Alye / Cloud & code security

Fix the few problems that open a path to your data.

Scanners hand you hundreds of findings and no order. I map your cloud the way an attacker would, follow every route from the internet to your sensitive data, and give you the short list of fixes that close those routes, filled in for your resources.

Book a demo See how it works

Read-only accessNo stored keysAWS and Google CloudFirst results in about 15 minutes

Attack paths · acme-prodscanned 4 min ago

3 open paths to sensitive dataweakest link: web-server

// From noise to a plan

337 findings. 3 attack paths. 6 fixes that close them.

Numbers from a scan of our own test AWS account. Most findings are hygiene; a handful decide whether someone can reach your customers' data.

337findings from configuration checks

3routes from the internet to sensitive data

6fixes that close all three

~15 minfrom connecting to the first ranked list

"Everything is critical."

Severity alone ranks a public test bucket next to an exposed production database.

With Alye: ranked by reach, environment and the data at the end of the path.

"We fixed it. Did it work?"

Fixes get applied and tickets get closed, but nobody checks the risk actually went away.

With Alye: the daily scan verifies each fix and closes the Issue itself.

"What do I tell the board?"

A list of 337 findings isn't a status. Leadership wants exposure, trend and deadlines.

With Alye: reports with open paths, deadlines and progress over time.

// Who it's for

One risk picture for the whole team.

Security leads and CISOs

Know your real exposure.

Every attack path to sensitive data, with its weakest link
Issues ranked by reach, with deadlines
Reports for leadership and audits
Production and staging kept apart

Platform and DevOps

Fix what matters, in your own tools.

A fix plan in CLI, Terraform, CloudFormation and console steps
Filled in with your resource names and IDs
Links to your cloud provider's own documentation
Discover with Alye in Cursor, Claude, Copilot or Codex

CTOs and founders

Pass the security review.

A clear answer to "can someone reach our data?"
Progress you can show customers and investors
Read-only, no agents to install
Live in an afternoon, not a quarter

// What you get

From "how exposed are we?" to a closed Issue.

01 · Prioritization

Issues ranked by what an attacker could reach.

Every Issue is scored by reach first: is it internet-facing, is it on a path to sensitive data, is it in production. Severity comes second.

Weakest link on every attack path
Deadlines by risk, so the urgent work is obvious
Fixed problems close themselves on the next scan

Issues · ranked by Alye8 critical of 336 open

Issue	Reach	Env	Due
IMDSv1 allowed · web-server	2 paths	production	2 days
Bucket public · invoices	1 path	production	2 days
s3:* on ssm-role	narrows 1	production	7 days
Versioning off · logs	hygiene	staging	30 days

02 · Fix plan

The fix, written for your resource.

Path-breaking fixes come first. Each one is filled in with your resource names and IDs, in the tool your team uses.

AWS CLI, Terraform, CloudFormation and console steps
References to your cloud provider's own documentation
Rules to accept or ignore findings that don't apply

breaks 2 paths

# Require IMDSv2 on web-server
aws ec2 modify-instance-metadata-options \
  --instance-id i-0a7f3c9e21 \
  --http-tokens required

resource "aws_instance" "web_server" {
  metadata_options {
    http_tokens = "required"
  }
}

WebServer:
  Type: AWS::EC2::Instance
  Properties:
    MetadataOptions:
      HttpTokens: required

Reference: Amazon EC2 User Guide · Configure the instance metadata options

03 · Inventory

Every resource, what it exposes and what it can read.

A live map of your cloud: what faces the internet, which role each workload runs as, and which data that role can reach.

Compute, storage, databases, functions and roles
Internet exposure and sensitive data in one view
Environments labelled, so production comes first

Inventory · acme-prod48 resources · 5 internet-facing

Resource	Exposure	Runs as	Can read
web-server · EC2	internet :443	web-role	customer-data
public-lb · ELB	internet :443	—	—
batch-job · ECS	private	batch-role	logs
customer-data · S3	PII	—	—

04 · Reports

A status you can take to leadership.

Open paths, critical Issues, fixes verified and anything overdue, by week and by environment.

Trends over time, not just today's count
CSV export of Issues
The same numbers your engineers work from

Weekly security report · acmeOct 27 – Nov 2

Open paths3▼ 2

Critical8▼ 3

Fixed11verified

Overdue0on track

CSV exportby environment

05 · Code to cloud

Code findings ranked by where they run.

I scan repositories and images and follow each finding to the resource it runs on, then open the fix as a pull request you review.

Dependencies, container images, secrets and Terraform
A CVE on an internet-facing server comes first
Fix pull requests opened by Alye, merged by you

Code to cloud · acme/webCVE-2020-8203

lodash 4.17.15 → web-serverFix first

internet-facingon 2 pathsproduction

lodash 4.17.15 → batch-jobLater

private subnetno path

PR #128 · Bump lodash to 4.17.21

tests passimage rebuiltre-scan clean

Opened by Alye · the merge is yours

06 · Discover with Alye

Your cloud, answered inside your editor.

My MCP server works with Claude, Cursor, GitHub Copilot and Codex. I answer from your live data and can write the change for you to review.

"What's my riskiest attack path?"
"Write the Terraform for Issue 412."
"What changed since yesterday's scan?"

Discover with Alye · Cursor

What's my riskiest attack path?

alye · get_attack_paths

Internet → web-server → web-role → customer-data (PII). The weak link is web-server allowing IMDSv1.Requiring IMDSv2 closes this path and one other. Shall I write the Terraform change?

// How it works

Six steps. I do five of them.

The one that changes your cloud stays yours.

01 · You

Connect

Launch one CloudFormation stack on AWS, or set up workload identity federation on Google Cloud. Read-only, with an external ID.

02 · Alye

Scan

Hundreds of configuration checks, plus a map of who and what can reach each resource. About fifteen minutes the first time, then daily.

03 · Alye

Prioritize

I follow every route from the internet to sensitive data and find each route's weakest link.

04 · Alye

Explain

Why each Issue matters in your account, in plain words, and what could break if you change it.

05 · Alye + you

Fix

The fix is filled in for your resource. You apply it, in your own pipeline.

06 · Alye

Verify

The next daily scan checks the change and closes the Issue by itself.

// Built for your security review

Alye can look. She can't touch.

What your security team will want to know, in one place.

Read-onlylist, describe and get. No create, change or delete.

0 keysroles with an external ID on AWS, federation on Google Cloud

1 hourthe longest any credential I use lives

1 clickdelete the stack and my access ends

What I can read

Resource configuration, network rules, roles and policies, and the names and tags of your data stores.

What I don't read

The contents of your buckets, databases or secrets. I see that a bucket holds PII from its tags, not its files.

Every call is logged

Everything I do shows up in your own CloudTrail or Cloud Audit Logs, under my role.

Your data, kept apart

Findings live in your organization only. Each environment and cloud account is labelled and filterable.

// Questions

What security teams ask first.

Something else? Write to sales@alye.ai.

What access does Alye need?

Alye

A read-only role. On AWS you launch one CloudFormation stack that creates it with AWS's SecurityAudit and ViewOnlyAccess policies and an external ID. On Google Cloud you set up workload identity federation for a service account with the Viewer and Security Reviewer roles.

Can Alye change anything in my cloud?

Alye

No. The role can't create, modify or delete resources. Every fix is applied by you, in your own tools and pipeline.

Which clouds are supported?

Alye

AWS and Google Cloud, across all your accounts and projects. Label each one as production, staging or anything else you use.

How is this different from a scanner?

Alye

A scanner lists findings by severity. I map who and what can reach each resource, find the routes from the internet to your sensitive data, and rank the fixes that close them first.

How long does setup take?

Alye

Connecting takes a few minutes. The first scan takes about fifteen, then I rescan every day on my own.

Can we export findings?

Alye

Yes. Issues export to CSV, and reports summarise open paths, critical Issues and fixes verified over time.

Fix the few problems that open a path to your data.

337 findings. 3 attack paths. 6 fixes that close them.

One risk picture for the whole team.

Know your real exposure.

Fix what matters, in your own tools.

Pass the security review.

From "how exposed are we?" to a closed Issue.

Issues ranked by what an attacker could reach.

The fix, written for your resource.

Every resource, what it exposes and what it can read.

A status you can take to leadership.

Code findings ranked by where they run.

Your cloud, answered inside your editor.

Six steps. I do five of them.

Connect

Scan

Prioritize

Explain

Fix

Verify

Alye can look. She can't touch.

What I can read

What I don't read

Every call is logged

Your data, kept apart

What security teams ask first.

Ready to put Alye on duty?