Your DevOps team ships 50 new resources this week.
By Friday, three of them are misconfigured — a security group open to the internet, an S3 bucket with public read, an RDS instance with no encryption. None intentional; they're just defaults nobody changed. The problem isn't careless engineers — it's that manual audits can't keep pace with cloud deployment.
The risk of not knowing
If it is not surfaced today, it is exposed today. Attackers do not wait for your quarterly review — and neither do auditors.
CSPM in two minutes
Voices are AI-generated. More short Q&A videos: Onam Security: cloud security
The mechanism, not the marketing
- 1
When you connect a cloud account, Onam discovers its resources across 549 services, with region and account recorded for each. Posture scanning connects through read-only cloud roles: IAM roles, service principals or service accounts.
- 2
Each resource is evaluated against 9,853 posture rules — OCI 2,059, AWS 2,018, Azure 1,926, GCP 1,322, Alibaba 1,151, Kubernetes 824, IBM 553 — by one cloud-agnostic engine that records PASS, FAIL or ERROR for every rule and resource.
- 3
Every rule carries its severity, rationale, references, remediation guidance, compliance mappings and MITRE ATT&CK tactics and techniques, so each finding arrives with the why and the how-to-fix.
- 4
Severity is raised when context makes a finding worse — the resource sits on an attack path and is exposed, it is a crown jewel, or an active threat touches it — and each finding gets a fix-by date.
- 5
Every finding also carries an AI fix prompt, written for your cloud's tooling, that you can paste into an assistant to draft the CLI command, Terraform change or console steps.
- 6
Findings can open Jira or ServiceNow tickets and alert through Slack, PagerDuty, email or webhook; the next scan re-checks the resource and confirms the fix.
Specific outputs, measurable outcomes
CSPM in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
CSPM on one page
Inputs, how it works, what you get and the limits — the same sheet our team uses in briefings.
Open full sizeQuestions we get a lot
Ready to see CSPM in your cloud?
Connect a read-only role in three minutes. Your first findings surface in under five.