Operate · Cloud security

Cloud risk, traced to the code and team that own it.

Heeler checks AWS, Azure, Google Cloud, Oracle Cloud and Kubernetes against the frameworks you report on, confirms what the internet can actually reach, and shows which vulnerable code is running there. Every finding goes to the team that can fix it, in near real time.

Get a demo See pricing

Cloud · acmeToday

publicSecurity group · prod-paymentsPort 5432 open to the internet on orders-dbCritical

shareS3 bucket · acme-exportsReadable by an account outside your organizationExposed

admin_panel_settingsIAM role · ci-deployerCan escalate to administratorHigh

deployed_codeService · payments-apiRunning log4j-core CVE-2021-45046, internet accessibleUrgent

commitDatastore · orders-dbDefined in acme/infra, owned by Team PaymentsTraced

Inventory

Every account and resource, in one inventory.

Connect an AWS Organization, Google Cloud organization, Azure tenant or Oracle Cloud tenancy once. Heeler finds every account, cluster and about 250 resource types.

cloudAWS, Azure, Google Cloud, Oracle Cloud and Kubernetes

account_treeOne StackSet for an AWS Organization, no stored keys on Google Cloud

syncUpdated in near real time from cloud change events

Cloud Security Context Engine

Cloud inventory5 connections

ConnectionProviderScopeAccountsResourcesEvents

acme-awsAWSOrganization4218,406Live

acme-gcpGoogle CloudOrganization124,210Live

acme-azureAzureTenant62,388Live

acme-ociOracle CloudTenancy3912Live

eks-prod-usKubernetesEKS11,644Live

acme-aws · changes in the last 10 minutes+ ingress rulesg-orders · 0.0.0.0/0 on 5432+ bucket policyacme-exports · principal outside the organization

Exposure

See what the internet and outside accounts can reach.

Heeler follows the network path to each resource and tests the connection. It reads resource and trust policies to find public, cross-account and vendor access.

publicInternet accessible on 26 resource types, confirmed by a live test

sharePublic, cross-account and vendor access in AWS resource policies

admin_panel_settingsIAM roles that can escalate to admin, and identities no one uses

Cloud Security Context Engine

orders-dbRDS · prod-payments

databasePostgreSQLlocation_onus-east-1badgeHandles PII

OverviewExposureChecksDeploymentsExposed 2

publicInternet0.0.0.0/0

routerigw-prod · route table rt-publicpublic subnet

lan

Security group sg-orders allows 5432 from anywhereInbound rule on a database port

Critical

databaseorders-db · publicly accessibleendpoint

cable

Live connection test: port 5432 answeredReachable from the internet, not just configured

Confirmed

S3 bucket readable by an account outside your organizationResource policy · cross-account read

High

4Hops from the internet

2Exposures

Team PaymentsOwner

Cloud Events

See who changed what in your cloud, and catch the suspicious changes.

Heeler reads every write in AWS CloudTrail, Google Cloud audit logs and the Azure Activity Log in near real time. Dozens of Heeler-managed rules, mapped to CIS benchmarks and known attack techniques, flag the changes that need a look.

ruleHeeler-managed rules plus your own, each tested against the last 7 days before it goes live

location_onWho made the change, from which country, and what else they did in the 10 minutes around it

forumSuspicious events start workflows in Slack, Teams, Jira, Linear, email or a webhook

Cloud Security Autonomous Operations

Suspicious cloud eventsLast 24 hours

cloudAWScloudGoogle CloudcloudAzure

cancel

Audit logging disabled or removedStopLogging · acme-aws · ci-deployer

Critical

Snapshot shared with an unknown accountModifySnapshotAttribute · prod-payments · from a country not seen before

High

lan

Firewall opened to the internetcompute.firewalls.insert · acme-gcp · port 22 from 0.0.0.0/0

High

admin_panel_settings

Privileged role assigned broadlyOwner at subscription scope · acme-azure

High

12,480Writes today

4Suspicious

1New country

Code to cloud

Know which vulnerabilities are running, and where.

Heeler matches each deployment to the image, commit and repository it came from. Each code and dependency finding shows whether it ships in a running service, whether that service is exposed, and what data it can reach.

commitECS, Lambda, EC2, Azure VMs and Kubernetes matched to source commits

deployed_codeImages linked to their repository through build provenance and labels

priority_highExposure and data access raise Heeler Risk on code, dependency, IaC and image findings

Context Engine Autotriage

payments-apiService

cloudprod-us · ECS · 3 taskscommita41c9e2folderacme/payments-api

OverviewDeploymentsVulnerabilitiesInfrastructureEndpointsRunning 2

deployed_code

log4j-core 2.14.1 · CVE-2021-45046In the running image · internet accessible · reaches orders-db

Urgent

deployed_code

jackson-databind 2.9.10 · CVE-2020-36518In the running image · internet accessible

Urgent

folderspring-web 5.3.18 · CVE-2016-1000027repository only

commitDeployed a41c9e2 to prod-us2 hours ago

3 of 3Tasks on a41c9e2

2Running vulnerabilities

Team PaymentsOwner

Posture and compliance

Check every resource against the frameworks you report on.

456 checks for AWS, Azure, Google Cloud and Oracle Cloud, mapped to AWS Foundational Security Best Practices and CIS benchmarks. Scores by framework and account, re-checked in near real time.

ruleAWS FSBP, CIS AWS 3.0 to 7.0, CIS Google Cloud 4.0, CIS Oracle Cloud 3.1.1

tuneYour own frameworks, with versions and crosswalks

verified_userExemptions need a second approver and an end date

Cloud Security

Frameworks · acme · all accounts38 failing checks

63% AWS FSBP

CIS AWS 7.0 · 43%

CIS Google Cloud 4.0 · 71%

CIS Oracle Cloud 3.1.1 · 51%

Payments framework v3 · 78%

CriticalDatabase port open to the internet · EC2.19sg-orders · remove the 0.0.0.0/0 rule on 5432

CriticalRoot account without hardware MFA · IAM.6

HighCloud Storage bucket allows public read · Google Cloud

verified_userExemption EXM-0042 · approved by a second adminEnds 31 Mar

Ownership

Trace a failing check to the service, code and team behind it.

Pick any failing resource. Heeler shows the service that uses it, the infrastructure code that defines it, and the team that owns the account, with the steps to fix it.

Cloud Security Context Engine Infrastructure as code

rule

Failing checkEC2.19AWS FSBP · Critical

lan

Resourcesg-ordersprod-payments · us-east-1

database

Datastoreorders-dbRDS · handles PII

cloud

Servicepayments-apiprod-us · internet accessible

data_object

Infrastructure codeacme/infrards.tf defines orders-db

groups

OwnerTeam Paymentsowns the payments-prod OU

Incident responseWhat can the internet reach?orders-db on 5432confirmed by a live connection test

AuditWhich control fails?AWS FSBP EC2.19evidence for DORA and your own frameworks

Fix routingWho fixes it?Team Paymentssteps to fix, with CLI commands and references

How it connects

ConnectGrant read-only accessA CloudFormation StackSet for an AWS Organization. Workload Identity Federation for Google Cloud and Oracle Cloud, with no stored keys. An app registration for Azure.

CollectInventory and change eventsHeeler harvests every account and follows CloudTrail, Google Cloud audit logs and Azure Activity Log in near real time.

ReviewResults appear in HeelerCloud posture, inventory and failing checks, scoped to the accounts each team owns.

Before it reaches the cloud

Check infrastructure code and images before they deploy.

Block risky infrastructure changes on the pull request.

Terraform, OpenTofu, CloudFormation, Pulumi and Kubernetes manifests. Findings are matched to the live resources they define.

Explore Infrastructure as code

acme/infra · PR #318 · Heeler Guardrail

RDS instance publicly accessible · rds.tfBlock
Security group open to 0.0.0.0/0 · network.tfWarn
rds.tf defines orders-db in prod-paymentsLive

Scan the images your cloud runs.

Images are scanned when they are pushed to ECR or Artifact Registry. Heeler finds which ones run in ECS, Kubernetes, Cloud Run and Lambda.

Explore Container images

Container images · in use · prod-us

payments-api:a41c9e2 · ECS12 fixable
AWS access key in layer 4Secret
Base image node:18-alpine to node:22-alpineClears 9

Report cloud posture from your coding agent.

The Heeler MCP server returns posture by framework and account, exposure and failing checks to any MCP client.

Explore MCP Server

MCP · cloud_posture_summary

AskCloud posture for the board
Heeler MCPFrameworks, accounts, exposure
ReportAWS FSBP 63% to 68%

Know what runs in your cloud, what can reach it, and who fixes it.

Get a demo See pricing