It answers for you to your insurer, your auditor and your customers. It tells you the few things that really matter. And it watches AWS, Azure and GCP every 10 minutes, even when you are not looking.
Answers for you
Cyber insurance and customer questionnaires, plus five frameworks, backed by evidence from your accounts.
Tells you what matters
From hundreds of findings to the few combinations that can actually hurt you.
Watches in minutes
A public bucket or a new admin reaches you within minutes, with who did it and from where.
Read-only · Nothing to install or switch on · AWS, Azure and GCP
Security · all your accounts
74
Security Score
Up since last week
What matters today
Critical change
3 min ago
Bucket or snapshot made public
s3://export-facturas · ci-deploy · 203.0.113.24
Still open on re-check · alert sent to Slack
Cyber insurance questionnaire
Answered with evidence · ready for review
Illustrative data
3
clouds in one view: AWS, Azure and GCP
10 min
between reads of your cloud audit log
5
frameworks with a questionnaire template and a PDF per account
6
categories: network, exposure, identities, encryption, logging and secrets
€20
per account per month, everything included
Security is rarely bought for fun: it gets bought when a third party pushes. For each of them, AAA Sentinel gives you what they ask for, taken from what it sees in your accounts.
“Before we renew the policy, please fill in this questionnaire.”
What AAA Sentinel gives you
“Show the ENS category the tender requires.”
What AAA Sentinel gives you
“We need this security spreadsheet before we sign.”
What AAA Sentinel gives you
“What evidence do you have for each control?”
What AAA Sentinel gives you
“Show us your risk-management measures.”
What AAA Sentinel gives you
“Are we OK on security?”
What AAA Sentinel gives you
Every 10 minutes, AAA Sentinel reads your cloud audit log: CloudTrail, Activity Log and Cloud Audit Logs. Nothing deployed in your account.
Reads
The AWS, Azure and GCP audit log, every 10 minutes.
Detects
The changes that open a door, not every console click.
Re-checks
It looks at the resource again before alerting. If it is already closed, it leaves you alone.
Alerts
What changed, who did it and from where. By email, Slack, Teams, webhook or ticket.
Critical changes
Illustrative data
Bucket or snapshot made public
3 min ago
s3://export-facturas
ci-deploy from 203.0.113.24
Still open on re-check · alert sent to Slack
Admin or database port opened to the internet
18 min ago
nsg-backoffice · 3389/tcp
ops-admin from 198.51.100.7
Already closed on re-check · no alert
Admin rights granted
41 min ago
roles/owner → sa-temporal
deploy-bot from 192.0.2.40
Still open on re-check · alert sent to Teams
MFA removed
52 min ago
iam:user/backoffice
ops-admin from 198.51.100.7
Still open on re-check · alert sent to Jira
Email, Slack, Teams, webhook or a Jira or Linear ticket. Plus a timeline of every critical change.
If someone removes AAA Sentinel’s access, you get an alert too. You are never left blind without knowing it.
A single finding is rarely the problem. Two together are. AAA Sentinel connects what it finds and puts the toxic combinations in front of you, in order.
Individual findings
Toxic combinations
Anyone can invoke it, and there are credentials inside.
Reachable from the internet and readable by whoever gets in.
One leaked password is enough, and the key has not been rotated in months.
Open to the internet, with transport only half protected.
A downloaded key with too many permissions is a back door.
Security and cost, together
Because AAA Sentinel already watches your cost, it connects the two: an open resource that nobody uses and that you pay for every month. Closing it lowers the risk and the bill at once, with the estimated saving in your currency.
It explains each finding in your language, chains attack paths together and proposes a prioritised plan: what to close first and why.
Five frameworks, each with a questionnaire template and a PDF per account. Every measure says what the scan checks and what your team answers.
73
Annex II measures
Levels per dimension (C, I, T, A, D) and a statement of applicability. Change a level and preview what changes first.
Spanish ENS, built in
10
measures in Article 21(2)
Each risk-management measure, one by one, with what the scan sees.
93
Annex A controls
Questionnaire template for the 2022 edition to prepare your audit.
38
criteria
Security, availability and confidentiality, in a questionnaire template to prepare your audit.
20
articles
The ones that bind the financial entity, with evidence from its accounts.
Plus the CIS benchmark report for every account.
We help you prepare your ENS, NIS2, ISO 27001, SOC 2 and DORA audits. We do not certify: your auditor or the accredited body does.
Who has more permissions than they use, effective admins, orphaned or unused identities, and idle keys and service accounts. With a least-privilege recommendation, on AWS and GCP. On Azure, subscription admins and permissions assigned to deleted identities.
It imports CVEs from Amazon Inspector and ECR, Defender Vulnerability Assessment and GCP Artifact Analysis, and ranks them by internet exposure and by cost. No agents.
The same rules in the AAA Sentinel IaC CLI, on the Terraform plan and in the pull request. Plus a drift alert when what is deployed moves away from the code.
Pull request comment
Our own rules in 6 categories, without switching on each cloud’s native tools.
With its evolution over 30, 90 or 365 days: what you fixed, what is new and how long fixes take. The current Score leaves out risks you accept.
It tells you what it could not check and which permission is missing, instead of assuming all is well.
It imports and deduplicates Security Hub, GuardDuty, Defender for Cloud and Security Command Center. One plan, with corroborated findings flagged.
A full automatic scan every day, and a manual one whenever you want.
Accept a risk with its reason, with a trail of who accepted it.
Security priorities, posture over time, questionnaires, frameworks and CIS, in Spanish, English, French and Portuguese.
One report per managed client with the questionnaires, the five frameworks and posture over time, a section per account, in their language and without your internal notes.
Score, posture over time, findings, framework status and critical changes through the API and from Claude, Cursor or any MCP client.
By default, we only read. If you want AAA Sentinel to close what it finds, you create remediation agents with the write permission you decide.
Proposes
The exact fix, with the reason why.
You approve
Someone on your team gives the OK. High-risk changes need two approvers.
Waits
A grace period of at least 24 hours, in case someone stops it.
Applies
With the permission you granted, not one more.
Verifies
It checks the issue is closed and keeps a trail of who asked for it.
Is the resource managed by Terraform? Your CI (GitHub or Bitbucket) opens the fix as a pull request, not as a console change, so there is no drift. If the value comes from a variable or an external module, we show the resource and the attribute to change in the code.
Agents execute on the Business plan. On Pro you see the recommendation and the fix plan.
Each cloud’s native tools do their own cloud well. The large CNAPP platforms are built for dedicated security teams. AAA Sentinel is for the company that does not have that team.
| What is compared | Native tools | Large CNAPP platforms | AAA Sentinel |
|---|---|---|---|
| What you have to switch on | Each service, in each account, paid separately | Connectors or deployments in your accounts | One read-only role. That’s it |
| Clouds | One each | Several | AWS, Azure and GCP in one view |
| Cost cross-check | Each service on its own | Not their focus | Exposed, unused and costing you, with the estimated saving |
| Cyber insurance and customer questionnaires | No | Depends on the product | Answered with evidence, in 4 languages |
| Spanish ENS | No | Rarely a priority | 73 measures, levels and applicability |
| Price | Per service and per cloud | Annual contract, through sales | €20 per account per month, published |
€20
per account per month
Everything included. Turn it on only for the accounts you want covered and remove it whenever you like.
Get startedAdded to the Pro (€49 a month) and Business (€249 a month) plans. The Free plan does not include it.
Read-only. Nothing to install. €20 per account per month.
