Misconfiguration detection
Know what is wrong, and why it matters.
ACSE checks every resource across your clouds against the frameworks and policies you choose. Each finding says what is misconfigured, which control it affects and where it sits on a path to your data, in words a risk officer can follow.
One view of every cloud
AWS, Google Cloud, Azure, Kubernetes and AI infrastructure are checked the same way, against the same policies.
Findings you can trust
Checks are deterministic. A fact ACSE cannot establish reads as unknown and counts against you, never as a pass.
Priority that reflects real risk
Findings on a path from the internet to data rise to the top, so your team fixes what an attacker would use first.
How detection works
From cloud API to clear finding
- Read the cloudRead-only adapters collect configuration from the provider’s APIs, inside your account, on a schedule or on demand.
- Normalize itEach provider’s answer becomes one consistent model, so a public bucket means the same thing on every cloud.
- Evaluate policyChecks written as policy as code evaluate every resource. The provider’s raw response is kept as evidence, verbatim.
- Explain the findingA failure becomes a finding with its control, its severity, its place on the risk graph and the fix that closes it.
What ACSE checks
The misconfigurations that get exploited
Storage
Public access, versioning, default encryption, access logging and retention.
Identity
Over-broad policies, full-admin grants, password policy, unused and long-lived credentials.
Network
Open security groups and firewall rules, plain-HTTP listeners, exposed management ports.
Compute
Instance metadata settings, public images and snapshots, privileged containers.
Logging and monitoring
Audit trails switched on, protected and kept for as long as your policy says.
Encryption
Keys, rotation and encryption at rest and in transit, checked per service.
Policies
Change policy without guessing
Policies are versioned. Before a change takes effect, ACSE simulates it against your real findings and shows exactly what would change.
Loosening a policy needs a second person. Tightening it applies at once. Either way, the change is on the record.
Clear boundaries
What detection means here
In ACSE, detection always means misconfiguration detection: how your cloud is set up, measured against policy. ACSE does not watch for live intrusions, scan workloads for vulnerabilities or classify the data inside your stores.
That focus is deliberate. It keeps every finding deterministic, explainable and fixable as code.
Questions
What people ask us
How often does ACSE scan?
On a schedule you set, and on demand from the portal. A re-scan queues a command the runtime in your account picks up, so nothing needs to reach into your cloud.
What happens when a check cannot get an answer?
The result is unknown, and unknown never counts as a pass. It lowers the score until ACSE can establish the fact, so gaps in visibility are never hidden.
Can I turn checks off?
Yes, by policy. A control that depends on a check you turn off reads as not evaluated and counts as unknown, so the score stays honest.
Keep reading
Related
Risk graph
ACSE links resources into a risk graph and traces the paths from the internet to your data, so your team fixes the misconfiguration that breaks the chain.
ReadACSEClouds
ACSE checks AWS, Google Cloud, Azure, Kubernetes and AI infrastructure for misconfigurations through read-only, keyless connections you set up yourself.
ReadACSEFrameworks
ACSE maps its cloud checks to CIS, PCI DSS, NIST 800-53, FedRAMP Moderate, CCCS Medium, ISO 27001 and SOC 2, with signed, versioned framework content.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.