Welcome to Infracast
Infracast is generally available. Which features you can use depends on your deployment model (SaaS or self-hosted) and your license tier (see License Required), and many features need a connected data source before they show anything. Each feature page describes its own scope and limits.
Infracast is an infrastructure security and compliance platform that discovers, maps, and continuously audits your entire technology estate — from cloud resources to on-prem devices to SaaS applications.
Start Here
- Connect your first cloud account — SaaS Quickstart (AWS cross-account role, External ID, connection test), then AWS Discovery
- Deploy self-hosted — Docker Quickstart for evaluation, Deployment Guide and Terraform Deployment for production; a license is required
- Investigate a finding — Your First Compliance Audit, the Findings API and Attack Path Analysis
- Prepare assessment evidence — Evidence Engine, Assessments & Questionnaires for controls that need human attestation, and the FedRAMP SSP Generator
- Use the API — API Overview and Authentication
What Infracast Does
🔍 Discover
Automatically discover infrastructure across AWS, Azure, GCP, Microsoft 365, VMware, Cisco, Palo Alto, and 20+ other platforms — agent-based or agentless.
🛡️ Secure
Find attack paths, IAM risks, misconfigurations, and vulnerabilities. Map findings to MITRE ATT&CK techniques for threat-informed defense.
✅ Comply
Continuous auditing against 1,350+ rules (all hot-reloadable YAML) across NIST 800-53, NIST 800-171 r2, DFARS 252.204-7012, FAR 52.204-21/23/25/27, CMMC 1–3, FedRAMP, PCI DSS 4.0, SOC 2 Type II, ISO 27001, HIPAA, CIS Benchmarks, DISA STIGs, NIST CSF 2.0, TLS/certificate posture, and 11 international frameworks — 37 frameworks in all. Every finding includes actionable fix steps for Terraform, AWS Console, CLI, and manual remediation across 10 domains.
Quick Start
Choose your deployment model:
| Path | Time | Best For |
|---|---|---|
| SaaS Quickstart | 5 min | Teams wanting managed infrastructure |
| Docker Quickstart | 10 min | Local evaluation or development |
| Terraform Deployment | 30 min | Production AWS/Azure deployment |
Core Concepts
Nodes
Everything Infracast discovers becomes a node — EC2 instances, VPCs, firewalls, switches, AD users, M365 users, S3 buckets, and more. Each node has a type (e.g., aws.ec2.instance, m365.user), properties, and tags.
Edges
Edges represent relationships between nodes: network connectivity, containment (VPC contains subnet), security group attachments, IAM policies, group membership, and more.
Findings
Findings are compliance violations or security issues detected by Infracast's audit engine. Each finding references a specific control from a compliance framework and includes remediation guidance.
Discovery
Discovery connects to your infrastructure sources (cloud accounts, M365 tenants, network devices, etc.) and populates the graph with nodes and edges. Run discovery on-demand or on a schedule.
Compliance Frameworks
Built-in support for:
| Framework | Coverage | Description |
|---|---|---|
| NIST 800-53 (Low/Moderate/High) | 130+ rules | Federal security controls — full baseline support |
| NIST 800-171 r2 | 114 rules | CUI protection for DoD contractors — all 110 requirements across 14 families |
| DFARS 252.204-7012 | 23 rules | Safeguarding Covered Defense Information and cyber incident reporting (72-hour DoD notification) |
| FAR (52.204-21/23/25/27, 52.239-1) | 30 rules | Federal Acquisition Regulation baseline safeguarding — applies to ALL federal contractors handling FCI |
| FedRAMP (Low/Moderate/High/LI-SaaS) | 80+ rules | Cloud service authorization at all impact levels |
| CMMC Level 1–3 | 70 rules | DoD Cybersecurity Maturity Model Certification |
| CIS Benchmarks (AWS, Azure, GCP, Kubernetes) | 265+ rules | Center for Internet Security hardening guides |
| HIPAA | 35 rules | Healthcare data protection & privacy |
| PCI DSS 4.0 | 60 rules | Payment card industry security standard |
| SOC 2 Type II | 40 rules | AICPA Trust Services Criteria |
| ISO 27001 | 45 rules | International information security management |
| GDPR | 30 rules | EU general data protection regulation |
| NIS2 | 28 rules | EU network & information systems directive |
| DORA | 25 rules | EU digital operational resilience act |
| UK Cyber Essentials | 20 rules | UK government baseline cyber security |
| IRAP (Australia) | 22 rules | Information Security Registered Assessors Program |
| CSA CCM | 30 rules | Cloud Security Alliance Cloud Controls Matrix |
| LGPD (Brazil) | 18 rules | Brazilian general data protection law |
| PIPEDA (Canada) | 16 rules | Canadian personal information protection |
| SOX IT Controls | 24 rules | Sarbanes-Oxley IT general controls |
| NERC CIP | 35 rules | Critical infrastructure protection (energy sector) |
| NIST CSF 2.0 | 40 rules | Cybersecurity framework — identify, protect, detect, respond, recover, govern |
| DISA STIG | 380+ rules | Security Technical Implementation Guides |
| DNS Security | 10 rules | DNS zone discovery & subdomain takeover detection |
| TLS / Certificate Posture | 10 rules | Live outside-in TLS scanning — expiry, weak protocols/ciphers, chain trust, hostname mismatch, HSTS |
| Total | 1,350+ rules | All hot-reloadable YAML across 37 frameworks incl. 11 international |
What the Compliance Claims Cover
Infracast separates three things, and the numbers on this page are about the first one only:
- Automated checks — rules that evaluate discovered infrastructure and raise findings. The rule counts in the framework table below are counts of these rules, not of controls proven satisfied.
- Human attestations — controls that cannot be determined by scanning (policy, training, physical security, etc.) are answered through Assessments & Questionnaires by a person, who supplies the evidence.
- Not assessed — a control with no automated result and no attestation is reported as Not Assessed; Infracast does not infer that it passes.
For NIST 800-53 specifically, the Evidence Engine works from a control catalog in the product. Counted from the
catalog source (internal/core/evidence/controls.go, by counting its {ID: "..."} entries and their Automatable flag):
it lists 135 entries (base controls and enhancements — a subset of NIST 800-53 Rev 5, not the whole publication),
62 flagged automatable and 73 not automatable. Of the 62 automatable entries, 19 list rule IDs in the catalog.
A catalog flag is not a guarantee that your environment passes. Using Infracast output in an authorization package does not
replace assessor review.
Feature Catalogue
Security
- Attack Path Analysis — Discover how vulnerabilities chain together
- CIEM — Identify IAM risks and overprivileged identities
- MITRE ATT&CK — Map findings to adversary techniques
- Zero Trust Maturity — Assess against CISA ZTMM
- Risk Scoring — Prioritize findings by true risk
Infrastructure
- Agentless Discovery — AWS, Azure, GCP, M365, on-prem
- On-Prem Relay — Full on-premises scanning (VMware vSphere, SSH, SNMP, WinRM) through an outbound-only relay; no VPN or inbound firewall rules required; agent-through-relay proxy for zero-inbound agents
- Microsoft 365 — Entra ID, Exchange, SharePoint, Teams
- Applications — Group resources by business service; auto-discovery from tags, K8s labels, and traffic patterns
- SBOM Generation — Software inventory for EO 14028 at host, application, and business service scope
- Configuration Drift — Detect drift from intended state
- Architecture & Model Export — Publication-quality diagrams, MBSE/SysML models, and rebuildable infrastructure code from the live asset graph; text formats stream server-side so very large estates export without memory pressure
- Asset Groups — Save named subsets of discovered assets (static, dynamic filter, or hybrid) and scope reports, documents, and exports to them
ATO & Compliance Automation
- Evidence Engine — Control assessments and evidence artifacts for the NIST 800-53 controls in its catalog; controls that cannot be checked automatically need human attestation (see scope)
- POA&M Management — Auto-populate and track Plan of Action & Milestones from findings
- Continuous Monitoring — Automated FedRAMP ConMon deliverables and 3PAO bundles
- GRC Integrations — eMASS, CSAM, ServiceNow GRC, RSA Archer connectors
- FedRAMP SSP Generator — Auto-generates System Security Plans with per-control narratives and compliance package ZIP export
- Assessment & Questionnaire System — Create questionnaires from templates, assign to users, capture evidence for non-automatable controls
- FAR/DFARS Compliance Reports — Automated document generators for FAR 52.204-21 and DFARS 252.204-7012 with SPRS score calculation
DNS & Authentication
- DNS Security & Discovery — Route53/Azure DNS/GCP Cloud DNS zone discovery, 10 DNS security rules, subdomain takeover detection
- MFA Enforcement — TOTP-based MFA with backup codes, admin enforcement, two-step login
Platform
- AWS Marketplace — Available for procurement alongside direct Stripe billing
- UI Consolidation — Streamlined navigation with tabbed compliance center, consolidated settings
Need Help?
- Documentation: You're here! Browse the sidebar.
- Community: Join us on Discord
- Support: Email support@infracast.io
- Enterprise: Contact sales@azgardtek.com