Multi-cloud security by the numbers
Facts you can rely on
one.O Guard is a cloud security platform that catalogues configuration, identities, code, data and workloads across your clouds and checks them against one policy database.
It is the base for the modules CSPM, CIEM, DSPM, CWPP, ASPM and AI-SPM that make one.O Guard a cloud-native application protection platform (CNAPP). NIS2 or DORA auditors can look up any account in the compliance view in seconds.
- Any issue traceable to the underlying configuration
- Controls built on CIS and other published benchmarks
- Accepted risks with their written reasons
- Any issue traceable to the underlying configuration
- Controls built on CIS and other published benchmarks
- Accepted risks with their written reasons
Small gaps become an exploitable chain
Weaknesses that rank low in isolation can add up to real risk, and tracing that combination is what attack path analysis does. one.O Guard correlates those weaknesses into a higher-risk issue and maps the chain, so your team has one threat to investigate first.
Conditions that combine into a path:
- Serverless function running an image with a known CVE
- The function's account, with rights to business records
- Internet exposure plus a secret in the function's code
- Serverless function running an image with a known CVE
- The function's account, with rights to business records
- Internet exposure plus a secret in the function's code
Cloud security platform in six modules
Each part of one.O Guard covers a different kind of risk, and whatever any of them raises arrives with its asset and its remediation. What used to need a separate tool per module now shows up in one record.
CSPM
Accounts are checked against the policy database. That cloud security posture management (CSPM) pass hands your team the fix steps for whatever falls short.
CIEM
Service accounts and people appear beside the permissions they hold, the cloud infrastructure entitlement management (CIEM) view. An over-privileged identity stands out before an intruder finds it.
DSPM
A data store that is public or outside its permitted region is flagged without a look inside. A GDPR review starts from that data security posture management (DSPM) list.
CWPP
Container and Kubernetes image vulnerabilities rank by internet reachability, a cloud workload protection platform (CWPP) ranking that puts exposed workloads first.
ASPM
The repository scan, the application security posture management (ASPM) module, covers source code, dependencies, secrets, infrastructure-as-code and CI/CD workflows. A leaked credential turns up here before a customer's due diligence does.
AI-SPM
The AI services and models your teams deploy get the same posture checks, the AI security posture management (AI-SPM) scope, and a model endpoint is listed next to its workloads.
Cloud asset inventory by asset type
Repositories
Developers keep working in their source-control platform; one.O Guard integrates with it and scans your resources. A repo enters the graph with its main language and its open items, and its score moves as they are fixed.
Cloud resources & workloads
Once you onboard an account or project, its compute, storage, networking and managed services enter the cloud asset inventory, which is rebuilt daily and updated in between. Endpoint scanning then probes what is public from beyond your perimeter, giving you an attacker's-eye insight into exposure.
Identities with their permissions
Human and machine principals arrive with their role bindings from the IAM service they belong to, and one.O Guard keeps access relationships as edges in the entitlement graph. For example, on Google Cloud you can trace an identity through to the resource it reaches, which is where an investigation starts.
Data stores
For databases, datasets and storage buckets one.O Guard notes location, exposure and who can get in. Criticality comes from the labels your teams already apply. A flagged bucket is prioritised without anyone opening it, and child resources inherit the parent's label.
Alerts go to the asset's owner
Each group writes a rule for its scope and decides which severities count. The matching results arrive in that group's Jira project or mailbox, and one.O Guard reconciles the rules on a 30-minute cycle, so nobody forwards anything by hand. Your automation can pull the same data over the REST API.
FAQs about one.O Guard
Whatever an outsider can get to, such as internet-facing endpoints, open storage and permissive identities, is your attack surface. An attack path runs across it, for example from a public function through a secret in its code to customer records. That route is what one.O Guard's attack path analysis uncovers, and it is reported as a distinct threat.
one.O Guard keeps multi-cloud security consistent by applying one policy database whichever provider hosts a resource. A public bucket rolls up to the same compliance control wherever it lives, and the score is worked out by a single formula at any scope.
The leading providers (AWS, Microsoft Azure, Google Cloud and STACKIT), code repositories on GitHub, GitLab and Bitbucket, and Kubernetes clusters hosted by those providers. Other SaaS applications you subscribe to, such as a messaging tool or an ERP system, are outside it. Ask for the current list in a demo if yours is not named here.
Yes. The documented REST API serves issues and assets, and the Terraform provider manages policies and access as code, so a ticketing workflow, a remediation pipeline or an AI agent you operate can take a case and work it from there.
Start with who owns which accounts and projects, then point a team's rule at the ticket queue it works from. one.O Guard keeps delivering matching alerts to that destination, and a shared inbox nobody reads never becomes the fallback.
Ready to see how a cloud security platform works?
We're happy to help with your questions and requirements. Book your personal consultation now, or send us a message.
