- Home
- Why ACSE
Why ACSE
Works with the tools you already have
Most teams already have something that finds cloud misconfigurations: a security platform, the cloud provider’s own tools, or both. ACSE doesn’t ask you to replace them. It adds the part that usually happens by hand: a validated fix in your code, a decision by a named person, and evidence you can hand to an auditor.
Keep your current tools
ACSE works alongside the platform and cloud-native tools your team already relies on.
Close findings, not just count them
Each finding can end as a reviewed pull request, a recorded decision and a verified result.
Show the work to an auditor
Every fix leaves signed, chained evidence in your account that anyone can verify offline.
The gap
Finding was never the hard part
Detection tools are good at producing findings. The work that follows is harder: working out which code owns the resource, writing a change that won’t break anything, getting the right person to approve it, and proving afterwards that it was authorized, tested and reversible.
That is where ACSE sits. It takes a finding to a governed fix and a sealed record, whichever tool raised it.
Where ACSE fits
Each tool does its job
Your cloud security platform
Keeps doing what it does across your estate: posture, attack paths and the other disciplines it covers.
Cloud-native tools
Your provider’s own security services keep reporting on their cloud, as they do today.
ACSE
Adds the governed fix and the evidence: a validated draft pull request, a human decision bound to what was shown, verification and a sealed record.
Fix what others find
One queue, whoever found it
ACSE runs its own misconfiguration checks, and can also take findings from the tools you have.
- Bring the findings togetherFindings from your existing tools and from ACSE’s own checks are matched and deduplicated into one fix queue.
- Find the owning codeACSE resolves the repository, file and module that define the resource, at an exact commit.
- Propose a validated fixThe change is planned offline, re-checked against your policy and judged for blast radius, then opened as a draft pull request.
- Decide, verify, sealA person approves with step-up MFA. After your pipeline deploys, ACSE verifies the resource, watches it and seals the record in your account.
Overlap, plainly
Where ACSE overlaps, and where it doesn’t
In ACSE, detection always means misconfiguration detection. It is not a threat detection, workload scanning or data security tool.
- Misconfiguration checks
- Overlaps. ACSE checks AWS, Google Cloud and Azure configuration, mapped to the frameworks you report on.
- Framework posture
- Overlaps. ACSE reports raw and governed scores per framework.
- Attack paths
- Overlaps for paths built from configuration and trust links.
- Workload vulnerability scanning
- Not offered. Keep the tool you use for it.
- Data security posture
- Not offered. ACSE doesn’t classify or scan your data.
- Runtime threat detection
- Not offered. ACSE doesn’t watch activity for attacks.
- Governed fix and evidence
- What ACSE adds: validated pull requests, bound human decisions, verification and offline-verifiable evidence.
In one line
Keep the tools that find problems. Add the one that shows each fix was authorized, tested and reversible.
ACSE fits beside what you run today, connected read-only, with evidence kept in your account.
Questions
What people ask us
Do we have to replace our current tools?
No. ACSE is designed to work alongside them. Many teams keep their platform for broad coverage and use ACSE to fix and prove.
Can ACSE fix findings our other tools raise?
Yes. Findings from your existing tools join ACSE’s own in one deduplicated fix queue, and go through the same validation, approval and evidence. See fixing existing findings.
Does ACSE detect attacks or scan for vulnerabilities?
No. ACSE detects misconfigurations only. It doesn’t do workload vulnerability scanning, data security posture or runtime threat detection.
What does ACSE connect to?
Your clouds through read-only access, your repositories through an app you install, your identity provider for sign-in and MFA, and optionally chat and a SIEM for notifications. See integrations.
Keep reading
Related
Fix existing findings
Whoever detected the misconfiguration, ACSE turns it into a reviewed fix in your own code, verifies the cloud afterwards and keeps a signed record.
ReadPlatformIntegrations
ACSE works with the tools your teams already use: GitHub and Terraform for fixes, your OIDC identity provider for sign-in and MFA, Teams and your SIEM.
ReadPlatformFix
ACSE turns a cloud misconfiguration into a validated pull request in your own Terraform, generated by rules and approved by a person. Never auto-merged.
ReadTalk to us
See ACSE on your cloud.
Tell us what you run and what your auditors ask for. We’ll show you the loop end to end: a real finding, a fix as code, an approval with MFA and the sealed record.