What Secorvia does, one capability at a time

Read-only connection

You connect an account with credentials that can look but not change. For AWS that is an assumed IAM role, which is the recommended route, or an IAM access key. Azure uses a service principal, Google Cloud a service account key, and DigitalOcean an API token. Secrets are encrypted before they are stored, and the form never shows them again after you save.

Connecting an account starts its first scan. Cloud posture scanning needs no agent. Oracle Cloud and Alibaba Cloud accounts cannot be connected. DigitalOcean can, and it has its own page because most security platforms skip it. The security page covers what the connection can and cannot see, and the connection guide lists the fields for each provider.

Security graph

Every resource, identity and relationship the scan collects becomes a node or an edge in one graph. You can search it by name or external ID, filter by provider or node type, and open any node to see its tags, properties and connections. The graph is a snapshot: a scan and a graph build are separate steps, so the page shows when it was last built.

The graph and attack paths start on the Starter plan. The graph guide walks through the explorer.

Reachability ranking

A severity score says how bad a flaw is. It does not say whether anyone can get to it. Secorvia models routes from an exposed resource, through identity and network relationships, to a valuable target, and lists them as ranked attack paths. Each path shows its severity, score, target, stage, number of steps and a breakpoint where one is known.

A path describes what is possible. It is not a record that an attack happened. Where they exist, CVSS, EPSS and CISA KEV signals sit next to the graph context, and a blast radius analysis from any node shows what else falls if that one resource is taken. See investigating an attack path and blast radius.

IAM analysis

Entitlement analysis (CIEM) runs against one account at a time and reports how many identities it found, how many are administrative, how many external trust relationships exist and how many critical or high findings come with them. Open an identity to read its attached policies, the actions being watched and its trust relationships.

When a policy cannot be resolved, the page says so and treats that as a gap in the data, not as proof that no permission exists. CIEM is part of the Growth plan. The CIEM guide has the full flow.

Container image scanning

Give Secorvia an image reference from a connected cloud account and it pulls the image, lists the packages inside and matches them to known vulnerabilities. For each package you see the installed version, the version that fixes it when one is published, and the CVSS, EPSS and KEV signals.

Images on a self-managed Linux host are scanned on the host by the agent, using Trivy. The agent uploads the package list and the image itself stays where it is. How many images you can scan depends on the plan, and the pricing page has the numbers. Details are in the container security guide.

Infrastructure as code scanning

An IaC project maps to a repository, service or environment your team owns. Inside it you add sources and revisions, and Secorvia parses the resources and reports findings against a specific revision. That keeps a problem in a Terraform file separate from the state of something already running. The formats listed in the product today are Terraform, CloudFormation, ARM, Bicep, Helm and Kustomize. IaC scanning is included on every plan, including Free. The IaC guide shows the setup.

Scheduled scans

A schedule runs scans for one cloud account on a cadence you choose: hourly, daily, weekly or monthly. You set the time and the timezone yourself, and the schedule shows its next run and last run. A monthly schedule set for a day the month does not have runs on the last day of that month. A schedule existing does not mean its last scan worked, so Scan History is where you confirm that. See scheduled scans.

Webhooks and notifications

Notifications go to email, Slack, Microsoft Teams or Discord. You pick the events that matter: a scan starting, finishing or failing, a new critical or high finding, a compliance report being generated, a failed account connection or a failed scheduled scan. Every delivery is logged, with its provider, event, status and any error.

Webhooks send selected events to an HTTPS endpoint you run. Each one has a signing secret that is shown once, a test button and a delivery list. Guides: notifications and webhooks.

Reports

You can generate executive, compliance or findings reports, choose the format and set a reporting period. Generation runs in the background and the list shows each job as pending, generating, completed or failed. A scheduled report repeats that daily, weekly or monthly. Compliance views map findings to SOC 2, ISO 27001, CIS and NIST CSF. Report generation starts on the Starter plan. See reports and scheduled reports.

API access

Organization API keys are made for one integration each, so a single key can be revoked without touching the rest. A key acts as a service identity, and changes and comments it makes are attributed to that identity. Scopes cover findings, inventory, cloud accounts, scans, vulnerabilities, compliance and the security graph, and read and write are granted separately. The secret is shown once, keys can carry an expiry, and rotation means creating the new key before revoking the old one. Full API access is part of the Growth plan. See API keys.

Roles

An organization is its own boundary, and members join it by invitation. They get a link to set their own password, so no password is ever sent. The roles are Owner, Admin, Analyst and Read-Only. The member list shows each person's role and invitation status, and what a person can see follows from that role and from what the organization's plan includes. The activity timeline on a finding records who changed what, and the audit log keeps history for 30 days on Free, 90 days on Starter and a year on Growth. See inviting and managing members.