Skip to main content

Cloud security automation

ARIA

Cloud control remediation and verificationARIA is the software engine behind Tricognita's Test → Fix → Verify → Keep secure. It evaluates your cloud security controls, applies bounded fixes your team approves, verifies every fix with the same check and keeps a signed record of each step, on AWS and Microsoft Azure, with Google Cloud launching.

Talk to us about ARIASee a sample closure record

ARIA is launching: capabilities show their current state on this page. Every change needs your authorization.

The problem

A findings list is not a fixed cloud.

Security teams do not lack findings. What they lack is a repeatable way to close them and prove they stay closed.

Findings accumulate

Each review adds to the list faster than engineers can close it.

A change is not proof

Someone applied a fix. Nobody re-ran the check that found the problem.

Controls regress

A new deployment or a quick console change quietly reopens what was closed.

Evidence is rebuilt by hand

Every customer review or audit means new screenshots and spreadsheets of the same controls.

No repeatable loop

Without the same check before and after every change, “fixed” is an opinion, not a result.

Who uses it

Built for the people who close findings

Engineering and security leads

See which controls fail, approve fixes, apply changes and confirm the result.

Auditors and reviewers

A read-only role to see results and records without being able to change anything.

Tricognita engineers

When you work with us, our engineers work from the same results and records.

What the platform does

Evaluate → Fix → Verify → Keep secure

The platform does more than report. For supported controls it makes the approved change itself, bounded to the one resource that failed, and only with your authorization.

  1. 01

    Evaluate

    • Checks each control on each resource from read-only access.
    • Identifies the controls that fail, and where.

  2. 02

    Fix

    • Applies bounded fixes for validated capabilities, once a named person in your team approves them.
    • Tracks the changes your own engineers apply.

  3. 03

    Verify

    • Re-runs the same check that found the problem.
    • Only a passing check marks the control remediated.

  4. 04

    Keep secure

    • Re-checks controls on a schedule.
    • Flags drift and keeps the evidence of every check.

Remediation

Bounded fixes, authorised by you

Automated fixes are off until your organisation enables them and grants a separate, narrow write permission. Checking never needs it.

Supported automated fixes are available by enablement for supported controls, subject to customer authorization.

  1. 01

    Request

    A fix is requested for one failing control on one resource.

  2. 02

    Named approval

    A named person in your organisation approves it. Your team always approves.

  3. 03

    Time-limited

    The approval is one-time and expires. The control is re-checked before the change runs.

  4. 04

    Bounded change

    A narrow, supported change is made to that one resource, and nothing else.

  5. 05

    Verification

    The same check runs again to confirm the result.

  6. 06

    Recorded result

    The request, approval, change and result are saved as signed records.

Current state

Customer-authorised fixes on Azure
Launching
Customer-authorised fixes on AWS
Launching
Tracking for fixes your team applies
Launching
Named, time-limited approvals
Launching

What stays with people

  • Not every control has an automated fix. Each supported action is validated individually.
  • Changes that are complex, span many resources or carry production risk stay human-led.
  • For those, the platform tracks the change your engineers make and verifies it the same way.

Verification

The same check that identified the issue verifies the result.

A fix is not finished when a change is made. It is finished when the check that found the problem passes on the same resource. Only a passing check marks a control remediated; a failed re-check keeps it open and says so.

Verification shows that a specific control passes after a specific change. It does not mean the whole environment is secure.

  1. 1. Control checkedFailing
  2. 2. Approved fix appliedchange recorded
  3. 3. Same check re-runPassing
  4. 4. Control marked remediatedFixed
  5. 5. Closure recordSee sample
  6. Sample sequence. If step 3 fails, the control stays open.
Same-check verification
Launching

You can also re-check a resource on demand, for example after your own engineers change it.

Drift

Know when a fixed control breaks again

Controls are re-checked on a schedule. A control that passed and now fails is flagged as drifted, with the record of when it last passed, so it can be fixed and verified again.

Scheduled re-checks and drift detection
Launching
Drift alerts
Launching
  1. Verified after fixPassing
  2. Scheduled re-checkDrifted
  3. Fixed again and verifiedPassing
  4. Sample sequence.

Evidence

A signed record of every check and change

Every check, approval, change and verification is saved as a signed record, linked to the record before it. Integrity is checked when records are viewed, so a broken link shows up rather than hiding.

Signed, linked evidence records
Launching
Verified closure record
Launching

The closure record brings it together: what failed, what changed, who approved it, whether the fix worked and whether it stayed fixed. It is a record of what happened, not an audit opinion.

Sample: checking a chain of linked records
unverified

Illustration of the integrity check, using sample records.

Controls

A defined catalogue of cloud security controls

Controls are grouped into seven areas. Each can carry references to frameworks such as CIS Benchmarks, SOC 2 and ISO 27001 to help your review. A reference is a label, not a compliance verdict.

  • Identity
  • Logging
  • Storage
  • Network
  • Encryption
  • Account configuration
  • Resilience

Clouds

AWS, Microsoft Azure and Google Cloud

One approval, verification and evidence model across three clouds. Google Cloud is in active development and is being expanded rapidly, starting with evaluation of the same controls.

  • AWS

    Evaluation
    Launching
    Bounded fixes
    Launching

    A read-only IAM role you create in your account and can remove at any time.

    AWS details

  • Microsoft Azure

    Evaluation
    Launching
    Bounded fixes
    Launching

    A service principal with the built-in Reader role.

    Automated fixes cover individually validated actions only.

    Microsoft Azure details

  • Google Cloud

    Evaluation
    Launching
    Bounded fixes
    After evaluation

    A least-privilege service account. In active development.

    Evaluation first, then the same approval, verification and evidence model.

    Register interest

Capabilities

What ARIA includes

Available
Delivering now
Launching
Being prepared for launch — register interest
Planned
On the roadmap

  • Control evaluation on AWS

    Checks your cloud security controls resource by resource, from read-only access.

    AWSRegister interest

    Launching

  • Control evaluation on Microsoft Azure

    The same controls, checked the right way on Azure, from Reader access.

    AzureRegister interest

    Launching

  • Control evaluation on Google Cloud

    Google Cloud support is in active development and is being expanded rapidly.

    Google CloudRegister interest

    Launching

  • Read-only onboarding

    Connect with an IAM role on AWS or a Reader service principal on Azure. Checking never needs write access.

    AWS · AzureRegister interest

    Launching

  • Named, time-limited approvals

    Every change needs a one-time, time-limited approval from a named person in your organisation, and the control is re-checked before the change runs.

    Register interest

    Launching

  • Customer-authorised fixes on Azure

    A bounded change to the one resource that failed, for individually validated Azure actions, applied only after a named approval.

    Supported automated fixes are available by enablement for supported controls, subject to customer authorization.

    AzureRegister interest

    Launching

  • Customer-authorised fixes on AWS

    The same bounded, approved fix model on AWS, for a narrow set of supported actions.

    Supported automated fixes are available by enablement for supported controls, subject to customer authorization.

    AWSRegister interest

    Launching

  • Tracking for fixes your team applies

    Record the proposal, the approval and the change your engineers made, then verify it.

    Register interest

    Launching

  • Same-check verification

    The check that found the problem confirms the fix. Only a passing check counts as fixed.

    Register interest

    Launching

  • Scheduled re-checks and drift detection

    Controls are re-checked on a schedule, and a control that passed and now fails is flagged.

    Register interest

    Launching

  • Drift alerts

    Notice of a drifted control sent to the people and tools your team chooses.

    Register interest

    Launching

  • Signed, linked evidence records

    Every check is saved as a signed record linked to the one before, with integrity checked when viewed.

    Register interest

    Launching

  • Verified closure record

    What failed, what changed, who approved it, whether the fix worked and whether it stayed fixed.

    Register interest

    Launching

  • Client access

    Your team and your auditor see results and records directly, with role-based access.

    Register interest

    Launching

  • Findings, drift history and reports

    Views and reports built on the same records.

    Planned

  • Assisted fix proposals

    Draft fixes prepared for your engineers, always approved by you before anything changes.

    Planned

What remains human

The platform does not replace security engineers

It removes repeated checking and record-keeping. The decisions stay with people: yours, and ours when you work with us.

  • Security judgement: what a finding means for your business.
  • Prioritisation: what to fix first, and what can wait.
  • Planning complex remediation that touches many resources or teams.
  • Sensitive production changes that need a person at the keyboard.
  • Penetration testing and retesting.
  • Communication with your customers, auditors and leadership.
  • Approval. Every change is approved by a named person in your organisation.

Services + Product

Use the platform on its own, or with our engineers

Services

Testing, security judgement, complex remediation, certification readiness and secure cloud engineering, delivered by Tricognita.

Product

Repeatable evaluation, approved bounded remediation, verification, drift detection and evidence.

Services → Product

Engagements can use the platform to verify fixes and produce the closure record. Retainers include platform access as it launches.

Product → Services

When a finding needs a penetration test, a complex fix or readiness work, our engineers can help. You do not need services to use the platform.

Explore our services

Pricing

How platform access is priced

With the Security Retainer

Platform access is included with the Security Retainer as its capabilities launch.

Standalone access

Launching

Talk to us. Talk to us about ARIA

Availability

What is available today

Platform capabilities move to Available only after production-readiness validation. Our services are available now, and are listed separately.

Available

No platform capability yet.

Launching

Planned

Sample

A sample closure record

Sample data for illustration. This is not a customer record.

Sample closure recordSample data
Control
Storage accounts block public access
Resource
sample-storage-01 (sample)
Found
Failing on first check
Change
Public access disabled on this one resource
Approved by
Named approver in the customer organisation (sample)
Verification
Same check re-run: passing
Later re-checks
Passing
Records
Each step signed and linked to the one before
FailingFixedPassing

A record of what happened, not an audit opinion.

See the full synthetic sample report

Talk to us about ARIA

Tell us about your cloud and the controls you need to close. We will show you the platform on sample data and where each capability stands. Teams in India and the United Arab Emirates are welcome.

Talk to us about ARIASee a sample closure record

Need testing, complex remediation or readiness support? Book a scoping call or see our services.