The graph model
Resources, identities, network paths, and findings are rows in Postgres with explicit relationships. The seed estate models five providers so every query has realistic structure to chew on.
A CNAPP's architecture,
running for real.
CloudLoom implements the decision-making heart of a cloud security platform — the graph, the controls, the attack-path logic — against a simulated multi-cloud estate. The integration layer comes next.
Four working parts.
Controls → issues
A control pairs a graph-shaped rule with a severity. When its conditions match modeled resources, an issue is raised and triaged through OPEN, IN_PROGRESS, RESOLVED, or REJECTED — persisted for real.
Attack-path reasoning
Entry exposure plus an exploitable finding plus an identity hop plus sensitive data: when the hops line up they surface as one prioritized toxic combination instead of three disconnected alerts.
Honest reporting surfaces
Inventory, CVE knowledge-base views, and compliance posture dashboards compute from the same tables you can open and inspect. No magic numbers, no black boxes.
Designed, not yet built.
These exist as schema headroom and roadmap order — not features. We say so because trust beats marketing.
See what IS built →- →
Live connectors
Read-only ingestion across AWS, Azure, GCP, OCI & Kubernetes via the Go agent
- →
Real telemetry
Network, identity, and runtime edges feeding live attack graphs
- →
Runtime sensor
Optional eBPF signals for detection and blocking
- →
Agentic layer
Red (attack simulation) · Blue (investigation) · Green (remediation PRs)
How the pieces fit.
One diagram, honestly labeled — solid lines run today, dashed lines are the roadmap.
Next.js 14 / TypeScript strict / Prisma v5 / Postgres / Tailwind / Go agent
Inspect the schema ↗