Assets and attack paths
Every sync does more than collect findings. It builds a deduplicated inventory of what actually exists in your cloud, reconciles it into one record per real asset, draws living topology diagrams, and computes attack and privilege paths. This page covers that surface, the promotion into continuity planning, and how cloud failures reach the risk register as signals.
Discovered assets
On the Posture page, open Assets & dependencies and find Cloud discovery and service assignments. It lists every resource your scanners observed, deduplicated into a living inventory. Group by service, account, region, type, or link status; search and filter server-side, so the view scales past what a browser could hold. Each asset shows its findings, when it was last seen (with a stale flag when the most recent sync did not refresh it), and the business service it belongs to.
Linking assets to business services is the step worth doing early: a linked asset inherits business criticality and becomes visible to DR scoping. Suggest links produces AI proposals — each with its reasoning — that you confirm or dismiss per asset.
One canonical registry
Discovered cloud assets appear in Assets & dependencies as one record per real asset, however many sources observed it. Open an asset to see its source records and its incoming and outgoing relationships. Reconciliation runs every 6 hours. Editors can also click Reconcile sources to run it on demand.
Topology diagrams, drawn from the sync
In Network Diagrams, the Generate from Cloud action builds living infrastructure maps directly from a connected cloud account — one diagram per VPC — instead of asking anyone to draw them. Cloud-generated diagrams carry a CLOUD SYNC badge, regenerate on every sync, and show drift when the topology changed since the last pass. They sit next to your uploaded diagrams and go through the same review flow.
Attack and privilege paths
From the same topology, SolveGRC computes attack paths and privilege-escalation paths: routes from an entry point to a target asset, ranked by risk. To see them, open the cloud-generated diagram in Network Diagrams and use its Topology view. Paths recompute as topology changes — a path is a statement about your cloud as it is now, not as it was when someone last drew a diagram.
Promote: into continuity, into the register
Two promotions turn observation into managed exposure:
- To BIA. Every asset row has a → BIA action, groups can be promoted together, and Promote all to BIA covers the estate — creating BIA assets and, for service-linked assets, the service-to-asset dependency edge. Once promoted, the DR scope and Continuity posture cards in the Posture page's Resilience view show which recoverable services are missing a DR plan, RTO/RPO, or backups, and where live configuration contradicts a continuity requirement.
- To the risk register. A failing finding on a mapped control sends a Control Failure signal to the Risks Signals tab when it is critical or high severity, the control is linked to a policy, or the asset's business service is critical or high. Signal titles start with "Security posture gap:", "Compliance posture gap:", or "Policy vs configuration gap:". A person then links the signal to a risk or creates one. Fixing the finding does not update or close the signal or the risk. See Promote from signals for what happens on the register side.
Everything on this page flows one way: the cloud is observed, never modified. Promotions copy what posture knows into BIA, and signals carry failures into Risks. Nothing writes back to your cloud account.
That closes the loop this guide opened with: one read-only connection in; findings, frameworks, assets, and attack paths out, refreshed every 6 hours.