Win the security review before it starts.
Sherpa checks your connected AWS accounts against CIS and SOC 2 controls, shows what's open to the internet and who holds access they don't use, and gives your team each fix.
After you sign up, a member of the Sherpa team contacts you within one business day to discuss your AWS environment and the right way to start.
How ready are we for SOC 2?
78% of SOC 2 checks pass. 14 to fix.
| SOC 2 checks | Count | Next step |
|---|---|---|
| Passing | 50 | keep |
| Failing | 14 | open the fix in Automate |
Who has admin access they don't use?
9 identities, unused in 90 days.
| Type | Count | Next step |
|---|---|---|
| Admin identities unused in 90 days | 9 | review access |
What's open to the internet, and what's sitting idle?
3 security groups open to the internet. $1,240 a month idle.
Open to the internet
| Security group rule | Count | Next step |
|---|---|---|
| SSH (port 22) from anywhere | 2 | open the fix in Automate |
| RDP (port 3389) from anywhere | 1 | open the fix in Automate |
Idle
| What | Count | Monthly cost |
|---|---|---|
| Unattached storage volumes | 14 | $736 |
| Idle load balancers | 1 | $412 |
| Idle servers | 1 | $92 |
Every connected account checked, every gap with a fix plan.
Checks run on the 1st and 14th of each month.
What will our buyers ask about?
-
Open to the internet
What anyone on the internet can reach.
- Open SSH and RDP ports.
- Publicly accessible storage.
-
Who can do what
Identities with more access than they use.
- Dormant admins and unused permissions.
- Routes from low access to admin, and outside accounts you trust.
-
The basics
The settings every account should have.
- Encryption and logging.
- AWS security services turned on in each account and the regions you use.
-
Readiness
Where you stand against CIS 3.0 and SOC 2.
- A 30-day trend.
- Compare two scans: what got fixed, what got worse.
Sherpa measures readiness against SOC 2 and CIS controls. It is not an audit and does not certify compliance.
What's costing you money, and what's left open?
Security tools don't show cost. Cost tools don't show exposure. Sherpa answers both in one chat.
What does a fix look like?
sg-0a1b2c3d allows SSH (port 22) from anywhere.
aws ec2 revoke-security-group-ingress --group-id sg-0a1b2c3d --protocol tcp --port 22 --cidr 0.0.0.0/0
Sherpa never applies a fix; your team does.
Why do AWS security gaps happen?
99%
of cloud security failures come from the customer's own settings.
Source: Gartner
200+
AWS services, each with its own settings.
Source: AWS
Enterprise buyers ask about these same settings in their security reviews.
Find your gaps this week.
After you sign up, a member of the Sherpa team contacts you within one business day to discuss your AWS environment and the right way to start.
AWS security questions we get asked.
What does a CIS check cover on AWS?
The CIS AWS Foundations Benchmark is a published set of security settings for identity, logging, monitoring, networking and storage. Sherpa checks your accounts against CIS 3.0 and lists each gap with its fix.
Does Sherpa make us SOC 2 compliant?
No. Sherpa shows how ready your AWS accounts are against SOC 2 controls and how to close each gap. Only an independent auditor can attest to SOC 2.
Does Sherpa change our security settings?
Sherpa never applies a fix; your team does. Connecting your AWS accounts, once and with our team, gives Sherpa what it needs to read your data. Every security change after that is your team's decision.
Do we need a security team to use Sherpa?
No. Sherpa ranks the gaps and gives your engineers a fix plan for each.
Does it cover every account and region?
It covers every AWS account you connect, in the regions you use.
Still have a question?
Contact us