How does Boundary connect to my cloud?

Boundary is agentless. You connect each AWS, Azure or Google Cloud account with a read-only role, so there is nothing to install on your servers and nothing changes in your workloads.

How long does setup take?

Most teams connect their first account in under 10 minutes. The first scan finishes within an hour, and you see your top risks ranked by impact as soon as it does.

Can Boundary change my infrastructure?

No. Access stays read-only. Guided remediation shows the exact fix as console steps, CLI commands or Terraform, and your team decides when to apply it or sends it to Jira as a ticket.

What data does Boundary store?

Only configuration metadata: resources, permissions and network settings. Boundary never reads the contents of your files, databases or storage buckets. Everything is encrypted in transit and at rest.

Which clouds and tools do you support?

AWS, Azure, Google Cloud and Kubernetes. Alerts go to Slack, Microsoft Teams, Jira and PagerDuty, and you can sign in with Okta, Auth0 or Google.

How does the free trial work?

You get 14 days of the Professional plan with every feature switched on. No credit card is needed, and your scan results stay in your account if you subscribe.

Can I change plans or cancel?

Yes. Upgrade whenever you add accounts or resources, and the new limits apply straight away. You can cancel before your next billing date without talking to sales.

FreeGet a cloud security assessment

Find and fix security risks in your cloud.

Connect your cloud to find vulnerabilities, risky permissions and exposed data.

Book a demo

Trusted by

Quillmont
Veyra
Orbitwell
Brightmesh
Cindral
Halvorn
Tidewise
Lumora
Ferncrest
Zentrik

How it works

From connected to fixed in three simple steps.

Boundary is agentless, so there is nothing to install and nothing to change in your workloads.

Connect your cloud
Add a read-only role for AWS, Azure or Google Cloud. Nothing to install.
See what matters
Your first scan finishes within an hour, with every risk ranked by impact.
Secrets not rotatedHigh
Versioning disabledMedium
Public storage bucketCritical
Admin without MFAHigh
Open SSH portMedium
Root access key in useCritical
Wildcard IAM policyHigh
Logging disabledMedium
Unencrypted databaseCritical
Public function URLHigh
Outdated container imageMedium
Exposed admin consoleCritical
Secrets not rotatedHigh
Versioning disabledMedium
Public storage bucketCritical
Admin without MFAHigh
Open SSH portMedium
Root access key in useCritical
Wildcard IAM policyHigh
Logging disabledMedium
Unencrypted databaseCritical
Public function URLHigh
Outdated container imageMedium
Exposed admin consoleCritical
Secrets not rotatedHigh
Versioning disabledMedium
Public storage bucketCritical
Admin without MFAHigh
Open SSH portMedium
Root access key in useCritical
Wildcard IAM policyHigh
Logging disabledMedium
Unencrypted databaseCritical
Public function URLHigh
Outdated container imageMedium
Exposed admin consoleCritical
Secrets not rotatedHigh
Versioning disabledMedium
Public storage bucketCritical
Admin without MFAHigh
Open SSH portMedium
Root access key in useCritical
Wildcard IAM policyHigh
Logging disabledMedium
Unencrypted databaseCritical
Public function URLHigh
Outdated container imageMedium
Exposed admin consoleCritical
Fix with guidance
Get the exact fix as console steps, CLI or Terraform, or send it to Jira.
main.tfCriticalHighMediumResolved
# Public storage bucket
module "prod_assets" {
- block_public_acls = false
+ block_public_acls = true
- block_public_policy = false
+ block_public_policy = true
}
# Admin without MFA
module "admin_role" {
- role_requires_mfa = false
+ role_requires_mfa = true
- max_session_duration = 43200
+ max_session_duration = 3600
}
# Logging disabled
resource "aws_cloudtrail" "org" {
- enable_logging = false
+ enable_logging = true
- is_multi_region_trail = false
+ is_multi_region_trail = true
}
Sent to Jira·SEC-142
Sent to Jira·SEC-143
Sent to Jira·SEC-144

Integrations

Your entire stack. One clear picture.

Industries

Cloud security for every industry.

See your risks, protect sensitive data and give your team a clear path forward.

Finance

Protect financial data, uncover risky permissions and keep critical cloud infrastructure secure.

Healthcare

Find exposed patient data and cloud misconfigurations before they put care delivery at risk.

E-commerce

Secure customer data and cloud storefronts as your business grows and traffic peaks.

SaaS & technology

Give engineering teams visibility into cloud risks so they can ship with confidence.

Education

Keep student records and learning platforms protected across your cloud environments.

Logistics

Identify vulnerabilities in the cloud systems that keep your supply chain connected.

Pricing

Cloud security that scales with you.

Start with visibility, then add deeper protection as your infrastructure grows.

Essentials

For small teams securing their cloud infrastructure.

$299/month

Billed monthly$2,868 billed yearly

Start your free trial

3 cloud accounts
500 monitored resources
Cloud asset inventory
Misconfiguration detection
Risk prioritisation
Email alerts

Professional

Enterprise

For organisations with complex infrastructure and security requirements.

$1,999/month

Billed monthly$19,188 billed yearly

Start your free trial

25 cloud accounts
Everything in Professional
SSO and role-based access
Custom security policies
Dedicated onboarding and support
Dedicated support

FAQ

Questions before you connect your cloud.

How Boundary works, what it can read in your cloud and what your team controls.

: Boundary is agentless. You connect each AWS, Azure or Google Cloud account with a read-only role, so there is nothing to install on your servers and nothing changes in your workloads.
: Most teams connect their first account in under 10 minutes. The first scan finishes within an hour, and you see your top risks ranked by impact as soon as it does.
: No. Access stays read-only. Guided remediation shows the exact fix as console steps, CLI commands or Terraform, and your team decides when to apply it or sends it to Jira as a ticket.
: Only configuration metadata: resources, permissions and network settings. Boundary never reads the contents of your files, databases or storage buckets. Everything is encrypted in transit and at rest.
: AWS, Azure, Google Cloud and Kubernetes. Alerts go to Slack, Microsoft Teams, Jira and PagerDuty, and you can sign in with Okta, Auth0 or Google.
: You get 14 days of the Professional plan with every feature switched on. No credit card is needed, and your scan results stay in your account if you subscribe.
: Yes. Upgrade whenever you add accounts or resources, and the new limits apply straight away. You can cancel before your next billing date without talking to sales.