See your entire cloud attack surface. Act on threats before they spread.

Asset discovery runs every 15 minutes via cloud provider APIs. New EC2 instances, Azure VMs, GCP compute resources, S3 buckets, storage accounts, and IAM principals appear in the entity graph within one polling cycle. Configuration drift is detected on the same cycle.

Both simultaneously. The platform ingests CloudTrail, Azure Activity Log, and GCP Audit Log in real time for active attack detection (API abuse, credential misuse, lateral movement). A separate configuration scanner runs every 15 minutes for posture drift. Both feed the same triage and response pipeline.

ManySignal maintains an entity graph that links users across cloud providers. When a credential is used in AWS and then unusual Azure activity follows within a short window, the correlation engine flags this as potential cross-cloud lateral movement — something single-cloud SIEMs miss by design.

Detections map to CIS Benchmarks (AWS, Azure, GCP), NIST CSF, SOC 2 Type II control objectives, PCI DSS, and ISO 27001. Compliance posture dashboards update in real time as configuration findings open and close.

Yes. Approved response actions include: revoke IAM key, quarantine EC2 instance, disable Azure AD user, remove S3 bucket public access, and rotate compromised credentials. Each action requires approval per your configured autonomy policy before execution.

ManySignal monitors Lambda/Functions execution logs, ECS/EKS API server audit logs, and container runtime telemetry for anomalous behavior. Unusual Lambda invocation patterns (unexpected event sources, data exfiltration via response payloads), container breakout attempts, and privilege escalation within Kubernetes RBAC are all detected. Container identities are tracked in the entity graph with their associated service accounts and namespace permissions.

CSPM (Cloud Security Posture Management) tools scan for misconfiguration at a point in time. ManySignal adds behavioral detection — it monitors what is happening in the cloud environment in real time, correlates configuration state with live activity, and identifies attacks that exploit correctly configured resources through compromised credentials. ManySignal ingests CSPM findings from Wiz, Orca, Prisma Cloud, and AWS Security Hub and correlates them with behavioral telemetry to prioritize which misconfigurations are being actively exploited.

ManySignal's entity graph maintains a unified view across all connected accounts, subscriptions, and projects. IAM principals, resources, and activity events from separate cloud accounts are correlated when they share common identities — a user who has roles in three AWS accounts appears as a single entity with access to all three. Cross-account lateral movement (role assumption chaining across accounts) is detected as a compound attack pattern, not separate unrelated events.

Yes. ManySignal monitors usage of cloud-native services that attackers abuse for C2 and exfiltration: S3 bucket creation followed by data upload from a compromised workload, Lambda functions making unexpected external API calls, CloudFront distributions created to proxy traffic, and SNS/SQS queues receiving unusual message volumes. These patterns are detected as anomalies against the baseline usage for the involved cloud services and account.