CloudGrade · Cloud Posture
Cloud misconfigurations, found and fixed as code.
CloudGrade, the cloud module of ReachMap, checks every account and project against benchmarks, connects misconfigurations to exposed workloads and identities, and suggests the code change that fixes each one.
app.resilientprivacy.com/cloud
Simulated environment, real workflow.
Capabilities
What CloudGrade does.
Misconfigurations, workload and identity risk across AWS, Azure and GCP, with fixes as code.
Every account checked, all the time
Agentless scans compare your AWS, Azure and GCP configuration against CIS benchmarks and your own policies.
- Multi-cloud benchmark checks
- Custom policies as code
- Drift alerts when settings change
What you get
- Posture dashboard
- Cloud team
- Benchmark reports
- Auditors
Vulnerable workloads in context
Containers, VMs and serverless functions are scanned and linked to the network exposure around them.
- Image and host vulnerability scanning
- Internet exposure per workload
- Runtime risk signals
What you get
- Workload risk list
- Platform team
- Exposure-linked findings
- SecOps
Least privilege you can prove
CloudGrade finds unused permissions, admin roles and risky trust relationships across accounts.
- Unused and excessive permissions
- Cross-account trust review
- Right-sized policy suggestions
What you get
- Entitlement report
- IAM team
- Policy diffs
- Cloud team
Stop misconfigurations before deploy
Infrastructure-as-code scanning catches issues in pull requests and suggests the fix inline.
- Terraform, CloudFormation and Helm checks
- Pull request comments with fixes
- Pipeline gates by severity
What you get
- PR findings and fixes
- Developers
- Gate results
- Platform team
The proof
Risk down, checks green, across every account.
CloudGrade grades posture across accounts and tracks every check, so you can show the grade improving instead of a one-off scan.
Down from 71 at onboarding
| Measure | Value |
|---|---|
| Risk score | 34 of 100 (Low) |
Simulated environment, real workflow.
- Passing 412
- Failing 23
- Accepted risk 18
| Status | Count | Share |
|---|---|---|
| Passing | 412 | 91% |
| Failing | 23 | 5% |
| Accepted risk | 18 | 4% |
Simulated environment, real workflow.
Delivered with consulting
Software that keeps the advice working.
The same practitioners who test, govern and monitor your systems work in this console, so their findings land where your team already looks.
How it works
CloudGrade, from first connection to running.
Most teams start with read-only connections and switch on automation once they trust the results. Deployment is scoped in the first call.
- 01
Connect
Grant read-only access to cloud accounts and projects.
Output: Read-only access
- 02
Grade
CloudGrade grades configuration, workloads and identities.
Output: Config findings
- 03
Prioritize
Findings are ranked by exposure and attack path.
Output: Attack-path ranking
- 04
Fix
Teams get code-level fixes in pull requests or tickets.
Output: Fix pull requests
Integrations
Works with the stack you have.
Connect once and the data feeds every RP product. Specific connectors are listed on the integrations page.
Supported connectors and versions are confirmed at scoping
FAQ
Questions we hear.
Also on the platform
Is it agentless?
Posture and identity checks use read-only cloud APIs.
Which benchmarks are included?
CIS benchmarks for each major cloud, plus custom policies.
Is this a separate product from ReachMap?
No. It is the cloud module of ReachMap, so cloud and external findings share one ranking.
Can it fix things automatically?
It suggests code changes and can open pull requests. Applying them stays with your team.
See CloudGrade on your own environment.
A 30-minute walkthrough scoped to your stack, with a look at what it would find first.