Cloud misconfiguration is invisible. Until it isn't.
Cloud Security Posture Management (CSPM) is the continuous, automated audit of cloud accounts for misconfigurations, risky exposure, and compliance drift. The Retrievy CSPM Engine continuously audits AWS, Azure, GCP, OCI, and Cloudflare. Findings are scored, framework-mapped, and tracked through their full lifecycle. The question stops being "are we compliant?" and starts being "what's the next thing to fix?"
Retrievy CSPM dashboard. Score, severity distribution, trend over time.
What you don't see.
Most teams audit their cloud once a quarter, against a static checklist, with mappings to frameworks that are already six months stale. In between audits, IAM policies drift, S3 buckets flip public, KMS rotations get postponed, and accepted-risk exceptions never expire.
You don't see drift between scans. You don't see how risk-accepted findings inflate the dashboard. You don't see the same misconfiguration recurring across three accounts because each one has its own auditor.
Retrievy CSPM removes that fog.
Agentless onboarding.
Five minutes per cloud.
AWS
Cross-account IAM role with the SecurityAudit + ReadOnly managed policies. CloudFormation template provided.
Microsoft Azure / Entra / M365
OAuth consent flow. Read-only scopes. App registration auto-validated.
Google Cloud Platform
OAuth with org-wide admin grant. Service-account scoped to read-only roles.
Oracle Cloud Infrastructure
Webhook-bound onboarding script run inside your tenancy. No outbound exposure of secrets.
Cloudflare
OAuth-bound API token. Scoped to Account · Zone · Access read.
Connect a provider, the engine schedules the first scan immediately, and the scored posture appears in your dashboard within hours.
Five clouds.
One unified audit.
Every connected provider, every account, every region — normalized into one ranked backlog. Drill into any account; roll up to one global cloud score.
AWS, Azure, GCP, OCI, Cloudflare. Audited side by side.
One score per provider, side by side. Roll up into one global cloud score, drill into any account or subscription for the per-resource view.
Every cloud-native surface, audited.
IAM, network, storage, compute, KMS, logging, tagging, monitoring, backup, DNS. Categories normalized per provider, so the same posture question gets the same answer across AWS, Azure, GCP, OCI, and Cloudflare.
Drill into the account that matters.
Each AWS account, Azure subscription, GCP project, and OCI compartment has its own posture dashboard. Click; you're there.
Continuous, agentless.
Daily scans across every connected provider. OAuth or IAM-role auth. Zero agents to install or maintain on the cloud side.
Cloud identity goes to ISPM. Cloud infrastructure stays in CSPM.
A single classifier reads each finding's signals and routes it to the right module. Cloud IAM and IDP findings (AWS IAM, Entra ID, GCP IAM, OCI Identity Domains) land in ISPM. Cloud infrastructure findings stay in CSPM. No provider-specific if/then trees, no manual triage.
Vendor-grade guidance,
inline on every finding.
Verifies that S3 buckets do not allow public READ via bucket ACL or bucket policy. Public READ exposes object listings and contents to unauthenticated principals.
aws s3api put-public-access-block \
--bucket my-bucket \
--public-access-block-configuration \
"BlockPublicAcls=true,IgnorePublicAcls=true,\
BlockPublicPolicy=true,RestrictPublicBuckets=true"- → AWS · S3 Block Public Access
- → CIS AWS Foundations 2.1.5
- → NIST CSF PR.AC-3
Findings flow Triage → Verifying → Hardened. The "Trust but Verify" rule means only the next scan can promote a finding to Hardened. No manual flips. Exceptions are a separate lane with expiry dates.
Group findings.
Ship a sprint.
Some fixes are quick. Others are quarterly initiatives. Multi-finding cleanup work that needs an owner, a deadline, and an audit-ready report at the end. That's a Remediation Project.
One project, many findings.
Bundle related findings under a single project. Use it for "deprecate every Kerberoastable account this quarter", "remediate the EU cloud baseline before audit season", or "clean up the FortiGate rule debt".
Owner. Deadline. Observation log.
Each project has an accountable owner, a target date, and a chronological observation log: who changed what, when, and why. The audit trail is intact by default.
Auto-generate a PDF on close.
When the project closes, Retrievy renders a PDF report. Scope, finding inventory, before-and-after posture, observation timeline. Hand it to your auditor without writing a single line.
Trust but Verify, project-wide.
Findings inside a project still follow the scan-verified status model. The next scan promotes them to Resolved. The project closes when every finding it contains is verified.
Twenty plus frameworks, one cloud finding.
Scan once, satisfy every framework. A single misconfiguration in AWS, Azure, GCP or OCI lights up the corresponding control in every standard you report against.
CIS AWS Foundations v2.0 through v6.0, CIS Azure Foundations v2.0 through v5.0, CIS GCP Foundations v2.0 through v4.0, and CIS OCI Foundations v3.0 / v3.1. Every finding tied to a CIS Control ID and the cloud-specific section.
Six functions: Govern, Identify, Protect, Detect, Respond, Recover. Every finding tagged at the function and category level, with NIST SP 800-53 Rev 5 controls layered alongside.
Cloud Matrix, Identity Matrix and Enterprise Matrix techniques and sub-techniques surfaced from the finding payload. Tactic and technique IDs render on every applicable finding.
CSPM, answered.
Score your cloud
today.
Connect your first provider in five minutes. The first scored posture appears the same day.
Try everything free for 14 days on your own data. Request your trial code. No credit card required.