Every path to your data, under your control.
Ctadel connects the configuration, identities, data, Kubernetes, code and vulnerabilities of your clouds in one graph, and shows you the attack paths to fix first.
- No agent, up and running in hours
- Six clouds, including Scaleway, OVHcloud and OUTSCALE
- Attack paths to fix, not a pile of alerts
Internet-exposed web server, vulnerable to Log4Shell, reaches the customer database prod-orders
prod-web-1
Attack path visualization
Why teams choose Ctadel
Fewer alerts, more fixes.
What matters first
Attack paths link the weaknesses that, combined, expose your data. One correction closes the whole path, instead of hundreds of isolated alerts.
Your clouds in one graph
Scaleway, OVHcloud, OUTSCALE, AWS, Azure and Google Cloud, with the same scanners and the same rules. Identities present on several clouds are matched.
Nothing to install
Connect an account, the inventory starts. No agent on your machines, no sensor in your clusters.
Audit-ready
Every rule cites ISO 27001, SOC 2, PCI DSS, NIST, GDPR or SecNumCloud. The questionnaire answers are in the trust centre.
3,600+
active detection rules
6
clouds covered at the same level
No agent to install
10
scanners feeding one graph
One graph for ten modules
Every resource, permission, piece of data, vulnerability and the Terraform line that declares them enters the same graph. Attack paths walk it; you can explore it yourself, relationship by relationship.
- Six clouds in one model
- Effective permissions computed
- Link to the Terraform line
- Ready-made queries
Ten scanners, one graph
Each scanner reads one facet of your clouds and feeds the same graph and the same findings. Pick one to see what it finds.
Toxic combinations
The sequences of findings that, together, open an access.
- What is read
- Exposures, permissions, sensitive data and vulnerabilities linked in the graph.
- How
- Hand-written chains and computed paths over the graph; every link is a real resource.
From detection to fix
What your team does in Ctadel, in order.
- 96Web server vulnerable to Log4Shell reaches the customer database
prod-web-1 → prod-ordersCritical - 81Valid access key in a public bucket
scw://bucket/prod-data-euHigh - 64Kubernetes service account that reads every secret
prod-mks / defaultMedium
Three AI agents that investigate, and let you decide
They work on your own data, with language models hosted in Europe, and change nothing without your approval.
- Answers
Warden
A conversation panel on every page. It answers only from Ctadel data, cites what it relies on, and says what it does not measure.
- Prepares the fix
Mason
From a finding, it reads the resource, what depends on it and where it is declared in the code, then proposes the fix in the right channel: Terraform, commands or a ticket.
- Searches for paths
Sapper
It walks the graph looking for attack paths no rule describes and files proposals, verified path and evidence included. You accept or reject.
A fourth one, the Constable, investigates audit-log detection incidents; it is under internal validation. Each AI agent’s scope is enforced server-side, its tools are read-only, and text addressed to it inside the data read is removed and reported. What the AI agents do
Connected to your tools
Alerts arrive where your team works, tickets go to your tool, code is analysed on every pull request.
- Notifications
Slack
Microsoft Teams
Google Chat
Mattermost
Matrix, Tchap
Discord
PagerDuty- Webhook
- Tickets
Jira
GitHub
GitLab
Linear
ServiceNow
YouTrack
- Code
- GitHub
- GitLab
Terraform
Kubernetes
Docker
- Authentication
- SAML
- OIDC
Getting started
Later runs are scheduled automatically. Closed findings are kept for ninety days by default, adjustable between seven days and ten years.
- 1
You write to us
We create your stack on its subdomain and your first administrator account. Signing in takes a password, then a code received by email.
- 2
You connect your clouds
From the settings, you add a cloud account: a CloudFormation template for AWS, a service principal for Azure, a service account for Google Cloud, an API key for Scaleway, a consumer key for OVHcloud, an EIM user for OUTSCALE.
- 3
The inventory starts
The first run begins as soon as the account is saved. Its duration depends on the number of resources; you follow its progress in the application and can receive an email when it ends.
Built for the people accountable for cloud security
Three readers, three uses, one instance.
CISOs and security leadership
A consolidated view of the six clouds, a score with its history, and findings you can defend in a committee.
- Prioritised attack paths rather than thousands of alerts
- ISO 27001, SOC 2, PCI DSS, NIST, GDPR and SecNumCloud references on every rule
- Hosted in France, data never leaves the European Union
Architects and cloud teams
The resource graph as it is, with effective permissions, exposures and the link to the Terraform code.
- Graph explorer and query templates
- Drift between code and what is deployed
- Fix proposed by the AI agent, reviewed by you
Compliance and procurement
Precise answers to questionnaires: where the data is, who accesses it, which permissions are requested, which limits apply.
- Documentation that also says what each scanner cannot see
- A single technical subprocessor, Scaleway
- No certification claimed that does not exist
And as a bonus, hosted in Europe
Ctadel is operated from France and hosted at Scaleway. Your data does not leave the European Union, and your security questionnaires find their answers in the trust centre.
- Hosted in France, a single European subprocessor
- Cloud credentials encrypted, never included in backups
- Questionnaire answers ready in the trust centre
The questions we are asked
Short answers; the details are in the documentation.
Do I need to install an agent?
No. Ctadel reads your accounts through their APIs. To analyse disks and databases, a temporary copy is created inside your account, read, then destroyed; those permissions are separate and you choose whether to grant them.
Where is my data?
On your dedicated instance, a Scaleway server in Paris, and in its backup space, also in Paris. Nothing is shared with another customer and nothing leaves the European Union.
How long to get started?
Creating the instance takes a few hours. The first inventory starts as soon as a cloud account is saved; its duration depends on the number of resources.
Which permissions exactly?
Read permissions for inventory and configuration, plus disk and database copy permissions if you enable host and data analysis. They are published cloud by cloud in the documentation: CloudFormation role for AWS, service principal for Azure, service account for Google Cloud, API key for Scaleway, consumer key for OVHcloud, EIM user for OUTSCALE.
What about false positives?
A rule whose data is not collected, or whose signal has never been observed, is disabled and stays visible with its reason. We prefer one rule fewer to one false alert.
Can we try it first?
The public demonstration runs on fictitious data. For an instance on your own accounts, write to us: we create it and you keep control of every access.
See Ctadel on your own accounts
The public demonstration runs on fictitious data. A dedicated instance is created within hours; you keep control of every access.
Documentation
Everything the product does, and does not do, in French and in English.