Is everything encrypted, and who can decrypt it?
Encryption and key management checks across KMS, Key Vault, Cloud KMS and OCI Vault.
The encryption engine evaluates 502 secrets and key-management rules across every cloud, then answers the questions that matter more than the checkbox: who a key policy lets in, and whether your most sensitive data sits behind a key you control.
- posture rules
- 9,853
- cloud providers
- 7
- cloud services
- 549
- compliance frameworks
- 78
Your compliance report says 100% encryption at rest.
It is technically true and nearly useless. The bucket is encrypted with an AWS-managed key that every principal in the account can use. The key that protects your customer database has no rotation policy and a key policy with a wildcard principal. A certificate on your main load balancer expires in nine days. 'Encrypted' passed the audit; none of this did.
How Encryption & Key Management works
- 01
Every key, vault, secret and certificate is discovered across AWS KMS, Azure Key Vault, GCP Cloud KMS, OCI Vault and their equivalents.
- 02
A coverage analyzer walks the resource inventory and identifies which resources are unencrypted, encrypted with provider-managed keys, or encrypted with customer-managed keys.
- 03
Key policies are parsed for wildcard principals, other accounts and grants, so a key that more than its owners can use is flagged. Each key is also mapped to the resources that depend on it, so you know the impact of disabling or deleting it before anyone does.
- 04
Certificate inventory tracks issuer, algorithm, and expiry across ACM and equivalent services, with lead-time alerting before expiry.
- 05
Rotation state, deletion protection, and key-material origin are checked against 502 secrets and key-management rules mapped to CIS, NIST and PCI-DSS controls.
- 06
DSPM labels are joined in: sensitive data on an unencrypted store is critical, sensitive data on a provider-managed key is high, and changes between scans (encryption removed, rotation switched off, a key scheduled for deletion) are caught as drift.
What you see in the console
- Encryption coverage report
- unencrypted, provider-managed, and customer-managed, per resource
- Key policy reach
- wildcard principals, other accounts and grants on every key
- Sensitive-data cross-check
- DSPM-labelled stores that are unencrypted or on provider-managed keys
- Key blast radius
- the resources that depend on each key
- Encryption drift
- encryption removed, rotation disabled or a key scheduled for deletion since the last scan
- Key rotation compliance and overdue rotation alerts
- Certificate inventory with expiry lead-time warnings
- Secrets manager posture
- rotation, versioning, and access scope
- In-transit enforcement gaps
- TLS policy on endpoints and load balancers
- Framework mapping for encryption controls across CIS, NIST 800-53 and PCI-DSS v4
Encryption & Key Management in the real console.
A recreation of the Onam console with sample data — the screens and finding types your team works with.
DSPM, Database Security and Encryption share one scan
They answer different questions about the same data. DSPM decides what is sensitive; the other two use that label to rank what they find.
What data do we hold, where, and how exposed is it?
- Covers:
- Every kind of store: buckets, databases, warehouses, streams, Kubernetes secrets.
- Gives you:
- Labels (PII, PHI, PCI, financial, confidential), public and cross-account exposure, lineage.
Is each database hardened, private, audited and backed up?
- Covers:
- Managed and self-hosted databases, down to CIS benchmarks for the engine itself.
- Gives you:
- A six-domain posture score per database, ranked higher where DSPM found sensitive data.
Is it encrypted, with a key we control, and who does the key let in?
- Covers:
- KMS keys, vaults, certificates and secrets managers across every cloud.
- Gives you:
- Coverage, key-policy reach, rotation and drift — and sensitive stores on weak keys.
How the labels pass between them is set out in the DSPM documentation.
Questions we get a lot
See Encryption & Key Management on your own cloud
Book a 30-minute demo. We walk through it on sample data, or on one of your accounts if you want to connect it.