How Pump Secure Works
Pump Secure continuously scans your AWS environment against industry-standard security and compliance frameworks. It surfaces misconfigurations, vulnerabilities, and compliance gaps, ranked by severity, so your team can prioritize what to fix first.
What Pump Secure Does
Pump Secure runs automated checks across your AWS resources and maps the results to the compliance frameworks you select. Each check evaluates a specific security control (for example, "Ensure there are no publicly accessible RDS instances") and reports whether your resources pass or fail.
Results are organized into a dashboard that shows:
Framework cards
Each active framework displayed as a card with a pass/fail status and percentage score
Severity breakdown
A summary of all failed checks grouped by severity: Critical, High, Medium, Low
Trend over time
A stacked area chart showing how your total findings have changed over days and weeks
Findings table
Every individual check with its name, failed count, passed count, severity level, and which frameworks it applies to
How Scanning Works
Pump Secure uses the PUMP_SECURE IAM role deployed to your AWS account. This role grants read-only access to security-relevant AWS services, including EC2, RDS, S3, IAM, VPC, ECS, EKS, CloudTrail, SecurityHub, GuardDuty, and others.
Scans are non-intrusive. Pump never modifies your infrastructure, creates resources, or writes data to your account. The PUMP_SECURE role includes the AWS-managed SecurityAudit policy plus a custom PumpSecure policy that covers additional read-only actions across services like Bedrock, ECR, EFS, Lambda, and API Gateway.
Supported Cloud Providers
Pump Secure is currently available for AWS. GCP and Azure support is not yet available.
What Pump Secure Is Not
Pump Secure runs compliance checks and configuration audits. It does not perform active penetration testing, network intrusion testing, or exploit simulation. The "Pump Pentest for AWS" framework option in the framework picker is a Pump-curated set of compliance checks, not an automated pentest.
Key Concepts
Framework. A collection of security controls defined by an industry standard or regulatory body. Examples: AWS Well-Architected Framework, CIS Controls, HIPAA, SOC 2, ISO 27001. Pump Secure supports 39 frameworks. You choose which ones to activate.
Check. A single security control that evaluates one aspect of your AWS configuration. A check can map to multiple frameworks. For example, "Ensure no security groups allow ingress from 0.0.0.0/0 to MySQL port 3306" may appear under CIS, AWS Well-Architected, and MITRE ATT&CK simultaneously.
Finding. The result of running a check against a specific resource. A finding is either passed or failed.
Severity. Each failed finding is classified as Critical, High, Medium, or Low based on the potential security impact.
Last updated
Was this helpful?