Onboarding overview
The onboarding process has 9 steps from scope confirmation to Decision Proof. Most pilots establish evidence collection and Current Security State during the first phase, then configure governance and validate the decision-to-verification workflow.
Confirm scope
Define the pilot or deployment boundaries before connecting any cloud environment.
- Cloud providers (AWS, Azure, GCP)
- Accounts, subscriptions, or projects
- Regions to include
- Asset limits and environment tiers
- Business-critical systems and crown-jewel candidates
- Pilot success criteria
- Required stakeholders for the review session
Create scoped evidence access
Cloudryption uses read-only access for standard discovery and analysis. The customer creates an approved role, service account, or equivalent identity with the permissions required for metadata collection.
No production write access is required for evidence collection, simulation, or verification scans. If direct remediation is enabled later, it uses a separate scoped identity and remains subject to Decision Governor and customer approval controls.
Connect environment
The customer connects the selected cloud environment to Cloudryption. Cloudryption validates:
- Authentication and credential validity
- Permission coverage for required metadata
- Account and project visibility
- Region visibility within agreed scope
- Scan readiness confirmation
Build Current Security State
Cloudryption collects authorized evidence and builds the initial Current Security State and decision graph. The first scan identifies:
- Assets, identities, and policies
- Exposures and public access points
- Network relationships and paths
- Storage and data classification signals
- Misconfigurations and security control gaps
- Potential attack paths from exposure to sensitive assets
Review evidence and define the Decision Objective
Cloudryption reviews the first Current Security State with the customer and makes the desired security outcome explicit. Focus areas:
- Material exposures and public entry points
- Crown-jewel reachability and business context
- Identity risk, privilege, and reachability footprint
- Attack paths to sensitive assets
- Risk drivers, root causes, and evidence quality
- Decision target, constraints, and measurable reduction objective
Compare strategies and configure governance
Strategy Arena compares candidate FixSets and simulated expected outcomes. The customer also configures the operating controls that determine execution authority:
- Competing remediation strategies and expected impact
- RBAC roles for plan creators, owners, approvers, and engineers
- Approval and exception policy
- Rollback, provider-safety, and blast-radius requirements
- Cloudryption Native Ticketing, Jira, or ServiceNow workflow selection
Govern and launch the remediation plan
The selected strategy becomes a governed plan with accountable ownership and traceable workflow:
- Plan creator, owner, approver, and engineering assignees
- Action list and approval state
- Native, Jira, or ServiceNow ticket references
- Email and workflow notifications
- Exceptions, blocked actions, and execution status
Execute and verify
Approved work is executed by the assigned engineer or by explicitly enabled Action V2 automation. Cloudryption tracks each action independently, then re-evaluates post-change evidence.
- Execution state remains separate from verification state
- Completed work does not automatically imply security improvement
- Post-change evidence establishes the actual outcome and residual exposure
Review Decision Proof and operating model
Cloudryption compares the simulated expected outcome with the verified actual result and preserves the lifecycle in Decision Memory. The customer can then close the pilot, expand coverage, or move to the agreed annual operating model.
Ready to run the full Decision OS lifecycle?
Start with a controlled pilot and receive Current Security State, ranked decisions, strategy simulation, a governed remediation plan, execution workflow, post-change verification, Decision Proof, and board-ready evidence.