Skip to content
Start free

Find risky cloud settings, and see what changed

Tracix runs Prowler's read-only checks against your AWS accounts, Azure subscriptions, Google Cloud projects and Kubernetes clusters on a schedule. Each account gets a score, its failing checks with remediation, what changed since the last scan, and exceptions with an owner.

Start freeBook a demoRead the security docs
  • AWS · Azure · Google Cloud · Kubernetes
  • Read-only Prowler checks
  • Daily scans by default

Posture checks run Prowler, licensed under the Apache License 2.0.

How it works

From a read-only role to a tracked score

Every number comes from each account's latest successful scan, and the view says when that scan ran.

  1. 01ConnectAdd a posture card for an AWS account, Azure subscription or Google Cloud project, with a read-only role you control.
  2. 02ScanYour workspace's own scanner runs Prowler every 6 hours, 12 hours, day or week. Clusters scan themselves.
  3. 03ScoreEach account's score is its passing results over passing and failing ones, from the latest successful scan.
  4. 04CompareEvery scan is compared with the one before, so new failures and fixes stand out.
  5. 05Fix or acceptFollow the remediation, or accept a failure as an exception with an owner, a reason and an end date.
  6. 06TrackFollow each account's score over 90 days, and the frameworks Prowler maps each check to.

Findings

Every failing check, with the fix and its history

Filter results by cloud, account, severity, framework, service, region or check, and group them the way you work. Each finding carries the remediation and how it changed across scans.

  • Failures that are new since the last scan, and the ones fixed, are marked on every result
  • Group by check, resource, account or service to find the change that clears the most
  • The 5,000 most severe results load first, and the view says when there were more

Read only

Scans that can read, and nothing else

Scans run in your workspace's own scanner with credentials you grant, never Tracix's own identity. They read configuration and keep only the results.

  • Read-only roles

    SecurityAudit and ViewOnlyAccess on AWS, Reader and Security Reader on Azure, Viewer and Security Reviewer on Google Cloud.

  • No fixer, no exports

    Prowler's fixer and its Security Hub and bucket outputs cannot be turned on.

  • Short-lived credentials

    Credential files exist only while a scan runs, then they are removed.

  • No raw resource data

    Results keep the check outcome, not settings such as function environment variables.

Exceptions

Accept a risk on purpose, with a name on it

Some failures are deliberate. Record them as exceptions with an owner and a reason, so the score reflects the risks nobody has decided on yet.

  • Scope an exception to one resource, one account or everywhere
  • Every exception needs an owner and a reason, and can lapse on a date you set
  • Exceptions apply when the view is read, so scores change without a rescan

Better together

Posture next to the resources it describes

Failing checks sit beside the same cloud inventory, clusters and security graph your other teams use, so a finding leads straight to the resource behind it.

Supported clouds

What each cloud needs, stated plainly

Each card uses your own credentials with read-only access. Scans run every 6 hours, 12 hours, day or week, daily by default.

PlatformConnect withRead-only accessScope
AWSCross-account IAM role with an external ID, or a static access keySecurityAudit and ViewOnlyAccessEvery enabled region, or the regions you choose
AzureService principalReader and Security ReaderListed subscriptions, or every one it can read
Google CloudService account keyViewer and Security ReviewerListed projects, or every one it can read
KubernetesThe collector's Helm chart, with posture turned onA read-only service account that never reads SecretsThe whole cluster; pod checks can be limited to namespaces

Control-plane checks need a self-managed control plane: on EKS, GKE and AKS they report nothing, while workload, RBAC and node checks still run. Checks run Prowler, licensed under the Apache License 2.0.

FAQ

Questions cloud and security teams ask first

Talk to a security engineer
Can Tracix fix a failing check for me?
No. Scans only read configuration, and Prowler's fixer cannot be turned on. Each failing check carries remediation steps for you to apply, and the next scan shows it as fixed.
Are results mapped to CIS Benchmarks?
No. CIS Benchmark content needs a CIS SecureSuite membership, so Tracix drops those mappings. Results keep the requirement ids of the other frameworks Prowler maps to, such as NIST SP 800-53, PCI DSS 4.0 and ISO/IEC 27001:2022.
How current are the numbers?
Posture is current state, not a time window. Every number comes from each account's latest successful scan, and scans run as often as every 6 hours. A failed scan is listed with its reason and retried an hour later.
Does it work on managed Kubernetes?
Yes, with one limit. Workload, RBAC and node checks run on any cluster. Control-plane checks read the API server, scheduler and etcd settings from static pods, which EKS, GKE and AKS do not expose, so those checks report nothing there.

Scan your first cloud account

Add a posture card with a read-only role, and see the account's score and failing checks after the first scan.

Start freeRead the security docs