The problem
The exposure that accumulates between audits
None of it is exotic. It builds up quietly, change by change, from engineers, from teams outside engineering, and now from AI agents with API keys. An attacker needs only one.
Network exposure
Databases, admin interfaces and internal services reachable from the internet, opened for a test and never closed.
db-prod 5432/tcp0.0.0.0/0
Data exposure
Public storage buckets, and disk or database snapshots shared with anyone who asks.
exports-2026public
Identity sprawl
Standing admin access, keys nobody has used in months, and AI agents holding credentials of their own.
svc-legacy keyunused 147d
Unrestricted egress
Workloads that hold credentials and can send data anywhere. One compromised dependency there is a breach.
app-tier egress all0.0.0.0/0
How it works
From a change to the fix that closes it
Heawood keeps a live model of how your cloud connects, and reads every change against it. You see what a change opened, not just what it changed.
- 1
Connect
One read-only role per account, deployed in minutes. No agents, no write access, nothing in your data path.
- 2
Map
Heawood builds a graph of the account: what the internet can reach, which identities can act on what, and the data they lead to.
- 3
Follow every change
Each change in the audit trail updates the graph, attributed to the person, pipeline or AI agent that made it.
- 4
Find what it opened
Only what the change touched is re-checked, across 76 controls, and traced for new paths to admin access or data. A reachable, privileged weakness outranks a thousand that aren't.
- 5
Close it
The finding names who made the change and the exact fix, as console steps, CLI or Terraform. When the fix lands, the finding closes.
Free guide
The AWS settings that leak data: 12 checks you can run in 10 minutes
For each one, the command to find it in your account and the command to fix it. No sign-up needed.
Read the checklistPilot program
Pilot Heawood on your cloud accounts
From January we're onboarding a small number of teams as pilot customers. Pilots run Heawood on their own accounts, with direct support from the founder.
Live on AWS today. Azure and Google Cloud next.