed. Where it runs. Vantalect's own AWS account. | Engagement evidence, under the engagement terms, in Vantalect's environment. Acumen Defensive holds none of it. |
Propose, never execute
Your approver holds the switch.
When Interceptor finds what an intruder holds, it writes the containment as an SSM Automation document with an approval step. You register the documents. An operator policy lets Vantalect’s people start only those registered documents, at a pinned version. The role that makes the change acts only after your approver approves, and it cannot edit its own policies. Interceptor itself holds no write credential, and Pathfinder’s fixes are pull requests a person on your side merges.
Put the tools to work
Engagements run through Vantalect.
Acumen Defensive builds the tools and runs no engagements of its own. Vantalect delivers every engagement that uses them, with the scope and price of each published at vantalect.com.
Vantalect, LLC is a separate company that licenses and operates these tools.