Free assessment

Find out what's really running in your cloud.

We scan your AWS, Azure and GCP accounts read-only. In about two days you get a findings report covering what's outside IaC, what has drifted, what fails policy, and what you're paying for without using.

  • Read-only. We can't change anything, and you can revoke access at any time.
  • No card and no obligation. The report is yours to keep.
  • About 15 minutes of setup on your side.
  • An optional 30-minute walkthrough with an engineer.
See what the report looks like →

Request your assessment

Add your name.

Enter a valid work email.

Add your company.

Pick your role.

We use these details only to run your assessment. See privacy.

Request received.

Within one business day we'll send a short setup guide for the read-only role. Your report follows about two days after you connect.

What happens next

From request to report in about two days.

Setup guide

Within one business day, we send step-by-step instructions for each cloud you picked.

You connect, read-only

Create the role. It takes about 15 minutes, using the permissions listed below.

We scan and review

Tessera runs the scan, and an engineer checks the findings before you see them.

You get the report

Findings ranked by severity, with fixes. Walk through it with us, or just keep it.

Exactly what we access

The permissions, published.

The assessment uses each provider's standard read-only roles. They let us read configuration, but not the contents of your buckets or databases. TODO: engineering to confirm exact roles

AWS

# cross-account IAM role trust tessera account + external ID policies arn:aws:iam::aws:policy/SecurityAudit arn:aws:iam::aws:policy/job-function/ViewOnlyAccess write none

Azure

# app registration, per subscription roles Reader Security Reader scope subscriptions you choose write none

Google Cloud

# service account, per project roles roles/viewer roles/iam.securityReviewer scope projects you choose write none

Want to remove access after the report? Delete the role. That's all it takes. More detail is on the security page.

Forward this to your CTO

Free, read-only, and over in two days.

If the scan finds real waste and risk, the subscription pays for itself. If it doesn't, you've spent 15 minutes and lost nothing.

Request the assessment → See a sample report