Fix cloud findings with PRs your team will actually merge.
PosturaNet learns what really uses each resource from your flow logs and CloudTrail, then opens the smallest Terraform fix that keeps all of it working. Read-only, in your CI, with your own LLM.
$ pip install posturanetSecurity groups should not allow unrestricted access to ports with high risk
Read as data: instructions inside finding text are ignored and logged.
Example data. Click a step, or use the arrow keys. Hover to pause.
Finding issues is solved. Fixing them safely isn't.
A scanner says 0.0.0.0/0 is too open, and it's right. But the CI runners, the VPN and the office still SSH in. PosturaNet reads who actually connected, and writes exactly that.
Exactly the sources that connected in 90 days. Nothing else.
Five checks stand between a finding and your main branch.
Any one of them failing stops the run. You get a reason, not a PR.
A read-only role
A published IAM allowlist with no write actions. A test fails the build if any mutating call appears.
Real-traffic evidence
90 days of VPC flow logs and CloudTrail show who actually connects, so the fix keeps them working.
A solver, not a guess
Z3 computes the smallest rule set that keeps every must_allow. The LLM only writes the explanation.
Plan-scope check
terraform plan must touch only the flagged resource, updated in place. Anything wider stops the run.
A human merges
PosturaNet opens a PR for the code owner. It never applies, never pushes to main, never changes live resources.
Keep the traffic that's real. Close everything else.
PosturaNet watches who actually connects, writes it down as a contract your team approves, and computes the fix that keeps exactly that. The contract stays in your repo and checks every future Terraform PR.
ingress tcp/22 from 3 CIDRs · contract: 3 kept, 1 denied
View the contract file
# posturanet/contracts/sg-bastion.yml
resource: module.bastion.aws_security_group.this
evidence: { source: vpc_flow_logs, window: 90d }
must_allow:
- { proto: tcp, port: 22, from: 10.0.4.0/24 }
- { proto: tcp, port: 22, from: 10.0.9.12/32 }
- { proto: tcp, port: 22, from: 192.0.2.10/32 }
must_deny:
- { proto: tcp, port: 22, from: 0.0.0.0/0 }
approved_by: "@acme/platform-network"When AI writes your Terraform, PosturaNet checks it first.
Claude Code, Cursor and other agents call PosturaNet through MCP before touching security groups. A change that breaks a contract is blocked, with the reason, before it ever reaches review. IAM and S3 checks come next.
Findings in. Pull requests out.
- AWS Security Hub
- Terraform
- GitHub
- AWS
- Claude + MCP
Prowler, AWS ASR and CNAPP exports are planned. Marks are generic symbols, not vendor logos.
Read the security model →Source available. Read every line before it reads your account.
The agent, the IAM policy and the safety checks are all in one public repository. Run it free with no account and no key. Each release becomes Apache 2.0 two years after it ships.
Free to run. Founding seats for teams that want more, sooner.
10 seats. Every Team feature as it ships, and a say in the roadmap.
Claim a seatYour next finding could be a reviewed PR.
Install it, point it at one finding, read the dry run. Nothing is written until you say so.
$ pip install posturanet