Welcome to Infracast

Generally Available

Infracast is generally available (GA). All features documented here are production-ready and fully supported.

Infracast is an infrastructure security and compliance platform that discovers, maps, and continuously audits your entire technology estate — from cloud resources to on-prem devices to SaaS applications.

What Infracast Does

🔍 Discover

Automatically discover infrastructure across AWS, Azure, GCP, Microsoft 365, VMware, Cisco, Palo Alto, and 20+ other platforms — agent-based or agentless.

🛡️ Secure

Find attack paths, IAM risks, misconfigurations, and vulnerabilities. Map findings to MITRE ATT&CK techniques for threat-informed defense.

✅ Comply

Continuous auditing against 1,637+ rules (all hot-reloadable YAML) across NIST 800-53, NIST 800-171 r2, DFARS 252.204-7012, FAR 52.204-21/23/25/27, CMMC 1–3, FedRAMP, PCI DSS 4.0, SOC 2 Type II, ISO 27001, HIPAA, CIS Benchmarks, DISA STIGs, NIST CSF 2.0, and 11 international frameworks across 42 packs. Every finding includes actionable fix steps for Terraform, AWS Console, CLI, and manual remediation across 10 domains.

Key Features

Security

• Attack Path Analysis — Discover how vulnerabilities chain together
• CIEM — Identify IAM risks and overprivileged identities
• MITRE ATT&CK — Map findings to adversary techniques
• Zero Trust Maturity — Assess against CISA ZTMM
• Risk Scoring — Prioritize findings by true risk

Infrastructure

• Agentless Discovery — AWS, Azure, GCP, M365, on-prem
• On-Prem Relay — Full on-premises scanning (VMware vSphere, SSH, SNMP, WinRM) through an outbound-only relay; no VPN or inbound firewall rules required; agent-through-relay proxy for zero-inbound agents
• Microsoft 365 — Entra ID, Exchange, SharePoint, Teams
• Applications — Group resources by business service; auto-discovery from tags, K8s labels, and traffic patterns
• SBOM Generation — Software inventory for EO 14028 at host, application, and business service scope
• Configuration Drift — Detect drift from intended state
• Large-Scale Topology — 50K+ node environments with Barnes-Hut layout, canvas renderer, and publication-quality PNG/draw.io export

ATO & Compliance Automation

• Evidence Engine — Continuous signed evidence for every NIST 800-53 control
• POA&M Management — Auto-populate and track Plan of Action & Milestones from findings
• Continuous Monitoring — Automated FedRAMP ConMon deliverables and 3PAO bundles
• GRC Integrations — eMASS, CSAM, ServiceNow GRC, RSA Archer connectors
• FedRAMP SSP Generator — Auto-generates System Security Plans with per-control narratives and compliance package ZIP export
• Assessment & Questionnaire System — Create questionnaires from templates, assign to users, capture evidence for non-automatable controls
• FAR/DFARS Compliance Reports — Automated document generators for FAR 52.204-21 and DFARS 252.204-7012 with SPRS score calculation

Security

• DNS Security & Discovery — Route53/Azure DNS/GCP Cloud DNS zone discovery, 10 DNS security rules, subdomain takeover detection
• MFA Enforcement — TOTP-based MFA with backup codes, admin enforcement, two-step login

Platform

• AWS Marketplace — Available for procurement alongside direct Stripe billing
• UI Consolidation — Streamlined navigation with tabbed compliance center, consolidated settings

Quick Start

Choose your deployment model:

Path	Time	Best For
SaaS Quickstart	5 min	Teams wanting managed infrastructure
Docker Quickstart	10 min	Local evaluation or development
Terraform Deployment	30 min	Production AWS/Azure deployment

Core Concepts

Nodes

Everything Infracast discovers becomes a node — EC2 instances, VPCs, firewalls, switches, AD users, M365 users, S3 buckets, and more. Each node has a type (e.g., aws.ec2.instance, m365.user), properties, and tags.

Edges

Edges represent relationships between nodes: network connectivity, containment (VPC contains subnet), security group attachments, IAM policies, group membership, and more.

Findings

Findings are compliance violations or security issues detected by Infracast's audit engine. Each finding references a specific control from a compliance framework and includes remediation guidance.

Discovery

Discovery connects to your infrastructure sources (cloud accounts, M365 tenants, network devices, etc.) and populates the graph with nodes and edges. Run discovery on-demand or on a schedule.

Compliance Frameworks

Built-in support for:

Framework	Coverage	Description
NIST 800-53 (Low/Moderate/High)	130+ rules	Federal security controls — full baseline support
NIST 800-171 r2	114 rules	CUI protection for DoD contractors — all 110 requirements across 14 families
DFARS 252.204-7012	22 rules	Safeguarding Covered Defense Information and cyber incident reporting (72-hour DoD notification)
FAR (52.204-21/23/25/27, 52.239-1)	30 rules	Federal Acquisition Regulation baseline safeguarding — applies to ALL federal contractors handling FCI
FedRAMP (Low/Moderate/High/LI-SaaS)	80+ rules	Cloud service authorization at all impact levels
CMMC Level 1–3	70 rules	DoD Cybersecurity Maturity Model Certification
CIS Benchmarks (AWS, Azure, GCP, Kubernetes)	265+ rules	Center for Internet Security hardening guides
HIPAA	35 rules	Healthcare data protection & privacy
PCI DSS 4.0	60 rules	Payment card industry security standard
SOC 2 Type II	40 rules	AICPA Trust Services Criteria
ISO 27001	45 rules	International information security management
GDPR	30 rules	EU general data protection regulation
NIS2	28 rules	EU network & information systems directive
DORA	25 rules	EU digital operational resilience act
UK Cyber Essentials	20 rules	UK government baseline cyber security
IRAP (Australia)	22 rules	Information Security Registered Assessors Program
CSA CCM	30 rules	Cloud Security Alliance Cloud Controls Matrix
LGPD (Brazil)	18 rules	Brazilian general data protection law
PIPEDA (Canada)	16 rules	Canadian personal information protection
SOX IT Controls	24 rules	Sarbanes-Oxley IT general controls
NERC CIP	35 rules	Critical infrastructure protection (energy sector)
NIST CSF 2.0	40 rules	Cybersecurity framework — identify, protect, detect, respond, recover, govern
DISA STIG	380+ rules	Security Technical Implementation Guides
DNS Security	10 rules	DNS zone discovery & subdomain takeover detection
Total	1,270+ rules	All hot-reloadable YAML across 36 packs · 23 frameworks incl. 11 international

Need Help?

• Documentation: You're here! Browse the sidebar.
• Community: Join us on Discord
• Support: Email support@infracast.io
• Enterprise: Contact sales@azgardtek.com