Connect your cloud read-only, and bring the findings you already have
Defendermate builds a live model of your environment from a read-only connection and the tools you already run. Nothing to install.
From sign-up to first verdicts
- Start free in the sandboxEvery capability on sample data.
- Connect your AWS accountA read-only role, in minutes.
- Bring your findingsVerification starts as they arrive.
What Defendermate uses, and why
Every source maps to the decisions it informs.
Findings
Verification, attack paths, scoring.
Assets and configuration
The model of your environment.
Identity and permissions
Attack paths and techniques.
Controls in place
Whether a path is already blocked.
Detection signals
Which mitigations to prioritize.
Patch state
Whether a fix is already applied.
Business context
What matters most.
Typical sources for each
| Data | Typical sources |
|---|---|
| Findings | Amazon Inspector, AWS Security Hub, Tenable, Qualys, Rapid7, Wiz, Snyk, Trivy, Semgrep |
| Assets and configuration | Your cloud provider’s APIs |
| Identity and permissions | AWS IAM and IAM Identity Center, Okta and other identity providers |
| Controls in place | Security groups, AWS WAF, AWS Network Firewall, Cloudflare, Palo Alto Networks, Zscaler |
| Detection signals | Amazon GuardDuty, Splunk, Microsoft Sentinel, Elastic, CrowdStrike, Microsoft Defender for Endpoint |
| Patch state | AWS Systems Manager Patch Manager, Intune, Configuration Manager, Tanium, Automox |
| Business context | Resource tags, ServiceNow CMDB |
Detection signals prioritize mitigations; they never decide whether something is exploitable.
Always current
Configuration drift, a new deploy or a new advisory re-checks the affected verdicts automatically.
Connectors for every other tool
Community, your own, or supported by Defendermate.
See integrations
What’s kept, and what’s only read
Context like tickets and chat is read live, never stored.
See trust
Start with a free account
Explore the sandbox, then connect your AWS account read-only.