Scan every workload without an agent
CloudLens mounts a snapshot of each VM and container disk and reads it directly — vulnerabilities, CIS misconfigurations, malware and secrets — with nothing installed on the workload and no running process to slow it down.
- 1The real findings list
Every open finding in one list — severity, service, where it sits and SLA, ranked by what it actually reaches.
- 2Open it on the right
Click a finding and it opens in a side panel: what it means, and every data store it can reach.
- 3See why it's critical
The access path from the scan’s network graph shows how an attacker reaches the data — internet, workload, role, store.
- 4File it
One click raises a Jira issue with the evidence attached, mirrored to Slack and Teams so the owner is paged.
Agents are the thing that never gets deployed
The workloads you worry about most are the ones where nobody wants to install another process.
Agent-based tools miss what they are not on
What usually happens: An agent has to be installed on every host. The forgotten VM, the short-lived job and the locked-down box are exactly the ones left unscanned.
How CloudLens resolves it: A snapshot scan needs nothing on the workload, so coverage is every disk CloudLens can read, not every host someone remembered to instrument.
ResolvedNobody wants another process on production
What usually happens: A runtime agent consumes CPU and memory and becomes one more thing to patch and trust on the critical path.
How CloudLens resolves it: The scan runs on a copy of the disk, off to the side. The workload carries no extra process and no extra risk.
ResolvedA CVE list is not the whole story
What usually happens: Vulnerability-only tools miss the SSH config, the malware dropped in /tmp and the key sitting in a credentials file.
How CloudLens resolves it: One snapshot is checked for vulnerabilities, CIS misconfigurations, malware and secrets together, so the real risk on the box is visible at once.
ResolvedOne snapshot, four answers
Open a finding and you see it was read from the snapshot, with the package, the fix and the exposure.
- Hosts and images in one list
- Filter to what is on an internet path
- KEV and exploitability, not CVSS alone
Point CloudLens at an account and scan a workload read-only
How an exposed Log4Shell got caught on a box nobody had an agent on
A Wednesday at Lumora Retail: a snapshot scan of checkout-api surfaces a known-exploited CVE on an internet-exposed host.
Lumora Retail is a fictional company. The people, names and numbers are sample data.
A snapshot scan completes
Opens the Critical CVE
Confirms it was read from disk
Files and tracks the fix
Full coverage, nothing to install
Nothing on the workload
A read-only snapshot is scanned off to the side, so there is no agent to deploy, patch or trust on the box.
Vulns, config, malware, secrets
One disk answers four questions at once, enriched with CISA KEV and exposure so the ranking reflects real risk.
Secrets on disk, not just in code
A key sitting in a credentials file on the host is caught the same way a key in git history is — and routed to an owner.
Workload protection questions
No. CloudLens takes a read-only snapshot of the VM or container disk and scans a copy. There is no agent to deploy on the workload and no running process on the critical path.
Vulnerabilities from OS and package feeds, CIS misconfigurations, malware (via ClamAV) and secrets — all read from the same disk snapshot in one pass.
By exposure and known-exploited status. A CVE on an internet-exposed host flagged in the CISA KEV catalog ranks above the same CVE on an isolated workload.
Yes. The same disk-level scan applies to VM disks and container images, so you get one consistent view across both.
Ready to see CloudLens in action?
Connect a read-only AWS role or Azure service principal. We'll walk you through your bill, your security graph and the first things worth fixing.