Emfirge · what can an attacker reach right now?

02 / How it works

Three movements.
No agents installed.

A read-only role. A cartography pass. A pull request. Live in production in under two minutes, with nothing to babysit.

FIG 1.1 — Connect

Deploy a read-only role.

One CloudFormation stack. No credentials stored. The agent never sees write access, to anything, ever.

FIG 1.2 — Map

Map the attack surface.

The agent traces every edge from the internet to your data. 18+ services. One graph. One redline path per finding.

FIG 1.3 — Act

Open a Terraform PR.

The agent writes HCL, opens a branch, links the finding. You review and merge. Production state never changes without you.

03 / Simulation

Add any component. See blast radius instantly.

Pick a component type, configure it, hit Simulate. Emfirge shows the exact findings, risk score delta, and toxic combinations before the resource exists.

You see the new findings, the risk delta, the toxic combinations introduced, and the recommended remediation. All in the same graph.

04 / Cartography

A live map of every path between the internet and your data.

Emfirge maps 18+ cloud services in parallel, then renders the relationships as a graph. Not a list of misconfigurations. A topology. You can see exactly which resource is one hop from public.

Every edge is queryable. Every node carries its findings, its IAM, and its blast radius.

05 / Findings

Every finding is a path, not a checkbox.

Other tools hand you a 4,000-line CSV. emfirge ranks risk by reachability, what an attacker can actually do from the internet, mapped to MITRE ATT&CK techniques.

Critical first. Noise last. With the resource graph behind every claim.

06 / Remediation

Fixes ship as Terraform PRs, not Jira tickets.

Emfirge writes the HCL, opens the PR on a feature branch, links the finding, and waits for your review. Never pushes to main. Never touches production directly.

You merge what you trust. The graph updates the moment the change lands.

07 / Anatomy of a finding

One real toxic combination, end to end.

Every finding Emfirge surfaces is a complete dossier, not a line item. Here's a real one, anonymized: a public ALB with overly-permissive ingress, fronting an EC2 instance whose IAM role can read the production database secret.

FINDING EMF-2026-T1530-04 · MITRE ATT&CK · T1530 / T1078.004

Critical

Attack path · 4 hops

1 0.0.0.0/0 internet

2 sg-066a7e4eecc6f5e86 :443 open

3 i-0ab19f23ca8d4e7c1 ec2 · prod-web

4 prod/db/master_password secrets · read

Toxic combination

internet-reachable EC2
+ permissive SG (0.0.0.0/0)
+ instance role with secrets:GetSecretValue
= direct path from public to prod credentials

Remediation · Terraform diff

# sg.tf · open #84 · emfirge/fix-sg-066a7e resource "aws_security_group" "web" { name = "prod-web" ingress { from_port = 443 to_port = 443 protocol = "tcp" - cidr_blocks = ["0.0.0.0/0"] + security_groups = [aws_security_group.alb.id] } } # iam.tf · scope secret read to single ARN data "aws_iam_policy_document" "ec2_secrets" { statement { actions = ["secretsmanager:GetSecretValue"] - resources = ["*"] + resources = [aws_secretsmanager_secret.app_only.arn] } }

Drift: 2026-05-04 14:22 UTC · agent v1.4.2

+12 −3 lines 2 files ▲ ready to merge

08 / vs Enterprise

Built for fast-moving teams, not buyers.

The incumbentEnterprise CSPM

Built for companies with a CISO, a procurement team, and a security committee.

Weeks to deploy. Agents on every workload.
Findings land in a dashboard. Fixes land in Jira.
$50k+ annual contract. Per-asset pricing.
Requires a security team to interpret results.
Built for compliance audits, not engineering velocity.

EmfirgeYou, in 2 minutes.

Built for the engineer who owns infra and security.

Live in 2 minutes. Read-only role, nothing installed.
Findings come with the Terraform fix already written.
Free during beta. No contract. No credit card.
Built for the engineer who owns infra and security.
PRs ship to GitHub. You review, you merge, done.

09 / Coverage

What happens after you connect.

Individual checks run per pass across your entire stack.

rules · active

Toxic combination patterns that multiply blast radius.

multi-signal · curated

Risk categories scored simultaneously: security, availability, cost, DR.

dimensions · parallel

Real-time

Drift detection between passes. New risks surface instantly.

continuous · no polling

Three movements.No agents installed.