Skip to main content
Trident Cloud gives you a continuously updated map of every resource in your AWS, Azure, GCP, and Kubernetes environments — and connects that map directly to your AI agents’ runtime behavior. Traditional cloud security tools treat each misconfiguration in isolation. Trident goes further: it builds a live security graph that links identities, compute, and data stores so it can find the multi-hop paths an attacker (or a compromised agent) could actually walk. When an AI agent carries over-permissioned credentials, a single prompt injection can chain all the way to a sensitive S3 bucket — Trident finds and ranks those paths before an attacker does.

Asset Discovery

Trident discovers 200+ cloud resource types — EC2, Lambda, EKS, S3, RDS, DynamoDB, IAM roles, Kubernetes pods, and more — within 15 minutes of creation, with no agents or network changes required.

Identity Analysis

Trident resolves effective permissions, not just attached policies. It follows role chains, instance profiles, and workload identities to show you what an identity can actually reach at query time.

Attack Paths

The toxic combo engine runs a breadth-first search across the security graph to surface multi-hop exploit chains ranked by real exploitability — confirmed with read-only IAM policy simulation before they reach you.

​
How it works

1

Connect your cloud accounts

You grant Trident a read-only IAM role (or equivalent) for each provider. No agents are installed, no network changes are needed, and onboarding takes under five minutes. See Connecting cloud accounts.
2

Trident builds the security graph

Trident scans your environment and assembles a live graph of assets, IAM identities, data stores, and the typed edges that connect them — such as assumes_role, reaches, stores, and grants.
3

The toxic combo engine finds attack paths

Trident runs named detection rules and a graph traversal across every path in the security graph. It looks for combinations of risk factors that are low-severity individually but critical together — for example, a prompt-injectable AI agent that runs as a privileged IAM role with access to a sensitive datastore.
4

Findings appear in the unified inbox

Confirmed attack paths and cloud posture findings land in the same inbox as your firewall events and red-team results. Each finding shows the blast radius, confidence score, and a Sentinel-generated remediation draft.

​
What makes Trident different

Most cloud security tools see cloud resources and AI agents as separate surfaces. Trident connects them. Every AI agent you monitor with Trident is linked to the cloud workload it runs on, the IAM role that workload assumes, and the data stores that role can reach. This means a finding like prompt injection in a customer-facing agent doesn’t stay isolated — Trident traces the full chain: the injection exploits the agent’s tool-calling behavior, the agent executes as a privileged IAM role, and that role has s3:GetObject on a bucket tagged sensitivity:HIGH. Trident surfaces the entire path, confirms exploitability with a read-only policy simulation, and proposes a fix.

​
Supported providers

ProviderCoverage
AWSEC2, Lambda, EKS, S3, RDS, DynamoDB, IAM roles and policies, VPC, Secrets Manager, and 180+ additional resource types
AzureVirtual machines, AKS, Blob Storage, Azure AD service principals, Key Vault, and more
GCPCompute Engine, GKE, Cloud Storage, Cloud SQL, IAM service accounts, and more
KubernetesPods, Deployments, ServiceAccounts, RBAC roles and bindings, namespaces

​
Scan frequency

Trident detects newly created resources within 15 minutes of creation. Full graph re-evaluation runs on each scan cycle so attack paths always reflect your current state.
Ready to connect your first cloud account? Head to Connecting cloud accounts — onboarding takes about five minutes and requires no network changes.