Joins what you already run
Trivy, Semgrep, Cloud Custodian and Falco findings, plus your AWS and Kubernetes state, in one graph of the environment as it really is. Cloud accounts are read, never written to.
Your scanners find issues. This finds the way in.
PerspectiveGraph joins what you already run into one graph of your real environment and asks a single question of it - can someone get from the internet, through privilege that is too broad, to something worth stealing? Then it stops the pull request that opens that route.
What it does
Section titled “What it does”Finds the way in
Every route from an internet entry point, through too much privilege, to a sensitive asset - ranked by what to fix first, each with how far its number can be trusted.
Stops it in the pull request
The check goes red only when this change opens a route, names it, and the fix comes back as its own pull request to review and merge.
Says how far to trust it
It grades its own scores against real test outcomes, and says “not enough data yet” rather than make a verdict up.
The dashboard on sample scanner output, with synthetic test outcomes recorded so that every panel has something to show - not a real environment. The live demo runs the same sample data with no outcomes at all.
Where to start
Section titled “Where to start”See it without installing anythingThe same dashboard, published read-only on sample data.
Check your own AWS accountOne read-only command, no deployment.
Put it on your pull requestsThe merge gate: a GitHub Action, a CLI and a Trivy plugin.
Evaluate it on your own estateIn stages that each end in an answer.
Understand the numbersWhat a score is the probability of, and what it is not.
Run it for realThe Helm chart, single sign-on, hardening, backup.
What it does not claim
Section titled “What it does not claim”A score is what the model concludes from the evidence it was given, not a measured frequency. Nothing has been calibrated against field data yet, and the engine says so itself - positioning states what is claimed, what is not, and how to check.
Open source under Apache 2.0. It runs on your infrastructure and collects no telemetry. Tried it? Tell us what worked and what didn’t. Contributions, questions and a line in the adopters list are all welcome.