Features by capability
Every feature inside each Onam Security capability: 211 features across 26 capabilities, grouped the way the product is.
Where a feature names one cloud, it works on that cloud only. For status, reach and stated limits per capability, see the Capability matrix.
Posture & Identity
CNAPP
Combines seven pillar scores (misconfiguration, detection and identity, workloads, data, network, threat, application security) into one 0–100 posture score. Available. Product page.
| Feature | Detail |
|---|---|
| One posture score | with a risk band, trended over time |
| Seven pillar scores | posture, threat detection and IAM, workloads, data, network, threat, code |
| Fixed pillar weights | rebalanced when a pillar has no data |
| Drill-down | from a pillar to the findings behind it |
| Context-raised severity | and a fix-by date per finding |
CSPM
Finds misconfigurations in what is deployed. Available. Product page.
| Feature | Detail |
|---|---|
| Severity ranking | every misconfiguration ranked Critical, High, Medium or Low |
| Remediation guidance | per rule, plus an AI fix prompt for CLI, Terraform or console steps |
| Compliance mapping | which of the 78 frameworks each finding affects |
| MITRE ATT&CK | tactics and techniques on every rule |
| Resource-level drilldown | every finding linked to the resource, account and region |
| Context-raised severity | and a fix-by date per finding |
| Ticketing and alerting | Jira, ServiceNow, Slack, PagerDuty, email, webhook |
| Rule suppressions | with a reason and an optional expiry |
CIEM
Works out effective permissions and escalation paths. Available with limits. Product page.
| Feature | Detail |
|---|---|
| Effective permissions per identity | after group inheritance, conditions, explicit denies and SCP denies |
| Shadow admin detection | AWS identities that can attach, rewrite or create their way to an admin policy |
| Privilege escalation paths | PassRole, multi-hop assume-role chains and boundary removal on AWS; vectors for Azure, GCP, OCI, IBM Cloud and Kubernetes |
| Cross-account and federated trust | external accounts, wildcard principals, missing ExternalId, OIDC and SAML federation |
| Non-human identities | roles classified by who can assume them: AWS service, execution, CI/CD over OIDC, EKS service account, cross-account |
| Unused permissions on AWS | granted actions never seen in CloudTrail, with the high-risk ones called out |
| Identity risk score | 0–100 per AWS identity, with the breakdown behind it |
| Blast radius | how many resources with open high or critical findings an identity can reach |
| Stale roles | AWS roles with no recent API activity |
| Access reviews | pending, needs remediation, reviewed or deferred, with an audit trail and decisions that expire (AWS) |
| Kubernetes RBAC | service accounts bound to cluster-admin, able to read secrets, exec into pods or rewrite roles |
| Database identity activity | superuser and role-grant changes and login anomalies, from credentialed database connections |
IAM Security
Checks MFA, access keys and policy hygiene. Available. Product page.
| Feature | Detail |
|---|---|
| MFA coverage | users and privileged identities without MFA |
| Access-key and credential age | keys and tokens past rotation thresholds |
| Root account usage | root activity and root access keys |
| Policy hygiene | wildcard actions and resources, admin policies, inline policies |
| Password policy | minimum length and expiry against CIS and NIST guidance |
| Trust settings | wildcard trust principals and cross-account roles without ExternalId |
| Six IAM modules | each with its own summary and pass rate |
| Effective Access lookup | search any principal and see what it can do after explicit denies and SCP denies |
Asset Inventory
Lists every discovered resource in one place. Available. Product page.
| Feature | Detail |
|---|---|
| Unified inventory | seven clouds and 549 services |
| Normalised resource model | comparable objects across providers |
| Relationship graph | the dependency map attack paths are computed on |
| Refresh on every scan | new resources picked up at the next scan |
| Hygiene reports | untagged, unowned and orphaned resources |
| Multi-account rollup | accounts and subscriptions in one view |
| Resource history | what changed, and when |
| Coverage reporting | which accounts and regions are actually being scanned |
Threat & Attack
Attack Path
Shows routes to the most valuable assets and the choke points that cut them. Available. Product page.
| Feature | Detail |
|---|---|
| Crown jewel path analysis | routes from entry points to critical assets, as interactive graphs |
| Evidence-checked edges | only confirmed relationships are walked |
| MITRE ATT&CK | tactic and technique on every hop |
| Path severity | likelihood × impact, adjusted for controls and exploitability |
| Choke-point ranking | the resources where one fix blocks the most paths |
| Remediation | a step per hop |
| Rebuilt every scan | fixed routes disappear |
| Feeds Risk Quantification | findings on attack paths get a higher loss estimate |
CDR (Detection)
Behavioural threat detection at three levels. Available. Product page.
| Feature | Detail |
|---|---|
| Single-event detection | rules over cloud audit logs |
| Multi-event correlation | scenarios within a time window |
| Behaviour baselines | per identity, with anomaly detection |
| Attack-sequence detection | exfiltration, identity pivot, secrets staging, compute hijack |
| MITRE ATT&CK | mapping on detections |
| Context | posture and identity context on every detection |
| Audit-log coverage | AWS, Azure, Google Cloud, OCI, Alibaba Cloud, IBM Cloud and Kubernetes |
| One alerts view | detections sit with the rest of Onam Security |
Threat Detection
Attack chains mapped to MITRE ATT&CK. Available. Product page.
| Feature | Detail |
|---|---|
| MITRE ATT&CK | every threat finding mapped to a tactic and technique |
| Attack chain visualisation | connected graphs |
| Blast radius analysis | — |
| Severity ranking | by CVSS, exploitability and actual reachability |
| Correlation | fewer duplicate alerts |
| Response guidance | per technique |
| Historical attack timeline | — |
| Attack Path integration | shares the Attack Path engine |
Risk Quantification
A FAIR-style loss estimate on each finding. Available. Product page.
| Feature | Detail |
|---|---|
| Loss estimate | FAIR-style, per critical and high finding: low, likely and high |
| Regulatory exposure | GDPR, HIPAA, PCI DSS, SOX and other regimes |
| Attack-path uplift | higher estimates for findings on attack paths and choke points |
| Multipliers | crown jewel and data sensitivity |
| Top scenarios | ranked by likely exposure |
| Breakdown | exposure by engine, trended over time |
| Tunable inputs | per-record cost, revenue and sensitivity multipliers per tenant |
Data & Network
DSPM (Data Security)
Labels sensitive data stores, shows who can reach them and where data flows. Available with limits. Product page.
| Feature | Detail |
|---|---|
| Data store catalog | every store with type, region, account and sensitivity labels |
| Metadata classification | PII, PHI, PCI, financial and confidential labels from names, tags and schema, never from contents |
| Public exposure, explained | which grant made a store public: policy verdict, ACL or wildcard principal |
| Cross-account access | bucket policies that let another account in, with write access ranked critical |
| Observed access | who touched each store in the last 30 days, with operations and time of last access |
| Encryption and keys | unencrypted stores, and sensitive data on provider-managed keys |
| Residency view | every store's region checked against the regions data is allowed to live in |
| Logging, versioning and backup | access logs, lifecycle rules, backup retention and point-in-time restore per store |
| Data lineage | chains of replication, backup, ETL, streaming and export hops, cross-region and cross-account flagged |
| Governance score | one 0–100 figure per store from encryption, public exposure and access logging |
| Attack-path context | sensitive stores become the targets attack paths are scored against |
Database Security
Managed database posture plus CIS database benchmarks. Available. Product page.
| Feature | Detail |
|---|---|
| Database inventory | managed services and self-hosted engines |
| Encryption coverage | at rest and in transit, per instance |
| Exposure detection | public accessibility and network exposure |
| Snapshot and backup exposure | including snapshots shared outside the account |
| Audit logging | configuration checked against CIS engine benchmarks |
| Backup compliance | retention and point-in-time recovery |
| Privileged accounts | database account and grant review |
| Sensitivity-weighted ranking | databases holding regulated data ranked first |
Encryption & Keys
Key inventory, rotation and who a key policy lets in. Available. Product page.
| Feature | Detail |
|---|---|
| Encryption coverage report | unencrypted, provider-managed and customer-managed, per resource |
| Key policy reach | wildcard principals, other accounts and grants on every key |
| Sensitive-data cross-check | labelled data stores that are unencrypted or on provider-managed keys |
| Key blast radius | the resources that depend on each key |
| Encryption drift | encryption removed, rotation disabled or a key scheduled for deletion since the last scan |
| Key rotation | compliance and overdue rotation alerts |
| Certificate inventory | with expiry lead-time warnings |
| Secrets manager posture | rotation, versioning and access scope |
| In-transit gaps | TLS policy on endpoints and load balancers |
| Framework mapping | encryption controls across CIS, NIST 800-53 and PCI-DSS v4 |
Network Security
Seven-layer network topology analysis. Available. Product page.
| Feature | Detail |
|---|---|
| Effective exposure score | for every resource |
| Security group audit | overly permissive inbound on SSH, RDP and database ports |
| Subnet classification | truly private versus publicly accessible |
| NACL analysis | — |
| Load balancer security | TLS version, HTTP to HTTPS redirect, internet-facing exposure |
| WAF coverage map | — |
| Flow log coverage gaps | — |
| Peering exposure | VPC peering and transit gateway analysis |
API Security
Shadow APIs, authentication gaps and firewall coverage. Available. Product page.
| Feature | Detail |
|---|---|
| API inventory | gateway-managed APIs across AWS, Azure, GCP, OCI, Alibaba Cloud and Kubernetes |
| Unauthenticated endpoints | public endpoints with no authentication or authoriser |
| Throttling gaps | missing rate limiting, burst limits and quotas |
| WAF coverage gaps | AWS API Gateway stages and Azure API Management |
| Transport gaps | TLS, HTTPS-only and mutual TLS |
| Logging coverage | access logging and tracing |
| Keys and backends | ageing API keys, and backend integrations that reach private addresses or metadata endpoints |
| Legacy APIs | name or version marks them as legacy, beta or test, still live |
Workloads & Code
CWPP (Workloads)
Protection view for virtual machines, containers, serverless and hosts. Available. Product page.
| Feature | Detail |
|---|---|
| Unified workload inventory | VMs, containers, serverless and hosts in one list |
| Per-workload posture score | with severity-ranked findings |
| OS hardening | results against CIS benchmarks for five Linux distributions |
| Package and vulnerability inventory | collected without agents |
| Privileged workloads | privileged and root-running workload detection |
| Runtime exposure | which workloads are internet-reachable |
| Serverless posture | runtime versions, execution roles and environment secrets |
| Pillar score trend | feeds the platform-wide CNAPP score |
Agentless Scanning
Scans disk snapshots inside the customer’s own account. Available. Product page.
| Feature | Detail |
|---|---|
| No agent rollout | workloads are covered without a deployment project |
| Package and OS inventory | from every scanned volume |
| Vulnerability detection | against the workload's real installed software |
| Host configuration signals | users, keys, services and hardening state |
| Secrets on disk | secrets and credential discovery |
| No production impact | no agent, no CPU, no memory, no kernel module |
| Snapshot cleanup | automatic, with orphan reconciliation |
| Capacity controls | per cloud, so scanning respects quotas |
Container Security
Cluster, container service and image scanning. Available. Product page.
| Feature | Detail |
|---|---|
| Image vulnerability scanning | CVEs in base and app layers |
| Kubernetes CIS benchmark | cluster, node, RBAC |
| Service account privilege analysis | — |
| Pod security analysis | privileged containers, host mounts, root users |
| Network policy coverage | — |
| Registry security | pull policies, unsigned images, image age |
| ECS task definition security | — |
| Runtime anomaly indicators | — |
Vulnerability Management
Known vulnerabilities ranked with context, not only by severity score. Available. Product page.
| Feature | Detail |
|---|---|
| SBOM generation | for every workload |
| EPSS-enriched prioritisation | — |
| KEV integration | CISA Known Exploited Vulnerabilities flagged |
| Network reachability correlation | — |
| Container image scanning | — |
| Serverless coverage | Lambda dependency scanning |
| OS-level findings | across the EC2 fleet |
| Remediation guidance | the exact upgrade version |
Code Security
Static analysis, live-app testing, library checks and infrastructure-template checks. Available with limits. Product page.
| Feature | Detail |
|---|---|
| Confirmed issues kept apart from hotspots | taint-backed findings first, pattern matches in a separate review list capped at medium |
| CWE and OWASP on every code finding | with the file, line and rule that produced it |
| Language coverage | Python, JavaScript, TypeScript, Java, C#, Go, C, C++ and Ruby |
| Dependency risk beyond CVSS | a 0–10 score built from CVSS, EPSS, CISA KEV and whether a fixed version exists |
| SBOM per repository | CycloneDX 1.5, plus import of existing CycloneDX or SPDX JSON SBOMs |
| SBOM governance | license classification and policy checks, an NTIA minimum-elements check, VEX statements and SBOM diffs |
| Dynamic testing of a running app | endpoint discovery, injection and SSRF payloads, header and cookie checks, JSON, HTML and SARIF reports |
| A fix path for every finding | rule guidance and a copyable AI fix prompt, plus AI Code Fix to put corrected files on a branch |
| Reports and trends | scan history per project, with CSV and PDF export |
AI Code Fix
Writes a fix and pushes it to a branch. Available with limits. Product page.
| Feature | Detail |
|---|---|
| Corrected files, not advice | the full rewritten file for each affected path |
| One pass per file | every finding in a file fixed together, with the surrounding code in view |
| Rule-guided fixes | the rule's recommendation and a language-matched safe example go to the model with each finding |
| A separate fix branch | the main branch is never written to |
| Per-finding status | fixed and committed, fix generated, failed or skipped, with the reason |
| Severity filter | fix the critical and high findings first and leave the rest for later |
| False positives respected | findings the team dismissed are not touched |
| Token handling | the Git token is used for one request and never stored or logged |
SaaS, AI & Governance
SaaS Security (SSPM)
Posture checks for business SaaS platforms. Available with limits. Product page.
| Feature | Detail |
|---|---|
| SaaS tenant inventory | every user, admin, guest and service account across connected platforms |
| MFA and conditional-access gaps | on privileged SaaS accounts |
| External sharing exposure | SharePoint, OneDrive and Google Drive links open to anyone |
| Audit-log configuration checks | M365 Unified Audit Log, Google Workspace retention, Snowflake QUERY_HISTORY |
| DevOps platform posture | GitHub and GitLab org settings, branch protection, token hygiene |
| Data warehouse posture | Snowflake roles, network policies and grant sprawl |
| CIS Benchmark scoring | per SaaS platform, with per-control evidence |
| Stale identities | stale and orphaned SaaS identity report |
AI Security
Risk checks for AI and machine-learning services such as SageMaker and Bedrock. Available. Product page.
| Feature | Detail |
|---|---|
| SageMaker endpoint access control | public versus VPC-only |
| Bedrock model invocation audit | — |
| Training job isolation | VPC and security groups |
| Model artifact encryption at rest | — |
| Shadow AI detection | AWS, from audit logs |
| SageMaker Studio network isolation | — |
| ML service role scoping | — |
| Logging and monitoring | for inference and training |
AI Assistant
Answers posture questions asked in plain language. Available. Product page.
| Feature | Detail |
|---|---|
| Natural-language querying | across every engine's findings |
| Thirteen domain specialists | IAM, compliance, encryption, database, container, network, CDR, risk, threat, vulnerability, data security, AI security and findings |
| Cited answers | every claim links to the underlying finding |
| Cross-domain synthesis | in a single question |
| Tenant-scoped and permission-scoped | the assistant sees only what the user can see |
| Attack path explanation | in plain language |
| Remediation guidance | drawn from the finding's own remediation record |
| Read-only by design | no silent changes to the environment |
Remediation
Fix guidance and a ready-made AI fix prompt for each finding. Available. Product page.
| Feature | Detail |
|---|---|
| Remediation guidance per rule | plus an AI fix prompt for CLI, Terraform or console steps |
| Fix branches | for static-analysis findings in source code, for the team to review and merge |
| Fixed versions | from the advisory, for vulnerable dependencies |
| Attack-path stories | with a remediation step on each hop |
| Suppression | for one finding or a whole rule, with reason, author and expiry |
| Tickets and alerts | Jira or ServiceNow; Slack, PagerDuty, email or webhook |
| Verification | the next scan confirms the fix actually landed |
Compliance
Maps findings to frameworks with evidence per control. Available with limits. Product page.
| Feature | Detail |
|---|---|
| 78 frameworks mapped | — |
| Continuous score | 0–100% per framework, with a trend |
| Evidence per control | with timestamps |
| Drill-down | from framework to control to resource |
| Export | PDF and CSV, plus Excel and JSON |
| Exceptions | with justification and expiry |
Technology Engine
Discovers running technology and checks it against CIS benchmarks. Available. Product page.
| Feature | Detail |
|---|---|
| Runtime technology inventory | what is actually running, not what was deployed |
| Version currency analysis | — |
| End-of-life detection | — |
| Default configuration checks | databases, web servers, frameworks |
| 34 CIS technology benchmarks | named products, not vague categories |
| 8,991 technology control rows | across those benchmarks |
| Shadow IT surface area | — |
| Technology risk scoring | — |