Assets and attack paths
Every sync does more than collect findings. It builds a deduplicated inventory of what actually exists in your cloud, reconciles it into one canonical asset registry, draws living topology diagrams, computes attack and privilege paths, and reports what changed since last time. This page covers that whole surface and the two promotions at the end of it: into continuity planning and into the risk register.
Discovered assets
The Discovered assets card on the Posture page lists every resource your scanners observed, deduplicated into a living inventory. Group by service, account, region, type, or link status; search and filter server-side, so the view scales past what a browser could hold. Each asset shows its findings, when it was last seen (with a stale flag when the most recent sync did not refresh it), and the business service it belongs to.
Linking assets to business services is the step worth doing early: a linked asset inherits business criticality and becomes visible to DR scoping. Suggest links produces AI proposals — each with its reasoning — that you confirm or dismiss per asset.
One canonical registry
Discovered cloud assets land in the Asset Registry alongside assets from the BCP register, approved network diagrams, and BIA services — one canonical identity per real-world asset, however many sources observed it. The registry shows per-source reconciliation coverage, an unreconciled queue you can work down, and a Unified Dependencies view where edges from every source are resolved to the same identities, so a dependency recorded in continuity planning and one observed in the cloud finally join up. A 6-hour sweep keeps identities and edges reconciled; a Reconcile button re-runs the pass on demand.
Topology diagrams, drawn from the sync
In Network Diagrams, the Generate from Cloud action builds living infrastructure maps directly from a connected cloud account — one diagram per VPC — instead of asking anyone to draw them. Cloud-generated diagrams carry a CLOUD SYNC badge, regenerate on every sync, and show drift when the topology changed since the last pass. They sit next to your uploaded diagrams and go through the same review flow.
Attack and privilege paths
From the same topology, SolveGRC computes attack paths and privilege-escalation paths: routes from an entry point to a target asset, ranked by risk. The Attack Paths view in the Network Evidence Dashboard lets you explore each path and open it highlighted on its diagram. Paths recompute as topology changes — a path is a statement about your cloud as it is now, not as it was when someone last drew a diagram.
The change feed
The Changes tab answers the question a point-in-time list cannot: what changed in my attack surface between syncs? New paths appear with their risk level; remediated paths appear as resolved — the closest thing posture has to a win column. An opt-in toggle, Email new high-risk paths, sends the team an email alert when a new high-risk path shows up, so the feed does not depend on someone remembering to look.
Promote: into continuity, into the register
Two promotions turn observation into managed exposure:
- To BIA. Every asset row has a → BIA action, groups can be promoted together, and Promote all to BIA covers the estate — creating BIA assets and, for service-linked assets, the service-to-asset dependency edge. Once promoted, the Posture page's DR scope and Continuity posture cards show which recoverable services are missing a DR plan, RTO/RPO, or backups, and where live configuration contradicts a continuity requirement.
- To the risk register. The Top risks panel ranks assets by the compound of attack-path exposure, findings, business criticality, and framework mapping — with expected annual loss in dollars where a business service is linked. Send to risk register creates or refreshes risk-register entries for the quantified cloud risks, so cloud exposure is managed alongside every other risk. See Promote from signals for what happens on the register side.
Everything on this page flows one way: the cloud is observed, never modified. Promotions copy what posture knows into BIA and the risk register; nothing writes back to your cloud account.
That closes the loop this guide opened with: one read-only connection in — findings, frameworks, assets, attack paths, and quantified risk out, refreshed every 6 hours.