Most teams know what is exposed in their cloud, but struggle to answer a simple question: where are our workloads actually connecting out to?
CloudFence gives you visibility and control over workload communications without agents, firewall VMs or forcing traffic through an inspection point.
.svg)
Step #1
CloudFence connects to your existing cloud network, DNS and identity logs through a read-only access - without changing how your traffic flows.
Step #2
CloudFence turns the raw logs into a behavioral footprint for each workload: who it communicates with, where it connects, the path it takes, and what its identity normally does.
Step #3
New destination. New communication path. New IAM action. CloudFence detects each change against what's normal for that workload in your environment.
CloudFence evaluates changes against the context around them: the destination's reputation and category, whether it appears across other workloads, the workload's history, and related network and identity activity, to surface only the changes that deserve attention.
.png)
Real findings from real cloud environments
A large healthcare company with a significant cloud footprint across AWS and GCP wanted to understand where its cloud-deployed LLM workloads were communicating. CloudFence surfaced outbound destinations the security team wasn't expecting and aware of.
While baselining workload communications for an insurance company with ~800 workloads on AWS, CloudFence detected staging workloads unexpectedly communicating with production.
At a customer running on AWS, workloads normally reached S3 through VPC endpoints. CloudFence detected when some started going through a NAT Gateway instead, the destination hadn’t changed, but the path had.
A large technology company needed to understand actual usage across more than 8,000 Security Group rules in AWS and remove unused access. CloudFence maps observed communications against the rules allowing them, and gave the DevSecops team the evidence and the confidence to remove unused rules without causing a single production outage.
A cybersecurity company running on Azure expected workload traffic to pass through its centralized inspection hub.CloudFence detected a workload connecting directly instead, revealing a communication path the security team wasn’t expecting.
CSPM and CNAPP focus on misconfigurations and posture especially Ingress. CloudFence focuses on behavioral detection — it learns normal patterns for every workload by looking at network and identity logs, builds baselines, and flags suspicious deviations in real time, especially in outbound traffic. It complements posture tools by catching what static config oriented checks miss.
SIEMs collect and store logs but rely on manual rules and tuning to find threats. CloudFence automatically analyzes network and identity behavior, builds per-workload baselines, and detects unusual activity without rule engineering — delivering fast, focused, actionable detections purpose-built for the cloud.
CloudFence itself focuses on detection and visibility, not inline blocking. However, it can integrate with your cloud controls (like security groups, firewalls ) to automate response actions or trigger blocking through your existing infrastructure.
CloudFence charges a flat yearly fee, based on the number of workloads with active interfaces generating traffic. This model provides cost predictability, eliminates surprises, and scales with your actual environment. Integration and hosting are fully managed, and we offer unlimited seats for your security and operations teams.
CloudFence starts analyzing communications and activities as soon as logs are connected, and deviations are detected in real time once baselines are established.In most environments, building a baseline takes from hours to a few days, depending on traffic volume and workload behavior.
In parallel, CloudFence’s built-in rule engine can detect known malicious activity immediately, using IP/DNS reputation feeds or custom Guardrails — predefined rules set by the customer to enforce their own security policies (e.g., blocking traffic to specific regions, blocking communication on unapproved ports or to unapproved geographies , or flagging sensitive services).
Move beyond static rules and legacy network appliances in the cloud. Visualize workload communications, control egress traffic, detect behavioral deviations, and remove unused access - all natively from your cloud logs
