Continuous assessment in your account

Sentinel

The estate, between engagements.

The same engine as the survey, with the same binaries, rule packs, and methodology, installed as a stack you own. It measures posture and cost between engagements, not only at week one and week six, on a schedule and on change: a resource is re-judged minutes after it changes.

What it touches in your organization Start an engagement at vantalect.com
A lone lighthouse on a rocky headland at night, its beam sweeping across a dark sea.A lone lighthouse on a rocky headland on a bright, hazy morning above a pale sea.

What it does

How it works.

  1. Runs on a schedule.

    Each run is a full scan: inventory, findings, and facts, written to a bucket in your own account. Stable finding ids make the series diffable, and any scan can be bound to an engagement as a measured point.

  2. Runs on change.

    A CloudTrail event re-reads just the changed resource with the same collector code and re-judges its rules at once. It consumes the event bus the pursuit tool already uses, so you run one event footprint, not two.

  3. Lets Vantalect read only what you grant.

    Vantalect reads the exports by assuming a read-only role you grant in that account, scoped to the export prefix. You can revoke it at any time.

  4. Licenses offline.

    A signed license file, verified offline and bound to your organization. No telemetry, and no license check-in.

By design

What it never does.

  • Changes anything outside its own stack.
  • Contains or remediates.
  • Sends your data to Acumen or anyone else.
  • Deletes your outputs. When a license lapses, it stops scheduling new runs and leaves everything in place.

Footprint

What it touches in your organization.

Your accounts
The same read-only roles the survey uses (one StackSet serves both), and a stack in an account you own. Everything is plain CloudFormation you can read.
Vantalect's access
One read-only role you grant, scoped to the export prefix, with no bucket policy: an identity-based Allow, Block Public Access on all four settings, and default SSE-KMS.
Where the data lives
In your own account: your key, your bucket, your outputs. It leaves only when the role you granted is assumed.
Compare every tool’s footprint

In Vantalect’s engagements

Where it fits.

  • AWS Security, Compliance & Governance Audit: Sentinel is the companion tool. The application-security tool joins when the statement of work includes your IaC and pipeline code; continuous assessment keeps the gate measured afterward, and external testing proves what the audit found.
  • AWS Cost Analysis & Optimization: Sentinel is the companion tool. Continuous assessment holds the savings after the engagement ends.
  • AWS Multi-Account Foundation: Sentinel is the companion tool. Continuous assessment keeps the guardrails measured.

Put the tools to work

Engagements run through Vantalect.

Acumen Defensive builds the tools and runs no engagements of its own. Vantalect delivers every engagement that uses them, with the scope and price of each published at vantalect.com.

Start an engagement at vantalect.com

Vantalect, LLC is a separate company that licenses and operates these tools.