The 26 capabilities of Onam Security in one table: what each does, how far it reaches, and the limit we state openly.
Each row links to its product page. Available with limits means the capability ships today and has a boundary a buyer should know before relying on it. For the features inside each capability, see Features by capability.
| Capability | What it does | Status | Reach | Stated limit |
|---|
| CNAPP | Combines seven pillar scores (misconfiguration, detection and identity, workloads, data, network, threat, application security) into one 0–100 posture score. | Available | One score per tenant | Cloud cost is not part of the score. |
| CSPM | Finds misconfigurations in what is deployed. | Available | 9,853 posture checks across 7 clouds | Checks deployed resources, not Terraform templates (Code Security covers templates). On AWS, no secret is stored: Onam assumes a read-only role. |
| CIEM | Works out effective permissions and escalation paths. | Available with limits | Unused access, access reviews, shadow admins and role chains: AWS only | Those four parts run on AWS only today. Unused-access analysis also needs cloud audit logs flowing into Onam. |
| IAM Security | Checks MFA, access keys and policy hygiene. | Available | 1,459 identity rules in the catalogue, 7 clouds | — |
| Asset Inventory | Lists every discovered resource in one place. | Available | 549 services across 7 clouds | — |
| Capability | What it does | Status | Reach | Stated limit |
|---|
| Attack Path | Shows routes to the most valuable assets and the choke points that cut them. | Available | — | Dollar figures are loss estimates per finding, for ranking. They are not a price for a whole route and not predictions. |
| CDR (Detection) | Behavioural threat detection at three levels. | Available | Audit logs from all 7 clouds | — |
| Threat Detection | Attack chains mapped to MITRE ATT&CK. | Available | — | — |
| Risk Quantification | A FAIR-style loss estimate on each finding. | Available | — | Estimates for ranking, not predictions. |
| Capability | What it does | Status | Reach | Stated limit |
|---|
| DSPM (Data Security) | Labels sensitive data stores, shows who can reach them and where data flows. | Available with limits | 7 clouds, cloud data stores | Labels come from metadata only (store names, tags, column names). It never opens a file or reads a row. A store with uninformative names and no tags gets no label. Copies made by scripts are not visible. |
| Database Security | Managed database posture plus CIS database benchmarks. | Available | 1,321 data-protection rules in the catalogue | — |
| Encryption & Keys | Key inventory, rotation and who a key policy lets in. | Available | 502 secrets and key rules in the catalogue | — |
| Network Security | Seven-layer network topology analysis. | Available | 1,166 network rules in the catalogue | — |
| API Security | Shadow APIs, authentication gaps and firewall coverage. | Available | Gateway APIs on AWS, Azure, Google Cloud, OCI, Alibaba Cloud and Kubernetes | — |
| Capability | What it does | Status | Reach | Stated limit |
|---|
| CWPP (Workloads) | Protection view for virtual machines, containers, serverless and hosts. | Available | — | — |
| Agentless Scanning | Scans disk snapshots inside the customer’s own account. | Available | — | — |
| Container Security | Cluster, container service and image scanning. | Available | 1,508 container and Kubernetes rules in the catalogue | — |
| Vulnerability Management | Known vulnerabilities ranked with context, not only by severity score. | Available | — | — |
| Code Security | Static analysis, live-app testing, library checks and infrastructure-template checks. | Available with limits | Code repositories | No pull-request comments. No IDE plugin. Cannot gate a build on new findings only (a pipeline can start a scan instead). Code findings are not yet linked to the running workload. |
| AI Code Fix | Writes a fix and pushes it to a branch. | Available with limits | Static-analysis findings | Library and live-app findings are not rewritten. The affected file is sent to a language model (Mistral). |
| Capability | What it does | Status | Reach | Stated limit |
|---|
| SaaS Security (SSPM) | Posture checks for business SaaS platforms. | Available with limits | 8 platforms; 433 CIS rules across 6 of them | GitHub and Okta have posture checks but no CIS rule pack yet. |
| AI Security | Risk checks for AI and machine-learning services such as SageMaker and Bedrock. | Available | AWS AI services (SageMaker, Bedrock) | Checks cover AWS AI services only. |
| AI Assistant | Answers posture questions asked in plain language. | Available | — | — |
| Remediation | Fix guidance and a ready-made AI fix prompt for each finding. | Available | — | Guidance only. Onam does not change the customer’s cloud. |
| Compliance | Maps findings to frameworks with evidence per control. | Available with limits | 78 frameworks | Controls with no automated check are marked for manual review. |
| Technology Engine | Discovers running technology and checks it against CIS benchmarks. | Available | 34 CIS technology benchmarks in 9 categories | — |
"All rules" is the full rule catalogue. "Posture checks" is the subset the CSPM scanner runs.
| Cloud | All rules | Posture checks | Services |
|---|
| AWS | 2,568 | 2,018 | 123 |
| Oracle Cloud (OCI) | 2,157 | 2,059 | 61 |
| Azure | 2,101 | 1,926 | 95 |
| Alibaba Cloud | 1,585 | 1,151 | 68 |
| Google Cloud | 1,479 | 1,322 | 71 |
| Kubernetes | 927 | 824 | 68 |
| IBM Cloud | 616 | 553 | 63 |
| Total | 11,433 | 9,853 | 549 |
| Area | Rules |
|---|
| Configuration | 2,689 |
| Containers and Kubernetes | 1,508 |
| Identity and access | 1,459 |
| Data protection | 1,321 |
| Logging | 1,295 |
| Network | 1,166 |
| Secrets and keys | 502 |
| Storage and databases | 310 |
| Applications and APIs | 241 |
| Compute and workloads | 219 |
| Platform | CIS rules |
|---|
| Microsoft 365 | 130 |
| GitLab | 122 |
| Google Workspace | 89 |
| Snowflake | 39 |
| SharePoint | 37 |
| Dynamics 365 | 16 |
| GitHub | Posture checks, no CIS rule pack yet |
| Okta | Posture checks, no CIS rule pack yet |
Things a buyer may expect that Onam Security does not do yet.
| Not available | Where it stands |
|---|
| Reading file or row contents to classify data | DSPM labels from metadata only |
| Data loss prevention and data labelling | Not offered |
| Unused access, access reviews, shadow admins and role chains outside AWS | AWS only today |
| Pull-request comments and an IDE plugin | Code Security |
| Failing a build on new findings only | Code Security |
| Linking a code finding to the workload built from it | Code Security |
| AI fixes for library and live-app findings | AI Code Fix covers static analysis only |
| Template scanning inside the misconfiguration scanner | Handled by Code Security instead |
| Making changes in the customer’s cloud | Onam reads and recommends |
| A CIS rule pack for GitHub and Okta | Posture checks only |
Dollar figures in Attack Path and Risk Quantification are loss estimates for ranking, in the FAIR style published by The Open Group.