KnellCloud security posture

Find the path to your data before an attacker does.

Findings and attack paths across every connected account, in one view. Daily scans show what changed.

Connect an account (opens in a new tab)See the product
  • AWS
  • Google Cloud
  • Azure
  • + more
fig. 01 · attack path
production · aws · us-east-1
reachable from internet
potential, not confirmed
  1. Internet
    Public internet
    0.0.0.0/0
    https:443
  2. Entry point
    web-public-alb
    elbv2:load-balancer
    forwards
  3. Compute
    web-1
    i-0a1b2c3d4e5f60718
    profile
  4. Identity
    web-app-role
    iam:role
    s3:GetObject
  5. Datadanger
    customer-uploads
    s3:bucket

Potential, from web-1

Data
orders-db
rds:db-instance · tcp/5432

A sample account. Internet traffic reaches web-1 through the load balancer, and the role attached to web-1 can read the customer uploads bucket. One policy statement closes the path.

Daily
scans, new and resolved tracked
Read-only
never changes your infrastructure
No agents
to install, across AWS, Google Cloud, Azure and more
Gaps shown
a permission error is never a clean result

See the risk. Find the path. Know where to act.

Move from a cloud-wide view to the resources that need attention, with the evidence your team needs to investigate.

  • Prioritize

    Ranked by what can reach your data

    • Severity and affected resources behind every finding
    • Attack paths show which exposures lead to your data
    • New and resolved tracked on every daily run

  • Trace

    Internet to data store, hop by hop

    • Load balancers, compute, identity, storage
    • Potential vs. confirmed edges shown separately
    • The exact rule, policy statement or resource field that failed

  • Coverage

    Every account, every day, no gaps hidden

    • Scan history per account in one view
    • A permission error shows as a gap, never a pass
    • AWS, Google Cloud, Azure and more

From finding to fix

One view across every connected account.

The question is what to fix first. Not where to look.

Know what to fix first
See the severity and affected resources behind each finding. Use attack paths to understand which exposures can lead to your data.
Give your team a clear next step
Open a finding to see the exact rule, policy statement or resource field that failed, with a link straight to the provider console.
Find the gaps in your visibility
Each scan records what it could not read. A permission error shows up as a gap, never as a clean result.
See whether your fixes hold
Daily scans show new and resolved findings, so you can track progress and catch misconfigurations that return.
dangerec2.sg.ssh-open-worldfirst seen today
Security group allows SSH from anywhere
Failed field
IpPermissions[0].IpRanges = 0.0.0.0/0 · tcp/22
Affected
sg-0b7f1e2a · bastion-legacy
sg-04c9aa13 · web-debug
VPC
vpc-prod-main · env=production
Links to the provider console.
Sample finding

Connected in three steps

No agent to install. Scans run from Sythe Labs against the provider's own APIs.

  1. Pick a provider

    Sign in and connect your cloud account. AWS, Google Cloud, Azure, and more, together in one place.

  2. Grant read-only access

    Follow the connection steps for your provider. Knell reads your cloud configuration without changing your infrastructure.

  3. Read the first scan

    Test the connection and the first scan starts. After that it runs every day on its own.

One team

One team for SOC 2, pentests and your cloud

Knell is part of the same security program. The engineers who prepare your audit and test your application are the ones you talk to about your cloud.

Find out what puts your cloud at risk.

Sign in with Google, pick a provider and grant read-only access. The first scan starts as soon as the connection test passes.

Connect an account (opens in a new tab)