Secure GCP projects at scale without slowing down engineering
GCP gives engineering teams enormous flexibility and security teams enormous blind spots. Onam continuously audits every project from IAM bindings and BigQuery permissions to GKE configs and VPC firewall rules.
One platform on Google Cloud
Connect Google Cloud once. Onam Security is covered in detail below; the rest of the platform works from the same discovery.
Every Google Cloud resource Onam discovers lands in one inventory, with provider, region, account, state and last-seen time, through the same read-only access. Every discovery run is recorded with its trigger and status. The per-account architecture view draws AWS accounts today, not Google Cloud.
Posture, identity, attack paths, workloads and compliance for Google Cloud. The detail is on the rest of this page.
Onam FinOps works on reconciled billing data: billed and effective cost, ownership, forecast, budgets, anomalies and savings. It holds read-only billing access and changes nothing in your accounts. On Google Cloud, billing is read only if you opt in when you grant access. Ask us which Google Cloud billing data applies to your accounts.
Onam DRM works from the same inventory: it proposes applications from your tags, reads backup, snapshot and replication from cloud configuration, and predicts RTO and RPO against your targets. It plans and records — it does not run a failover or a DR test. Ask us about DRM coverage for Google Cloud.
Onam AIOps
Early accessAI agents investigate your Onam Security inventory and findings and propose changes a person approves. Executing a change in a customer cloud is on the roadmap, with AWS first; nothing is executed in Google Cloud today.
Services we monitor on Google Cloud
Every service below is scanned continuously — no agents, no network changes, read-only.
Plus: Pub/Sub, Cloud Build, Artifact Registry, Dataflow, Vertex AI, Cloud DNS, Load Balancing, and more.
Compliance frameworks
Onam maps every Google Cloud finding to the frameworks your auditors care about.
Connect in 3 steps
From consent to your first findings, with no agents to install for posture scanning.
Create an Onam service account
Provision a service account at the organization level with the Security Reviewer and Viewer roles. Terraform module included.
Grant org-level read access
One binding at the organization node inherits down through every folder and project. New projects — created by any engineer, at any time — are covered automatically.
Findings from the first scan
Onam authenticates via workload identity federation, walks the resource hierarchy, and returns findings mapped to CIS GCP and the other frameworks you track.
Google Cloud in the Onam Security console.
A recreation of the Onam console with sample data: connect, inventory and posture in one view.
What makes Onam different on GCP
Org → folder → project traversal
Onboard once at the org node. Onam discovers every folder and project, respects Organization Policy constraints, and never misses a shadow project created by a busy team.
IAM binding + BigQuery permission graph
Standard and conditional IAM bindings are correlated with BigQuery dataset ACLs and column-level policy tags. See which principals are granted read access to your regulated data.
GKE cluster & VPC firewall depth
Autopilot and standard clusters are audited against CIS GKE — control plane, workload identity, PodSecurity, and network policies — alongside the VPC firewall rules that actually reach them.
Questions we get a lot
Google Cloud security — related reading
How the engines behind Google Cloud coverage work, and what the categories actually mean.
BigQuery and GCS classification, exposure and access paths.
Cloud security posture management explained — what it catches, and what it cannot.
Why a list of findings is not a priority, and how chains reach crown jewels.
Attack paths and choke points computed across your whole estate.
Effective permissions after role chains, SCPs and permission boundaries.
CIS, NIST, ISO 27001, PCI-DSS and more, scored continuously.
Snapshot-based workload scanning that runs inside your own account.
See Onam on your Google Cloud environment
Connect once with read-only access. Every Onam product you use works from the same discovery, so your accounts are connected once.