Why we built NxSCORE.
Years of running cloud security for customers taught us that finding more was never the problem. The problem was that nothing stayed fixed.
- 2019eSec Forte starts its cloud security work
- 2021Managed cloud security, run for customers
- TodayNxSCORE: what those years taught us, built as a platform
Where we started.
eSec Forte began working on cloud security in 2019. Two years later we were running it for customers as a managed service: watching their accounts, working through their findings and preparing them for their audits, every day.
Almost every customer had bought a CNAPP. The tools were good at finding things. What they could not do was carry the work: deciding which findings mattered, getting the fix through change control, proving it to an auditor, and making sure the same problem did not come back next month.
That work fell to people, and it fell to them again and again. NxSCORE is what we built so that it would not.
What we kept seeing.
Customers did not lack tools. Most had a CNAPP, and many had more than one. Four problems came back in nearly every account we ran.
- 01
Changing your CNAPP means starting again.
Teams buy a CNAPP, then find it does not fit their environment. Moving to another one moves the alerts, not the work. Every verdict, exception, approval and decision stays behind.
In practice- Every finding is judged again, as if it were new
- Risk acceptances are argued and approved a second time
- Evidence for the next audit is collected from the start
- 02
Sometimes the CNAPP changes under you.
Products are renamed, merged and acquired. Prisma Cloud is moving to Cortex Cloud, and every change like it brings the same reset, through no decision of yours.
In practice- Policies are renamed and remapped to frameworks again
- Alert rules and integrations are rebuilt
- The history of what was decided, and why, is hard to carry across
- 03
Compliance a scanner cannot see.
CNAPPs map findings to frameworks, but not every control can be scanned. Many teams do not know they should be collecting evidence for the rest until an audit asks.
In practice- Access reviews and their sign-off
- Approved exceptions, with an owner and an expiry
- Vendor reports and the checks made on them
- 04
The same mistakes, again and again.
Customers came to us with millions of alerts open and no way through them, because the same misconfigurations returned with every release.
In practice- Release templates re-applying an old configuration
- Access granted for a project and never taken back
- Alert queues that grow faster than anyone can close them
| What your team built up | Your CNAPP alone | With NxSCORE |
|---|---|---|
| Verdicts and owners on every finding | Done again by hand | Carried over |
| Risk acceptances, with their expiry | Done again by hand | Carried over |
| Maker-checker approvals and the audit trail | Done again by hand | Carried over |
| Evidence, including manual controls | Done again by hand | Carried over |
| The history of every recurring issue | Done again by hand | Carried over |
Even when the CNAPP stays, it misses things.
A framework lists controls. A CNAPP lists policies. The two rarely match one for one, and some policies are switched off or never raise an alert. NxSCORE checks every control by the route that can actually answer it.
- CNAPP
Checked by your CNAPP
A policy exists, is switched on and raises an alert.
- CNAPP + NxSCORE
Checked by your CNAPP, confirmed by NxSCORE
The CNAPP covers part of the control; the NxSCORE scanner checks the rest.
- NxSCORE
Checked by NxSCORE only
No CNAPP policy covers it, so the NxSCORE scanner does, through the read-only role.
- Manual
Evidence collected by people
No scanner can see it. Your analyst asks for the evidence, records it and keeps it current.
And when an account cannot be reached, NxSCORE says Not scanned, never Pass.
So we set out to remove the causes.
What we built instead.
A platform that reduces the issues in your cloud, instead of another scanner that finds more of them. It works in three parts, with an analyst across all of them.
Operations: we run the programme with you, and get more from your CNAPP.
An NxSCORE analyst runs your cloud security programme with you, day to day. The aim is simple: get the best out of the CNAPP you already pay for, and close what it leaves open. Your engineers still make every change.
- A better CNAPP workflowWe find the policies that are switched off, the alerts that never fire and the accounts your CNAPP does not monitor, and add the policies and data it is missing.
- A verdict before a fixEvery finding is judged first: safe to fix, needs review or waiting for data. Then a fix kit your engineers can run in their change window.
- From fixes to guardrailsWe find what should become a guardrail: the mistakes that keep returning, and the controls your organisation will not compromise on.
Enforcement: fix it once. Then rule it out.
Cloud security intent enforcement is a new category of cloud security. Instead of finding a mistake after it happens, the cloud itself refuses it. NxSCORE takes your intent there in five stages: understand, translate, predict, enforce safely and govern.
- Understand, then translateNxSCORE reads your resources, identities and existing findings, then turns one sentence of intent into each cloud’s own controls.
- Predict, then enforce safelyEach guardrail is tested against your recent activity first, rolled out in alert-only mode, and switched on with a rollback ready.
- GovernExceptions have an owner and an expiry, drift is caught, and NxSCORE checks every day that each guardrail is still in force.
Assurance: evidence kept as the work happens, and someone watching.
Every control is checked by the route that can answer it, and its evidence is kept as the work happens. An analyst watches across all your accounts for what repeats, which is how the next guardrail goes where it matters.
- Evidence for every controlScanned controls carry their evidence automatically; manual controls are collected by your analyst, so nothing is missing at audit time.
- An analyst on what repeatsRepeated mistakes and repeated violations, by account, by team and by the release path that brought them back.
- Maker-checker, alwaysEvery change to a verdict is prepared by one person and approved by another. Only your security team can accept a risk.
What we believe.
Fewer issues, not more alerts.
A programme is measured by how many issues are left in your cloud, not by how many a scanner can find.
Read-only, always.
NxSCORE writes every fix and guardrail. Your engineers run them, through your own pipeline.
People decide.
Software finds and drafts. An analyst prepares, your team approves, and every decision is kept.
Your decisions outlive your tools.
Verdicts, exceptions and evidence stay with you, whichever CNAPP you run next.
Fewer issues. Not more alerts.
Start with one account. Your NxSCORE analyst shows you what is open, what keeps coming back, what your CNAPP is not checking, and the guardrail that would stop it.