How do you scan every workload without deploying anything?
Agentless workload scanning from disk snapshots, run inside your own cloud account.
Onam scans workloads using point-in-time volume snapshots orchestrated inside your own cloud account with native services: AWS Step Functions, Azure Logic Apps and GCP Workflows. Your data never leaves your environment, and no software ever runs on the workload being scanned.
- posture rules
- 9,853
- cloud providers
- 7
- cloud services
- 549
- compliance frameworks
- 78
Agent rollouts drag on.
Every agent needs a package, a version, a rollout plan, an exception list for the machines that break, and a renewed argument with the platform team every quarter. Months in, coverage is still partial, the gaps are in the legacy estate that most needs scanning, and nobody can say which machines are covered.
How Agentless Scanning works
- 01
Onam assumes a read-only role and enumerates the volumes attached to every workload across your accounts.
- 02
A snapshot is created and analysed by a short-lived scan worker that runs inside your own account, orchestrated by AWS Step Functions, Azure Logic Apps, or GCP Workflows depending on the cloud.
- 03
Results are relayed through a storage bucket in your account; raw disk contents are never transferred to Onam. Only structured findings leave your environment.
- 04
A capacity manager per cloud throttles concurrent snapshots so scanning never competes with production for quota or IOPS.
- 05
Snapshots are deleted automatically once analysis completes, and a reconciler sweeps orphaned artefacts so nothing is left behind or billed.
What you see in the console
- Coverage without an agent rollout
- every volume the read-only role can see can be scanned
- Package and OS inventory from every scanned volume
- Vulnerability detection against the workload's real installed software
- Host configuration signals
- users, keys, services, and hardening state
- Secrets and credential discovery on disk
- Nothing runs on the workload
- no agent, no daemon, no kernel module
- Automatic snapshot cleanup with orphan reconciliation
- Per-cloud capacity controls so scanning respects your quotas
Agentless Scanning in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
Questions we get a lot
See Agentless Scanning on your own cloud
Book a 30-minute demo. We walk through it on sample data, or on one of your accounts if you want to connect it.