Know where your cloud security stands
One dashboard across every connected account and cluster: a security score, open findings by risk, what is exposed to the internet, and how it is trending.
See how an attacker could reach your sensitive data
Individual findings look harmless until they chain. Verity joins network, identity and data findings into a path from an exposed entry point to the data at the end, with the evidence behind every hop.
Fix what matters first, and know when it is actually fixed
Verity ranks findings by real risk on your resources, then tracks each fix from owner to scan-verified closure.
Prioritization: risk on your resource, not a generic severity label
Four signals Verity already has, including the attack paths a finding sits on.Is the resource reachable from the internet: public IP, open security group, public bucket policy, unauthenticated endpoint.
What the resource holds, read from your tags (pii, phi, pci) and the classification you set per account.
What an attacker gets next: the paths through the resource, IAM permissions reachable from it, admin roles.
Whether the misconfiguration is trivially usable: anonymous access, default credentials, known-exploited weaknesses.
Verified fixes: a finding is closed only when the next scan proves it
Every finding gets an owner, guided fix steps and a state. Verified results become compliance evidence.How a fix is tracked
- Applied is what you say; verified is what the next scan proves. Only verified counts.
- Each finding carries guided fix steps for the failing resource; manual fixes get a documented step and an owner.
- If a verified fix regresses, the finding reopens with the change that caused it.
- Owners and states sync to Trakly tickets; the audit log keeps who did what.
Know whether your controls are passing, every day
Each rule in Verity is mapped to the controls it satisfies across your chosen frameworks. Every scan updates control status and stores the passing result as dated evidence. When a rule stops passing, the control reopens and you are alerted, long before the audit.
- RULE
- What is checked, on which resource type
- CONTROL
- The framework clause the rule satisfies (one rule, several frameworks)
- EVIDENCE
- Each passing result, stored with account, resource and timestamp
What Verity covers today, and what is next
Read-only access, scheduled scans, explicit scope. AWS and Amazon EKS are available in early access; additional providers follow.
CIS AWS Foundations Benchmark across every connected account and region: IAM, S3, EC2, VPC, RDS, KMS, CloudTrail, Config.
CIS Amazon EKS Benchmark and control-plane configuration for clusters discovered from connected accounts.
CIS GCP Foundations Benchmark and GKE. On the roadmap; not available in early access.
CIS Azure Foundations Benchmark and AKS. On the roadmap; not available in early access.
Permissions Verity needs
- A read-only IAM role per AWS account, created from a CloudFormation or Terraform snippet we provide
- A read-only ClusterRole on each EKS cluster for benchmark checks
- Your framework choice and the tags that mean sensitive data (pii, phi, pci)
What Verity does not do
- Does not change anything in your accounts. Fixes are guided steps your team applies, or SquareOps applies under a services contract.
- Does not scan application code or run penetration tests. VAPT is a separate SquareOps service.
- Does not scan container images, detect runtime behaviour or enforce admission policy. Verity reports; it does not block.
- Does not certify you. It collects the evidence; your auditor issues the report.
Connected and scanning the same day
A read-only role per account, a framework choice, and your first ranked findings arrive with the first scheduled scan.
- 0110 min per account
Connect your environment
Deploy the read-only role in each AWS account. EKS clusters are discovered automatically and get a read-only ClusterRole.
- 02first scheduled scan
Review your findings
Choose frameworks and sensitivity tags. The first scan returns your security score, ranked findings and any attack paths.
- 03ongoing
Track remediation
Assign owners, work the ranked list, and let the next scan verify each fix. Evidence accrues under every mapped control.
Hand your auditor evidence, not screenshots
The evidence Verity collects during the period is what the auditor receives: a per-control export and, if they want it, a read-only login. Each item is dated to the scan that produced it, so sampling across the audit period is a filter, not a project.
- Per-control export (PDF or CSV) with every evidence item: account, resource ID, attribute, timestamp, rule
- Framework summary: controls passing, reopened and not applicable, with dates
- Sampling across the audit period by filtering evidence to any date range
- Optional read-only auditor login that expires after the audit window
Free during early access
Per-account pricing follows at general availability. Early-access teams keep their rate for 12 months after GA.
- Daily scheduled scans
- Security score, risk ranking and attack paths
- SOC 2 + ISO 27001 mapping
- Remediation tracking with Trakly tickets
- Direct line to the engineering team
- Everything in Early access
- HIPAA + PCI DSS mapping
- Evidence export and auditor login
- Additional cloud providers as released
- Everything in Team
- SSO / SAML
- Custom control sets
- Deploy in your AWS account
- Dedicated support
Questions about Verity
Not covered? An engineer replies within one business day.
consult@squareops.comNot yet. Verity is in early access with a limited number of teams. Request access and an engineer will follow up within one business day.
AWS and Amazon EKS are available in early access. Google Cloud (including GKE) and Microsoft Azure (including AKS) are on the roadmap and not yet available.
No. Verity uses read-only roles. Each finding comes with guided fix steps your team applies, or SquareOps engineers apply them under a services contract.
Scans run on a daily schedule, with a full inventory refresh weekly. Fixes are verified on the next scheduled scan after they are applied.
A chain of findings that together let an attacker reach a sensitive resource: an exposed entry point, the identity or permission it reaches, and the data at the end. Each hop is backed by the rule result that proves it, and Verity shows which single fix breaks the most paths.
Four weighted signals: exposure (0.35), data sensitivity from tags (0.30), attack-path reach through IAM (0.20) and exploitability (0.15). The signals behind each score are shown on the finding.
SOC 2, ISO 27001, HIPAA and PCI DSS 4.0, with the CIS AWS Foundations and CIS Amazon EKS benchmarks as the rule baseline. Custom control sets are available on Enterprise.
Security Hub reports findings by severity. Verity ranks them by exposure, data sensitivity and attack-path reach, tracks each fix to scan-verified closure, and turns passing controls into dated audit evidence.
Remediation tickets sync to Trakly. Alerting and additional ticketing integrations are planned.
Verity stores configuration attributes and rule results, not your data, encrypted at rest and in transit. Enterprise plans can deploy into your own AWS account.
Yes. SquareOps cloud security and compliance services include readiness programs, VAPT and DevSecOps, with Verity tracking posture and evidence throughout. SquareOps itself is ISO 27001 certified.
Connect one AWS account. See your first ranked findings.
Read-only access, free during early access, and a direct line to the engineers building Verity. Limited seats.