> ## Documentation Index
> Fetch the complete documentation index at: https://docs.usetrident.dev/llms.txt
> Use this file to discover all available pages before exploring further.

# Cloud Security: Map Assets and Attack Paths for AI

> Trident Cloud continuously maps your cloud infrastructure, surfaces attack paths from AI agents to sensitive data, and prioritizes what to fix first.

Trident Cloud gives you a continuously updated map of every resource in your AWS, Azure, GCP, and Kubernetes environments — and connects that map directly to your AI agents' runtime behavior. Traditional cloud security tools treat each misconfiguration in isolation. Trident goes further: it builds a live security graph that links identities, compute, and data stores so it can find the multi-hop paths an attacker (or a compromised agent) could actually walk. When an AI agent carries over-permissioned credentials, a single prompt injection can chain all the way to a sensitive S3 bucket — Trident finds and ranks those paths before an attacker does.

<CardGroup cols={3}>
  <Card title="Asset Discovery" icon="magnifying-glass">
    Trident discovers 200+ cloud resource types — EC2, Lambda, EKS, S3, RDS,
    DynamoDB, IAM roles, Kubernetes pods, and more — within 15 minutes of
    creation, with no agents or network changes required.
  </Card>

  <Card title="Identity Analysis" icon="id-badge">
    Trident resolves **effective permissions**, not just attached policies.
    It follows role chains, instance profiles, and workload identities to
    show you what an identity can actually reach at query time.
  </Card>

  <Card title="Attack Paths" icon="route">
    The toxic combo engine runs a breadth-first search across the security
    graph to surface multi-hop exploit chains ranked by real exploitability
    — confirmed with read-only IAM policy simulation before they reach you.
  </Card>
</CardGroup>

## How it works

<Steps>
  <Step title="Connect your cloud accounts">
    You grant Trident a read-only IAM role (or equivalent) for each provider.
    No agents are installed, no network changes are needed, and onboarding
    takes under five minutes. See [Connecting cloud accounts](/cloud/connecting).
  </Step>

  <Step title="Trident builds the security graph">
    Trident scans your environment and assembles a live graph of assets,
    IAM identities, data stores, and the typed edges that connect them —
    such as `assumes_role`, `reaches`, `stores`, and `grants`.
  </Step>

  <Step title="The toxic combo engine finds attack paths">
    Trident runs named detection rules and a graph traversal across every
    path in the security graph. It looks for combinations of risk factors
    that are low-severity individually but critical together — for example,
    a prompt-injectable AI agent that runs as a privileged IAM role with
    access to a sensitive datastore.
  </Step>

  <Step title="Findings appear in the unified inbox">
    Confirmed attack paths and cloud posture findings land in the same inbox
    as your firewall events and red-team results. Each finding shows the
    blast radius, confidence score, and a Sentinel-generated remediation
    draft.
  </Step>
</Steps>

## What makes Trident different

Most cloud security tools see cloud resources and AI agents as separate surfaces. Trident connects them. Every AI agent you monitor with Trident is linked to the cloud workload it runs on, the IAM role that workload assumes, and the data stores that role can reach.

This means a finding like **prompt injection in a customer-facing agent** doesn't stay isolated — Trident traces the full chain: the injection exploits the agent's tool-calling behavior, the agent executes as a privileged IAM role, and that role has `s3:GetObject` on a bucket tagged `sensitivity:HIGH`. Trident surfaces the entire path, confirms exploitability with a read-only policy simulation, and proposes a fix.

## Supported providers

| Provider       | Coverage                                                                                                              |
| -------------- | --------------------------------------------------------------------------------------------------------------------- |
| **AWS**        | EC2, Lambda, EKS, S3, RDS, DynamoDB, IAM roles and policies, VPC, Secrets Manager, and 180+ additional resource types |
| **Azure**      | Virtual machines, AKS, Blob Storage, Azure AD service principals, Key Vault, and more                                 |
| **GCP**        | Compute Engine, GKE, Cloud Storage, Cloud SQL, IAM service accounts, and more                                         |
| **Kubernetes** | Pods, Deployments, ServiceAccounts, RBAC roles and bindings, namespaces                                               |

## Scan frequency

Trident detects newly created resources within **15 minutes** of creation. Full graph re-evaluation runs on each scan cycle so attack paths always reflect your current state.

<Tip>
  Ready to connect your first cloud account? Head to [Connecting cloud accounts](/cloud/connecting)
  — onboarding takes about five minutes and requires no network changes.
</Tip>