One platform. Three parts. An analyst on all of it.
NxSCORE takes every cloud finding all the way: found, fixed by your team, then ruled out by your cloud’s own guardrails, with the evidence kept along the way.
Operations: we run the programme with you, and get more from your CNAPP.
An NxSCORE analyst takes ownership of the day-to-day work: what is open, what matters, and what your engineers should run next. Your CNAPP keeps finding; NxSCORE makes sure the findings go somewhere.
See: everything your CNAPP sees, and what it misses.
NxSCORE syncs the findings from your CNAPP and matches every account in your organisation against what the CNAPP actually monitors. Where a policy is switched off or never raises an alert, you are told by name.
- Findings from your CNAPP and the NxSCORE scanner, one entry per resource
- Duplicates from two sources merged into one finding
- An account NxSCORE could not reach reads Not scanned, never Pass
prod-paymentsMonitored by your CNAPP
core-bankingMonitored, 3 policies switched off- sandbox-17Not in your CNAPP, scanned by NxSCORE
data-lakeMonitored, 2 policies never raise an alert- dr-siteNot scanned: read-only role missing
Fix: a verdict before anyone touches it.
Every finding gets a verdict first, with the reason in plain words. Then your analyst writes the fix kit: what is wrong, why it matters, and the change that fixes it, in the form your team works in.
- Fix kits in CLI, script, cloud policy or Terraform, explained line by line
- Run by your engineers, in your change window, with your own tools
- Closed only when the next assessment agrees, not when someone says it is done
- Safe to fixS3 bucket readable by anyone, prod-paymentsNo public reads in 30 days. Blocking public access breaks nothing.
- Needs reviewSecurity group open on 443, core-bankingIt sits behind the load balancer that serves customers. Your team decides the change.
- Waiting for dataKey Vault purge protection off, treasuryThe owner is not confirmed yet. NxSCORE asks, and holds the verdict until they answer.
Enforcement: fix it once. Then rule it out.
A fix closes one finding. A guardrail closes the door it came through. NxSCORE finds what keeps coming back, traces the cause, and turns your intent into rules your cloud enforces itself.
Prevent: the cause, not just the finding.
When a finding returns, NxSCORE marks it as a recurring issue and traces where it comes from: a template, a pipeline, a manual change, or access that was never taken back. Then it writes the prevention plan.
- Recurring issues found across every account, with their cause
- Access unused for months found and removed, tested against real activity first
- Every prevention plan comes with its test and its rollback
Enforce: the cloud itself refuses the mistake.
Cloud security intent enforcement is a new category of cloud security. Instead of finding a mistake after it happens, the cloud refuses it. NxSCORE takes each intent through five stages.
- 1UnderstandResources, identities, permissions and existing findings, across every account.
- 2TranslateOne sentence of intent becomes each cloud’s own controls.
- 3PredictTested against your recent activity: what it would block, and what it would break.
- 4Enforce safelyAlert-only first, then switched on in stages, with a rollback ready.
- 5GovernExceptions with an owner and an expiry, drift caught, checked daily that it holds.
AWSOrganisation policy, prod OUAzureAzure Policy, prod management groupGoogle CloudPublic access prevention, prod folder# AWS organisation policy, prod OU: nobody turns public access back on
{
"Effect": "Deny",
"Action": "s3:PutBucketPublicAccessBlock",
"Resource": "*",
"Condition": {
"StringNotLike": { "aws:PrincipalArn": "arn:aws:iam::*:role/platform-admin" }
}
}Enforced in the cloud, so nothing goes around it.
A check in one pipeline only covers that pipeline. A guardrail in the cloud covers every way a change can arrive. NxSCORE writes it; your team applies it through your own pipeline, and NxSCORE stays read-only.
- Console
- CLI
- API
- Terraform
- Scripts
- AI agents
Fixed, and ruled out. Now, proved.
Assurance: evidence kept as the work happens, and someone watching.
Every control is checked by the route that can actually answer it, mapped to the frameworks you answer to, and kept current. An analyst watches what repeats, and every decision has two keys.
Prove: every control, by the route that can answer it.
A framework lists controls; a CNAPP lists policies. NxSCORE decides for each control how it is checked, collects the evidence, and tracks each finding against the deadline your regulator sets.
- Mapped to ISO 27001, SOC 2, PCI DSS, NIST, DORA, RBI and more
- Manual controls collected by your analyst, never left out
- Evidence carries who did what, and when
- CNAPPA CNAPP policy covers it, is switched on and raises an alert.
- CNAPP + NxSCOREThe CNAPP covers part; the NxSCORE scanner checks the rest.
- NxSCORENo CNAPP policy covers it, so the NxSCORE scanner does.
- ManualNo scanner can see it. Your analyst collects and keeps the evidence.
| IRDAI | High-risk VAPT gaps | Closed within 30 days, then re-validated |
|---|---|---|
| SEBI CSCRF | VAPT and audit findings | Closed within 3 months |
| RBI | Vulnerabilities | Fixed in a time-bound manner, set by your policy |
| Your policy | Anything else | Set by severity, per framework |
Watch: an analyst on what keeps repeating.
The platform looks across all your accounts for patterns: which mistakes repeat, where, and what brings them back. Your analyst turns that into the next guardrail, and talks to your team in plain language.
- Repeats by account, by team and by the release path that brought them back
- Risk acceptances with an owner, an expiry and a quarterly re-review
- Maker-checker on every verdict; only your security team accepts a risk
- release-template v4 re-applies an old bucket policyprod-payments, 4 reopenings
- Manual console change outside the change windowcore-banking, 2 reopenings
- Service keys created by data-pipeline, never removeddata-lake, 3 new keys
Works with what you already have.
NxSCORE reads your clouds through a read-only role and syncs the CNAPP you already run. Nothing is replaced, and nothing in your cloud is changed by NxSCORE.
- AWS
- Azure
- Google Cloud
Cloud
Prisma Cloud
Cortex Cloud- Wiz
Orca Security
Tenable Cloud Security
See it on one of your accounts.
Connect one account with a read-only role. Your NxSCORE analyst shows you what is open, what keeps coming back, what your CNAPP is not checking, and the guardrail that would stop it.