Find and fix security gaps in your European clouds

The main screens:

• Dashboard: your findings by severity and category, the checks that fail most and your latest scans.
• Asset Explorer: every asset across your clouds, to search, filter and tag.
• Asset Details: one asset's configuration, its findings and how it connects to the rest of your cloud.
• Vulnerabilities: every finding, sorted by severity, with a recommendation. Dismiss a finding with a reason, or raise a Jira ticket for it.
• Attack Paths: the routes an attacker could take to your data, with the choke point to fix first.
• Compliance: where you stand on each framework, control by control.
• Audit Log: who dismissed a finding, changed a setting or exported data, and when.

You can also export findings, attack paths and the audit log as CSV, invite your team, turn on two-factor authentication and scan each cloud on a schedule you set.

Yes: the guided tour. It opens the real product on Orvessa, a fictional health software company running on OVHcloud and Scaleway, and it needs no sign-up. The tour takes about three minutes, and you can leave it at any point to explore on your own. It runs on Orvessa's data, so nothing you do there touches a real cloud.

To see PABLO on your own cloud, book a guided setup and we'll connect your first account with you.

By the size of your cloud: the price depends on how many assets PABLO monitors in your accounts, such as instances, volumes, databases and users. Book a guided setup, or email us roughly how big your cloud is, and we'll tell you what it costs.

No. PABLO only covers European clouds, and each of its checks is written for the provider it runs on. If you also run on AWS, Azure or Google Cloud, keep your current tooling there and use PABLO for your European accounts.

No. PABLO reads your configuration through each provider's API with a read-only API key, so there's nothing to install on your machines, clusters or databases.

Create a read-only API key in your provider's console, add a connector in PABLO and paste the key in. PABLO starts reading your assets straight away and lists its findings once the first scan is done. After that, it reads your cloud again on the schedule you choose.

Rather do it together? Book a guided setup and we'll connect your first account with you.

Yes, on Scaleway and OVHcloud. IAM is where PABLO runs the most checks, for example:

• an organisation owner, or any other user, without multi-factor authentication
• a policy that allows every action through a wildcard
• a policy that still grants access to a disabled user
• an API application that can be used from any IP address
• an admin bound to a policy directly, instead of through a group

Attack paths then show what those risks add up to: which users and applications could reach your databases or take over your organisation.

PABLO turns your inventory into a graph of your assets and how they connect: users, policies, networks, machines and databases. It then follows the permissions and network routes an attacker could use, from an entry point (a user, an API application or a public IP address) to a target (your organisation, a database or a machine open to the internet). On STACKIT and OpenStack, where PABLO doesn't check IAM yet, it follows network routes only.

Each path gets a severity and an attacker effort: the sum of how hard each step is, from trivial to expensive. The most severe paths come first and, among those, the easiest. On each path, PABLO marks the choke point: the one step to fix so an attacker can't use the path at all.

PABLO rebuilds the paths every time it reads your cloud, so a fix shows up as paths that disappear. You can also tag your own entry points and targets.

NIS2, GDPR (Article 32), ISO 27001 and CIS. PABLO covers each framework's technical controls: every one is linked to the automated checks that verify it on your cloud, so you see which controls you meet, which you don't and the findings behind them. Organisational controls, such as staff training or incident procedures, aren't part of PABLO's compliance view.

Next to the frameworks, every finding carries a CVSS score, and custom checks cover misconfigurations specific to European clouds that the frameworks miss. For NIS2, PABLO checks each control against ENISA's Technical Implementation Guidance, which spells the control out as concrete technical requirements. The checks come from the European Cloud Baseline, our set of security controls for each provider, which we write from that provider's documentation.

In Scaleway's Paris region, in France. Each company gets its own graph database for its inventory. Your findings, users and settings sit in a separate database next to it.

PABLO reads how your cloud is configured, not the data inside your databases, volumes or buckets. Your inventory and findings never leave the EU unless you send them out yourself, for example by raising a Jira ticket for a finding. You can delete your company, and all its data with it, from your profile.