Ask what a security tool costs and the answer is the licence. Ask what it really costs and you get a different list: the weeks of rollout, the agent that has to be kept current on every host, the credentials nobody wanted to hand over, and — the largest one — the hours engineers spend deciding which of four hundred findings actually matter.
Two design choices in our platform attack those costs directly: we connect agentless, and we build a graph of your estate before we scan anything. This post explains what each saves, for whom, and where the limits are.
Agentless: what it means and what it is not
Connecting a cloud installs nothing on your servers. For AWS that is a Terraform-created role, for Azure an app registration, for GCP a service account. We read configuration and metadata through the provider's own APIs (any content sampling for data-security checks is bounded and stays in your account), and we verify the credentials with a real call before storing them, so a bad connection fails at setup rather than silently at 2 a.m. We never hold write access to your cloud.
Agentless is not a claim that nothing can ever be deployed. Some things genuinely need to run somewhere — an optional runtime sensor, or a thin outbound-only connector to reach a private network. Those are opt-in, off by default, and documented as such. The default is that a new environment is visible within a connection, not a rollout project.
What it saves
| Who | Cost avoided |
|---|---|
| Security team | No agent fleet to deploy, upgrade, and chase across environments; coverage does not depend on every host having been touched. |
| Platform / infrastructure | No kernel-adjacent software on production hosts, no performance budget to defend, no change-window negotiation for a security tool. |
| Compliance / procurement | A smaller access story: read-scoped roles you can review in minutes, and no write path to explain to an auditor. |
| Finance | Less engineering time spent on the tool rather than the risk. |
Graph-first: a list of findings is not a picture of risk
Most scanners work one layer at a time and return a list. A vulnerable library in a repository, a permissive role in the cloud, an exposed endpoint, and an AI agent with a tool that can call all three are four rows — but they are one path. Which of the four rows matters depends on the connections between them, and a list cannot express that.
So we build the map first: agents, repositories, workloads, identities, network routes and data stores, and the relationships between them. Every later step writes back into it — discovery of shadow AI, penetration-test results, posture findings — so each starts with the context the last one produced.
What it saves
- Triage time. A finding that cannot be reached from anything exposed, or that touches no sensitive data, drops in priority; one on a reachable path to a data store rises. Engineers read fewer things, in a better order.
- Duplicate work. One finding on a shared library or role is one fix, not one ticket per affected service.
- Tool sprawl. A graph shows which of your existing controls cover which assets. Overlap is visible, and so are the gaps — including AI and agent surfaces that no other tool in the stack sees.
- Audit preparation. Evidence at every hop of a path, mapped to the frameworks your auditor already uses, is easier to hand over than a spreadsheet of exports.
For developers
The graph is not only for the security team. The same context that ranks a finding decides where it shows up in your workflow: a CI check that gates a pull request on proven risk instead of every low-severity library warning, and fixes delivered as draft pull requests that a person reads and merges. A machine-written security change never lands unreviewed — that is a rule, not an option.
For the budget
Pricing follows the shape of what we do. Plans are set by the size of your estate — workloads and agent identities — rather than by scan count, so discouraging people from scanning is not built into the bill. The free tier includes the full estate graph, because the graph is the first step of everything else and you should see your whole surface before paying for anything.
Work it out with your own numbers
We would rather you run the arithmetic than take a percentage from us. Four questions:
- How many hosts or accounts would a security agent have to be installed on, and how many engineer-hours does keeping it current cost per quarter?
- How many findings does your current tooling produce per month, and how many minutes does a human spend deciding each one is real?
- What share of those, on inspection, could not be reached from anything exposed?
- How often does one root cause produce many separate tickets?
Multiply through by a loaded engineering rate. Those four numbers are where the money is, and they are yours.
Limits
Start with the free graph from the platform page, read about cloud posture and shadow-AI discovery, or see pricing.