AWS security Win the security review before it starts.
Sherpa is an AI platform for AWS. It measures your security posture and compliance readiness against CIS and SOC 2 controls, finds what's open to the internet and which identities hold more access than they use, and gives your engineers the remediation for each gap. It is built for companies without a dedicated security team.
What's open to the internet, and what's sitting idle?
3 security groups open to the internet. $1,240 a month idle.
Open to the internet
| Security group rule | Count | Next step |
|---|---|---|
| SSH (port 22) from anywhere | 2 | open the fix in Automate |
| RDP (port 3389) from anywhere | 1 | open the fix in Automate |
Idle
| What | Count | Monthly cost |
|---|---|---|
| Unattached storage volumes | 14 | $736 |
| Idle load balancers | 1 | $412 |
| Idle servers | 1 | $92 |
How ready are we for SOC 2?
78% of SOC 2 checks pass. 14 to fix.
| SOC 2 checks | Count | Next step |
|---|---|---|
| Passing | 50 | keep |
| Failing | 14 | open the fix in Automate |
Who has admin access they don't use?
9 identities, unused in 90 days.
| Type | Count | Next step |
|---|---|---|
| Admin identities unused in 90 days | 9 | review access |
How has our SOC 2 readiness changed since last week?
Up from 71% to 78%. 14 checks still failing.
| Scan | Readiness | Failing checks |
|---|---|---|
| Last week | 71% | 19 |
| This week | 78% | 14 |
Why do AWS security gaps happen?
-
99%
of cloud security failures come from the customer's own settings, not the provider.
-
200+
AWS services, each with its own settings to get right.
Sources: Gartner; AWS.
Enterprise buyers ask about these same settings in their security questionnaires and vendor reviews.
What's costing you money, and what's left open?
-
Idle
load balancer
prod-web-alb· $412 a month · 0 requests in 30 daysFix in Automate →
-
Open
security group
sg-0a1b2c3d· SSH from anywhereFix in Automate →
Security tools don't show what resources cost, and cost tools don't show what's exposed. Ask Sherpa one question and get both answers side by side, each with its own remediation.
What will our buyers ask about?
-
Open to the internet.
Resources anyone on the internet can reach, including open SSH and RDP ports and publicly accessible storage.
-
Who can do what.
Identities holding more access than they use, dormant administrators, routes from low access to admin, and the outside accounts your environment trusts.
-
The basics.
Encryption, logging and the AWS security services that should be enabled in every account and every region you use.
-
Readiness.
CIS 3.0 and SOC 2 readiness with a 30-day trend, plus a comparison of any two scans showing which controls your team fixed and which got worse.
Sherpa measures readiness against SOC 2 and CIS controls; it is not an audit, and it does not certify compliance.
What does a fix look like?
Security group sg-0a1b2c3d allows SSH (port 22) from anywhere.
aws ec2 revoke-security-group-ingress --group-id sg-0a1b2c3d --protocol tcp --port 22 --cidr 0.0.0.0/0Sherpa never applies a fix; your team does. Each remediation comes as steps, AWS CLI commands, and CloudFormation or Terraform where they apply.
Find your gaps this week.
Sign up
Connect your AWS organization in about ten minutes and see findings across every account.
Sign up
AWS security questions we get asked.
What does a CIS check cover on AWS?
The CIS AWS Foundations Benchmark is a published set of recommended security configurations covering identity, logging, monitoring, networking and storage. Sherpa checks your accounts against CIS 3.0 and lists each gap with its remediation.
Does Sherpa make us SOC 2 compliant?
No. Sherpa shows how ready your AWS accounts are against SOC 2 controls and how to close each gap. Only an independent auditor can attest to SOC 2 compliance.
Does Sherpa change our security settings?
No. Sherpa writes the remediation, and your team reviews it, decides and applies it. Sherpa never applies a fix; your team does.
Do we need a security team to use Sherpa?
No. Sherpa is an AI platform for AWS built for teams without one: it ranks the gaps by priority and gives your engineers the remediation for each.
Does it cover every account and region?
Yes. Sherpa covers every account in your AWS organization and every region you use, and you can filter by account and region.
How do we connect Sherpa?
Your team deploys one CloudFormation template in the AWS management account. It creates one role, which Sherpa uses to set up the data connections it needs in your accounts.