Cloud Coverage
Five infrastructure surfaces treated as first-class citizens — each with its own credential model, ingestion path, detector family, and remediation actions.
The platform treats five infrastructure surfaces as first-class citizens. Each has its own credential model, its own ingestion path, its own detector family, and — for the deepest — its own remediation actions.
Coverage at a glance
| Surface | How it connects | Active detectors |
|---|---|---|
| AWS | IAM AssumeRole with External ID — no long-lived keys stored | 102 |
| Azure | Service Principal with encrypted client secret | 72 |
| GCP | Service Account JWT with encrypted key material | 58 |
| Oracle Cloud (OCI) | OCI API signing key, encrypted at rest | 37 |
| Kubernetes | Kubecost, OpenCost, or the bundled in-cluster agent | 13 |
| Cross-cloud | Derived — operates on the normalised ledger | 23 |
| 305 total |
What 'active detector' means
An active detector is a rule backed by real detection logic that produces findings. 305 is the figure to use in any assessment of detector depth.
The platform also publishes this number live at its public detection coverage page — computed from the running rule registry rather than typed into marketing copy, so it cannot silently go stale.
What is ingested, per surface
| Source | Purpose |
|---|---|
| Cost Explorer | Fast spend summaries |
| CUR via Athena | Authoritative billing detail — daily and hourly |
| CloudWatch metrics | Measured utilisation for rightsizing evidence |
| CloudWatch Logs Insights | Log-derived detection, e.g. Lambda memory rightsizing |
| Live resource scanning | The inventory register |
| AWS Pricing API | Live prices for pre-merge cost estimation |
Deepest surface. AWS carries the fullest remediation action set, the Savings Plan purchase path in the commitment negotiator, and partner billing reconciliation.
Cross-cloud detection
Twenty-three detectors operate on the normalised ledger after ingestion rather than on any single provider. They catch patterns that only appear when providers are compared side by side — duplicated environments across clouds, the same workload paid for twice, cost shapes that look normal per-provider and anomalous in aggregate.
This is why partial connection is dangerous
Cross-cloud detectors need the whole picture. Connecting a representative sample of accounts does not just give you a smaller number — it gives you a wrong one, and silently disables an entire detector family.
Remediation depth
Read and analysis coverage extends to all five surfaces. Automated remediation is deepest on the three largest providers, and every automated action — regardless of provider — inherits the same safety machinery:
- protected-tag exemption
- execution windows
- rollout safety staging
- dry-run capability
- full audit logging
See The Data Lifecycle → Act for how those controls compose.