Platform
A single, cloud-native platform for workload compliance and security across the entire infrastructure stack, throughout the application lifecycle.
Cloud Posture Management
Identification of changes made to cloud configuration through service provider APIs, including host instances, security groups, IAM policy, and access keys.
Application Security
Build-time and runtime application security, including developer feedback and live attack detection and blocking.
Host Security
Real-time, continuous monitoring and protection for Linux and Windows virtual machine workloads.
Workflow Integrations
RESTful APIs and built-in integrations that leverage existing incident response, investigation, and analytics tools.
Container & Kubernetes Security
Detection of risky behaviors, active threats, and configuration issues for containers, container orchestration, and managed container services.
Program Overview
Extend your team’s security expertise and resources with the Threat Stack Cloud SecOps Program℠.
Threat Stack Oversight℠
Reduce mean-time-to-respond with 24/7 monitoring and alert escalation from the Threat Stack Security Operations Center.
Threat Stack Insight℠
Improve your cloud security posture with deep security analytics and a dedicated team of Threat Stack experts who will help you set and achieve your security goals.
Cloud Attack
Follow along as the Threat Stack Security Team shows how a malicious actor leverages the unique characteristics of the public cloud to launch their attack.
Shellbot
See inside an active cryptomining malware campaign as Threat Stack’s Security Operations Center (SOC) details a recently discovered variant of the Shellbot malware.
Plans Overview
Threat Stack offers unique solution packages to meet your cloud security goals.
Trade Up Program
Trade in any competitive solution and receive an invoice credit for current contract towards a Threat Stack plan, a dedicated on-boarding team, and customer service manager.
Compliance for Cloud Workloads
Demonstrate continuous monitoring to auditors with pre-built rulesets and compliance reports that map to major regulatory compliance requirements like PCI-DSS, HIPAA, and SOC 2.
Security for AWS
Integrate Threat Stack with AWS to monitor changes and misconfigurations across multiple accounts and services.
Intrusion Detection
Monitor for anomalous or risky behaviors across host, container, and container orchestration to alert you to signs of compromise.
Vulnerability Assessment
Detect and remediate vulnerabilities across your infrastructure.
File Integrity Monitoring
Monitor for creates, deletes, opens, and edits to secret files to identify nefarious activity and satisfy compliance requirements.
SIEM
Correlate security signals across your entire infrastructure stack with flexible built-in integrations, APIs, and data lake integration for SIEM.
DevSecOps
Bring Security and DevOps teams together: Deploy in minutes and auto-scale with configuration management tools and Kubernetes to monitor cloud-native resources throughout the build pipeline.
Secure Microservices
Monitor all of your de-coupled, stateless, polyglot services in a single solution, even when they’re built and deployed in separate pipelines by different teams.
Fargate Security Monitoring
Threat Stack fills the visibility gap for managed container services like AWS Fargate, with process tracking and detailed netflow metadata.
View Resource Center
Blog
Cloud security tips, insights, and ideas.
Newsroom
Stay up to date with the latest press releases, news, and events from Threat Stack.
Press Kit
Watch a sophisticated cloud attack and learn the necessary steps to prepare yourself.
Company
Meet the Threat Stack leadership team.
Careers
Building a great company starts with building a great team.
Contact
55 Summer Street Boston, MA 02110
Customers
Hear what our customers explain how Threat Stack has made them more successful and secure.
Partnerships
Become a Threat Stack Partner.
FAQ's
How can we help you?
Please enable JavaScript in your browser for better use of the website, some features like forms and videos use Javascript in order to display the elements.
Whether you need to monitor CloudTrail events, EC2, EKS, and Fargate, or scan the configuration of security groups, IAM, RDS and S3, Threat Stack is the perfect complement to integrating with and securing your AWS environment.
Threat Stack helps you pull important security information from your AWS services and accounts into a central location, allowing you to quickly understand your attack surface and manage risk.
Inconsistent or overly permissioned DevOps teams can spin up instances and use services that could generate unexpected costs or exposures. Threat Stack enables you to gain visibility into infrastructure changes and risky behavior without introducing blockers and permissions that unnecessarily slow down your team.
Unlike cloud security solutions that only assess account misconfigurations, Threat Stack also monitors for risky and anomalous behavior — helping you understand whether you’re exposed and what happened if someone breached your environment.
While AWS is responsible for protecting the infrastructure that runs its services, you’re responsible for securing your data and systems. Threat Stack helps you manage the security and compliance for your share of responsibility by collecting and analyzing data from your EC2 instances and the AWS Management Console, alerting you of risky runtime misconfigurations or behaviors.
Threat Stack provides cloud security posture management (CSPM) through the platform’s Configuration Auditing feature. With scheduled and on-demand assessments against CIS Benchmarks, Threat Stack provides 47 default policies for evaluating configuration state against your foundational AWS services.
Mistakes happen. If someone gets ahold of your AWS keys, they have free reign over your infrastructure and could make changes to your configurations, spin up new instances, or traverse your infrastructure until they find an instance with admin privileges to access private data.
Threat Stack monitors both AWS CloudTrail and AWS workloads. As a result, you get visibility to the entire path of the attacker, even for increasingly sophisticated attacks.
Receive alerts on changes to your instances, security groups, S3 buckets, and access keys, and also see whether any of these changes had adverse effects on your systems.
See an inventory of all servers and instances across multiple AWS accounts and see key information like instance ID, region, type, IP, and more. See which servers have the Threat Stack Agent installed and assign Threat Stack rules by using EC2 tags.
Evaluate configuration best-practices for managing IAM policies and password hygiene.
Perform configuration checks on S3 bucket permissions and encryption.
Scan settings for RDS backups, encryption, and more.
Monitor all activity of Amazon ECS containers and the hosts these containers are running on.
Monitor all activity of Amazon EKS containers and the hosts these containers are running on.
Threat Stack ingests data from services like AWS CloudTrail to alert you of changes made like instances spun up in unused regions.
Threat Stack’s lightweight agent monitors system, user, and file behavior on the host to alert you to signs of compromise — from the inside or outside.
Threat Stack integrates with Docker to alert you to suspicious activity — like someone logging into a container.
As your company grows, it can be difficult to keep track of new AWS accounts and instances — and adding an obtrusive security solution can lead to insecure workarounds and shadow IT. The Threat Stack Agent can be baked into your AMIs and popular configuration management tools, so instances are automatically monitored as they are added. Threat Stack also gives you visibility across multiple accounts, making it easier to manage your attack surface and risk.
Normal behavior on one server may indicate compromise on another. Threat Stack automatically pulls in your EC2 tags so you can easily assign rules to subsets of your servers. This means your alerts are even more relevant and actionable.
Autoscaling infrastructure is great for your infrastructure costs and availability, but presents challenges when it comes to security. Threat Stack allows you to view a history of activity, even on terminated servers, so you won’t have missing pieces when it comes time to investigate.
Autoscaling technology
Easily deployed with pre-built runbooks and agent baked into base AMI
Ability to investigate events on terminated servers
Host-based technology
Cloud Security Posture Management
This site uses cookies to provide better user experience. By using this site, you are accepting our use of cookies. View Privacy Policy.