Cloud Evidence That Actually Evaluates
Collecting evidence was never the hard part. Producing a verdict you can defend is.
This release connects the last link in that chain. Every integration operation now decodes its own response, evaluates its assertions, and writes a real verdict against the control — and the failure modes that used to resolve silently in your favor no longer do. An AccessDenied used to arrive as evidence with zero records, which made a "no critical Security Hub findings" check pass. XML from IAM, EC2, and S3 was never decoded, so those checks were reading an empty array. A relative-date predicate compared ISO strings against the literal text CUTOFF_PLACEHOLDER. Each of those failed by attesting a control rather than by erroring, which is the only kind of bug that matters here.
Now an undecodable response fails its region, empty evidence returns inconclusive and attests nothing, an incomplete sync run is excluded from coverage, and every failing check raises a finding with the evidence attached.
The connector estate grew to match. AWS sync spans multiple accounts, multiple regions, and AWS Organizations — fanning out with per-account failure isolation, stamping every record with its account and region, and offering chained role access for estates that will not run StackSets. Supabase, Vercel, Netlify, and GitHub cover the teams whose production footprint is a PaaS stack, where hosting, database, and deploy pipeline previously produced no automated evidence at all.
- Approved exceptions can satisfy a check — pointed at specific records, requiring a real approver, and expiring on their own, so an accepted risk is not a permanent carve-out
- Agent skills bundle instructions, tools, and when-to-use guidance, loading on demand instead of on every turn, with provenance-aware approvals and asynchronous sub-agents
- Programs report against individual boundaries, with account and region scope rules that finally make the PCI CDE case reachable
- Assessments scoped to a program inherit its controls and every piece of evidence already on file
- A desktop app with tabs, persisted per workspace and reorderable by drag
- AI spend attributed by surface and operation, with a usage report that reconciles itself
- CSP enforced, privileged RPCs behind the service role, and a security pass that closed every advisor finding
Open Signup, PCI DSS, and Agent-Run Vendor Reviews
The waitlist is gone — anyone can sign up. Plus full-fidelity PCI DSS ROC & SAQ assessments, an agent that runs the vendor evidence lifecycle over email, trust centers served at your own domain root, and an evidence-backed assurance dashboard.
Securing the Pipeline: Why DevSecOps Is No Longer Optional
Security can't afford to wait until after deployment. Here's how forward-thinking security leaders are embedding controls directly into the development pipeline — and why it matters more than ever.