Frequently Asked Questions

Cloudryption is a cloud security platform that helps organizations understand, simulate, and reduce real attack paths across their cloud environments. Instead of only listing misconfigurations, Cloudryption builds a risk model of the environment and shows how attackers could move from exposed assets to sensitive data, identities, or critical systems.

Cloud environments generate thousands of alerts, misconfigurations, identity risks, and exposure findings. Security teams often struggle to know what matters most. Cloudryption helps answer:

• What is exposed?
• What can be attacked?
• What identities or data are at risk?
• Which attack paths are possible?
• Which few fixes reduce the most risk?
• What evidence supports the decision?

Cloudryption combines multiple cloud security capabilities into one decision-focused platform:

• CSPM — Cloud misconfiguration and posture analysis
• CIEM — Identity and permission risk analysis
• DSPM — Sensitive data exposure and access-risk analysis
• CWPP — Workload and runtime-aware risk context
• Attack Path Analysis — Modeling how risks connect into real compromise paths
• Decision OS — Turning evidence into objectives, competing strategies, governed action, verified outcomes, Decision Proof, and Decision Memory

The main value is carrying a security objective from evidence through decision, governance, controlled execution, verification, and proof.

Cloudryption is designed for: Cloud security teams, Security architects, SOC teams, DevSecOps teams, Cloud platform teams, CISOs and security leadership, GRC and compliance teams, and Managed security service providers.

Cloudryption focuses on decision quality and controlled outcomes. It connects findings into security state, evaluates competing FixSets, governs whether action is authorized, tracks the approved remediation plan, and verifies what actually changed. The platform is designed to answer not only "What should we fix first?" but also "Why this strategy, who approved it, what happened, and was the expected reduction verified?"

Cloudryption turns authorized cloud evidence into a governed decision lifecycle. The simplified V2 flow is:

1. Collect and normalize evidence into Current Security State
2. Define the Decision Objective
3. Identify material attack paths, crown-jewel exposure, privilege, reachability, and blast radius
4. Build competing remediation strategies and FixSets
5. Simulate expected outcomes before change
6. Apply Decision Governor policy, RBAC, safety, rollback, and approval controls
7. Create the remediation plan, owner assignments, and Cloudryption Native, Jira, or ServiceNow tickets
8. Track approved execution action by action
9. Re-evaluate post-change evidence and record the verified actual outcome
10. Create Decision Proof and preserve the lifecycle in Decision Memory

The Cloudryption decision graph is a modeled representation of the customer's cloud environment. It connects cloud assets, identities, permissions, network paths, workload context, sensitive data indicators, findings, and control evidence so risk can be evaluated as connected exposure rather than isolated alerts.

An attack path is a sequence of connected weaknesses or access opportunities that could allow an attacker to move from an entry point to a critical asset. For example:

Public exposure → vulnerable workload → attached IAM role → access to sensitive storage bucket

Cloudryption helps show the full chain, not only the individual alerts.

The Decision Control Plane establishes Current Security State, defines an explicit objective, evaluates competing strategies, applies Decision Governor controls, binds approved actions to executable contracts, tracks execution, verifies post-change evidence, and creates Decision Proof and Decision Memory.

Remediation value measures the expected security improvement of a candidate FixSet. Before change, Cloudryption labels these values as simulated expected outcomes; after execution, the platform re-evaluates evidence and records the verified actual outcome.

• Observed current state: 52 material attack paths
• Simulated expected outcome for the selected FixSet: 18 attack paths
• Verified post-change outcome: recorded only after execution and re-evaluation

This keeps prediction, execution, and verification as separate truth states.

A crown jewel is a high-value asset that could cause serious business, security, or compliance impact if compromised. Examples: Sensitive data storage, Production databases, Critical workloads, Privileged identities, Encryption keys, Customer data repositories, Business-critical applications.

Standard evidence collection and analysis use scoped, read-only cloud permissions. Write access is not required for inventory, attack-path modeling, simulation, reporting, or verification scans. Direct cloud-resource remediation is a separate capability: when enabled, it requires scoped write permissions, validated actions, Decision Governor controls, and explicit customer authorization. Native, Jira, and ServiceNow ticket creation is workflow automation and does not by itself modify cloud resources.

Cloudryption needs enough permission to read cloud configuration, identity, network, workload, and security posture information. Examples include read access to: Cloud inventory, IAM policies and roles, Storage configuration, Network configuration, Security findings, Key management metadata, Workload metadata, and Logging and monitoring metadata. The exact permission set depends on the cloud provider and features enabled.

Cloudryption does not need to copy or store customer business data to provide attack path and exposure analysis. The platform focuses on metadata, configuration, permissions, relationships, and security evidence. Where data sensitivity analysis is enabled, Cloudryption uses safe metadata, classification signals, or controlled sampling policies based on customer configuration.

Cloudryption does not store raw secrets, credentials, tokens, or sensitive data samples. If secret exposure is detected, the platform stores only safe evidence, references, metadata, or redacted indicators.

Cloudryption can operate agentlessly for cloud posture, identity, exposure, and attack path analysis. Some workload or runtime visibility features may require additional integrations depending on the customer environment.

Cloudryption uses tenant isolation controls to ensure each customer environment is separated logically and operationally, including: Tenant-based access control, Environment scoping, Role-based access control, Audit logging, Data separation, Least-privilege design, Secure API authentication, and Controlled access to evidence.

Cloudryption is designed with enterprise security principles in mind, including least privilege, auditability, access control, encryption, and secure operational practices. Formal certifications such as SOC 2 or ISO 27001 may be added as the platform matures.

Cloudryption is designed for multi-cloud security. Target coverage includes: Amazon Web Services (AWS), Google Cloud Platform (GCP), Microsoft Azure, Kubernetes, Containerized workloads, and Hybrid cloud environments. Current support may depend on the deployment version and enabled connectors.

Yes. Cloudryption is designed to analyze AWS services including: IAM roles and policies, S3 buckets, VPCs and security groups, KMS keys, EC2, Lambda, EKS, CloudTrail-related signals, Security Hub-style posture findings, Public exposure paths and identity privilege risks, and Sensitive data access paths.

Yes. Cloudryption is designed to support GCP security analysis including: Projects, IAM bindings, and service accounts, Custom roles and Cloud Storage buckets, KMS keys and VPC networks, Firewall rules, Cloud Run, Cloud Functions, Compute Engine identity attachments, and Sensitive data exposure signals.

Yes. Microsoft Azure is an available cloud connector. Cloudryption can collect authorized Azure evidence for assets, identity, permissions, network, configuration, security findings, and related context according to the enabled connector scope.

Yes. Cloudryption can be extended to include Kubernetes-related risk context such as: Cluster exposure, Workload identity and service accounts, Network exposure, Container workload relationships, and Paths from workloads to cloud identities or data.

Cloudryption does not treat a recommendation as permission to change production. The selected strategy becomes a governed remediation plan. Decision Governor, RBAC, approval, ActionContract validation, provider safety, blast radius, and rollback requirements determine whether direct execution is authorized. Customers can also keep execution human-led while Cloudryption tracks the plan and verifies the result.

V2 tracks the remediation lifecycle as an operating workflow: plan creator, accountable owner, approver, governance state, action list, ticket reference, notifications, execution status, and verification status. Work can use Cloudryption Native Tickets or synchronize with Jira or ServiceNow.

A fix set is a group of remediation actions that together reduce risk. Example:

• Remove public bucket access → Breaks external entry path
• Restrict IAM trust policy → Blocks privilege escalation
• Require private endpoint access → Reduces exposure
• Rotate exposed credential → Removes active compromise path

Yes. This is one of Cloudryption's most important capabilities. For example, removing public access from a storage bucket may eliminate many attack paths that depend on that exposure, delivering outsized risk reduction from a single action.

Cloudryption keeps truth states explicit:

• Observed: the current value supported by collected evidence
• Simulated: the expected outcome if a candidate FixSet is applied
• Executed: the action was applied or marked complete
• Verified: post-change evidence confirms the actual outcome

A simulated value is never relabeled as an actual after-value. Decision Proof compares the prediction with the verified result.

Yes. Cloudryption reduces noise by grouping isolated issues into meaningful attack paths and prioritizing fixes by risk reduction. Instead of showing 500 separate alerts, it can show 12 high-impact remediation actions that reduce 80% of reachable critical exposure.

Cloudryption can be deployed depending on customer requirements, including SaaS deployment, private cloud deployment, customer-managed deployment, or hybrid models. Contact us to discuss the right deployment model for your environment.

Initial onboarding depends on the size and complexity of the cloud environment. A basic environment can usually be connected quickly once read-only access is configured. Larger multi-account or multi-cloud environments may require additional planning for permissions, scope, and data collection.

Cloudryption is designed to integrate with cloud providers, security findings sources, SIEM tools, ticketing systems, identity providers, CI/CD systems, vulnerability scanners, compliance tools, and cloud logging services. Contact us for specific integration availability.

Yes. Cloudryption is designed with API-driven workflows so organizations can integrate findings, remediation plans, and risk context into existing security and cloud operations processes.

Cloudryption can provide risk context and prioritized findings that may be integrated into SIEM or SOAR workflows. This helps security teams enrich alerts with attack path and remediation impact context.

The dashboard shows overall risk score, critical attack paths, crown jewel exposure, exposed identities, publicly reachable assets, sensitive data exposure, top remediation actions, risk reduction opportunities, cloud coverage, recent scan status, and trends over time.

Yes. Cloudryption provides executive-level reports that explain current cloud risk posture, critical exposure paths, business impact, top remediation priorities, risk reduction progress, compliance-relevant evidence, and security improvement trends.

Findings and remediation plans can be exported or integrated into security workflows depending on the enabled deployment and integration options. Possible formats include PDF, CSV, JSON, API, ticketing system integration, and SIEM/SOAR integration.

Yes. The platform shows how risk changes over time including attack path count, exposure count, critical findings, remediation progress, crown jewel exposure, identity risk, and cloud posture improvement.

Yes. Cloudryption can help provide evidence for security controls, cloud configuration, access risks, and remediation progress. It can support programs related to cloud security governance, internal audits, risk reviews, security architecture reviews, regulatory readiness, and control validation.

You can request a demo by contacting the Cloudryption team through the contact page. The demo can be tailored to cloud security leadership, security architecture, DevSecOps, or investor-level use cases.

Yes. Cloudryption can be evaluated through a proof of concept depending on environment scope, cloud provider, and required use cases. Contact us to discuss your requirements.

Pricing depends on cloud scope, number of environments, enabled modules, deployment model, and support requirements. Please contact us for pricing details.

Support includes onboarding support, cloud connection guidance, platform usage support, risk interpretation support, remediation planning support, and demo and POC support.

For password changes or account access support, please contact the Cloudryption team through the support or contact page.

Users can visit this FAQ page, contact support, or reach out through the contact page for onboarding, account access, platform usage, or technical questions.

Cloudryption is positioned as a cloud risk intelligence and decision platform. It connects cloud findings, identities, data exposure, workloads, and attack paths into one decision model, then prioritizes actions by impact rather than enumerating vulnerabilities or scanning for CVEs.

No. Cloudryption shows which cloud-security issues can reach your critical systems and which few fixes remove the most risk—helping your team prioritize within your existing toolset. It works alongside Wiz, Prisma Cloud, Defender for Cloud, Lacework, and other cloud security tools by adding decision context and risk prioritization to the findings they already provide.

Cloudryption can operate with human-led remediation or with explicitly enabled direct execution. In either model, the Decision OS governs the plan, owner, approval, ticket, action state, verification, and proof. Direct execution requires scoped permissions, validated ActionContracts, Decision Governor authorization, and customer-defined safeguards; it is never implied by read-only evidence collection.

Cloudryption's standard data analysis focuses on metadata, storage exposure, classification indicators, and customer-provided business context. Deep content inspection, raw data sampling, or sensitive-data processing must be explicitly enabled and governed by agreed data-handling terms. By default, Cloudryption does not collect raw customer business data, application data, database records, or private documents.

Cloudryption is not currently SOC 2 certified. We maintain a documented readiness program and phased path toward SOC 2 Type II. Customers can request our current security posture details. See the Compliance Roadmap (SOC 2) for details.