New Savings Proposals: approve, test and roll back cost changesLearn more Sign in|Talk to a cloud engineer
Product tourGet a demo

What we're building next in Atlas

These capabilities are rolling out to early-access customers. They use the same graph, guardrails and audit trail as the rest of CloudLens. Ask us to turn them on for your organization.

Request early accessExplore Atlas
What you're watching (early access)
  1. 1
    Ask the question in plain English

    Which internet-facing workloads can reach PII? The question is typed into Atlas Copilot and sent.

  2. 2
    Read the answer as paths

    Three workloads can reach PII. The shortest path runs checkout-api to checkout-task-role to customer-exports, drawn in red.

  3. 3
    Check the table and follow up

    checkout-api is Critical; partner-webhook and search-api are High. Suggested follow-ups include limiting to production and creating Jira issues for all three.

Who does thisSecurity engineer or head of security preparing for a reviewWhat you getAn answer made of paths you can open and check hop by hop.
Early access. Everything on this page is being rolled out gradually and may change before general availability. Features described on the other Atlas pages are available today.
Early access

Custom detection rules

Build your own detectors in a visual builder and check the match count before you save.

Early access

Approvals in Slack and Teams

Approve savings proposals and schedules from the message in the channel your team watches.

Early access

Auto-fix pull requests

Turn a finding into an infrastructure-as-code change and open it as a pull request.

Early access

Atlas Copilot

Ask the graph a question in plain English and get paths back as the answer.

Early access

Runtime and drift alerts

Hear about a new exposure minutes after the change that caused it.

Early access

Blast-radius simulator

Pick a key or role and see everything it could reach if it leaked.

Gaps we are closing with early users

Each row is an early-access feature: the gap it closes today, and what changes when it ships.

Detection

Your rules aren't in a default ruleset

What usually happens: The rule that no production database ships without a backup-owner tag lives on a wiki page nobody checks.

What Labs adds (early access): In early access, you build it as a detector and see how many resources match before it saves.

Resolved
Workflow

Approvals wait for a login

What usually happens: A savings proposal sits in Pending Approval all weekend because the approver only checked Slack.

What Labs adds (early access): In early access, approvers can approve or hold from the Slack or Teams message, with the same dry run.

Resolved
Response

Incident response starts with reach

What usually happens: When a key leaks, the first hour goes to reading IAM policies by hand to work out what it could touch.

What Labs adds (early access): In early access, the blast-radius simulator walks the graph from that key and lists what it could reach.

Resolved

How a pilot team used Labs

Marcus's team joined the early-access program. These are the Labs features they used in their first week.

MCMarcus ChenSecurity engineer, early-access pilot

Lumora Retail is a fictional company. The people, names and numbers are sample data.

    1
    Mon 09:00Early access

    Writes a custom rule

    RDS instance in prod-core without a backup-owner tag. The dry run matches 3 databases before he saves the rule.
    2
    Tue 14:00Early access

    Asks Copilot a question

    Which internet-facing workloads can reach PII? The answer comes back as paths, starting with checkout-api.
    3
    Wed 11:30Early access

    Simulates a leaked key

    He picks the ci-deployer access key. The simulator lists the buckets and roles it could reach and suggests the one policy change that contains most of it.
    4
    Thu 16:10Early access

    Gets a drift alert

    A bucket policy change makes a staging bucket public. The alert reaches the owner's channel a few minutes after the change.
    5
    Fri 10:00Early access

    Reviews an auto-fix pull request

    Atlas opened a Terraform pull request that removes the public grant, with the plan output attached for the reviewer.
Want to shape what ships next?

Join the Atlas Labs early-access program

Request early access

Six capabilities on the same graph

Custom detection rules Early access

Describe the risk that matters to your organization using resource type, tags and configuration, and Atlas turns it into a detector. A dry run shows how many resources would match before anything is saved.
  • Visual rule builder
  • Dry-run count before save
  • Runs alongside built-in detectors
What you're watching
  1. 1
    Describe the rule

    Match S3 buckets tagged env=production whose public access block is not fully enabled, and raise them as High.

  2. 2
    Run a dry run first

    Atlas evaluates 4 accounts and finds 14 matches, including customer-exports and clickstream-raw, with 0 duplicates of built-in findings.

  3. 3
    Save once the count looks right

    Save rule stays greyed out until the dry run finishes. The saved rule then runs on every scan next to the built-in detectors.

Who does thisSecurity engineering lead turning an internal standard into a checkWhat you getYour own standard running as a detector, with its match count known before it goes live.

Approvals in Slack and Microsoft Teams Early access

Today CloudLens posts recommendations and anomaly alerts to Slack and Teams, and approvals happen in the app. In early access, approvers can approve or hold savings proposals and schedules from the message itself, with the same dry run and guardrails.
  • Savings proposals
  • Schedules
  • Same guardrails as the app
What you're watching
  1. 1
    A proposal arrives in Slack

    Savings proposal PR-1042 posts to #cloud-cost-alerts: $3,542 a month across 5 resources, with dry run, rollback and stored specs checked.

  2. 2
    Approve from the message

    Priya approves in Slack. CloudLens reruns the dry run and schedules the change for the Saturday 02:00 window.

  3. 3
    The same flow in Teams

    A qa-databases night schedule, stopping at 22:00 and starting at 07:00 UTC, is approved in Cloud Ops. CloudLens confirms it is active.

Who does thisPlatform lead approving changes proposed by a FinOps analystWhat you getApprovals happen in the channel the approver already reads, behind the same guardrails as the app.

Auto-fix pull requests Early access

For resources managed as code, Atlas traces a finding back to the template that created it and proposes the change as a pull request. The plan output and a re-scan check are attached, so the reviewer can see that the change resolves the finding.
  • Terraform diff
  • Plan output in the checks
  • Linked to the finding
What you're watching
  1. 1
    Generate a fix from the finding

    The toxic combination on checkout-api traces back to infra/checkout/security.tf. Generate fix opens a change against that file.

  2. 2
    Review the Terraform diff

    SSH ingress narrows from 0.0.0.0/0 to the office VPN range. The admin policy is swapped for one built from 30 days of observed calls.

  3. 3
    Open the pull request

    The PR links to the finding and SEC-82. Checks show a terraform plan with 2 changes and an Atlas re-scan where the finding resolves.

Who does thisService engineer reviewing the change, with a security engineer as second approverWhat you getA fix that arrives as a reviewable pull request in the repository that owns the resource.

Atlas Copilot Early access

Ask which internet-facing workloads can reach PII and get back the paths, the hops and the severity. Follow-up questions narrow the answer, and you can open Jira issues for the results.
  • Plain-English questions
  • Answers drawn as paths
  • Follow-ups and Jira issues
What you're watching
  1. 1
    Send a plain-English question

    Which internet-facing workloads can reach PII? No query language and no saved filter are needed.

  2. 2
    Get paths back

    checkout-api, search-api and partner-webhook reach PII through checkout-task-role and search-role, ending at customer-exports and orders-db.

  3. 3
    Narrow it or act on it

    The table ranks each workload by severity. Follow-ups offer to limit to production, explain the checkout-api path or create Jira issues.

Who does thisSecurity engineer answering a question from a VP or an auditorWhat you getA reach question answered as three ranked paths, without reading IAM policies by hand.

Runtime and drift alerts Early access

A policy change that makes a sensitive bucket public shouldn't wait for the next scheduled scan. Atlas watches configuration changes, re-evaluates the affected resources and alerts the owner within minutes, then checks the fix when it lands.
  • Change to alert in minutes
  • Owner notified in chat
  • Fix checked on re-read
What you're watching
  1. 1
    A pipeline changes a bucket policy

    At 12:04 deploy-pipeline changes the policy on customer-exports. Two minutes later Atlas flags public read on a PII store, ranked Critical.

  2. 2
    The owner hears about it

    The alert goes to #security-alerts in Slack and Cloud Ops in Teams, with Data Platform as owner. SEC-81 opens at 12:09.

  3. 3
    The fix is verified on re-read

    The policy is reverted and Atlas re-reads the bucket at 12:21. It is still visible and now private, so the exposure resolves.

Who does thisSecurity engineer on call, with the Data Platform teamWhat you getA public PII bucket closed 17 minutes after the change, with a re-read showing it is private again.

Blast-radius simulator Early access

Pick a key, role or workload and simulate its compromise. Atlas walks the graph to show everything it could reach, highlights sensitive data, and suggests the smallest change that contains it.
  • What-if for any identity
  • Sensitive data highlighted
  • Containment staged as a proposal
What you're watching
  1. 1
    Simulate a leaked ci-deployer key

    Atlas walks the graph from the key. Within 2 hops it reaches 14 resources, including deploy-role and admin-role.

  2. 2
    Find the sensitive stores

    Three of them hold sensitive data: customer-exports and orders-db hold PII, and payments-archive holds PCI data.

  3. 3
    Stage the containment

    Rotate the key and scope it to build-runner and artifacts. Reach drops from 14 to 2, staged as a proposal to approve and dry run.

Who does thisIncident responder or security engineer, with the CI platform ownerWhat you getIn the first hour of a key leak, a list of what it could touch and the smallest change that contains it.

Want to try these first?

Tell us which capability you'd use most. Early-access customers help shape each feature before general availability.

Ready to see CloudLens in action?

Connect a read-only AWS role or Azure service principal. We'll walk you through your bill, your security graph and the first things worth fixing.