> For the complete documentation index, see [llms.txt](https://help.pump.co/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.pump.co/pump-secure/how-pump-secure-works.md).

# How Pump Secure Works

Pump Secure continuously scans your AWS environment against industry-standard security and compliance frameworks. It surfaces misconfigurations, vulnerabilities, and compliance gaps, ranked by severity, so your team can prioritize what to fix first.

### What Pump Secure Does

Pump Secure runs automated checks across your AWS resources and maps the results to the compliance frameworks you select. Each check evaluates a specific security control (for example, "Ensure there are no publicly accessible RDS instances") and reports whether your resources pass or fail.

Results are organized into a dashboard that shows:

| Dashboard element  | What it shows                                                                                                        |
| ------------------ | -------------------------------------------------------------------------------------------------------------------- |
| Framework cards    | Each active framework displayed as a card with a pass/fail status and percentage score                               |
| Severity breakdown | A summary of all failed checks grouped by severity: Critical, High, Medium, Low                                      |
| Trend over time    | A stacked area chart showing how your total findings have changed over days and weeks                                |
| Findings table     | Every individual check with its name, failed count, passed count, severity level, and which frameworks it applies to |

### How Scanning Works

Pump Secure uses the PUMP\_SECURE IAM role deployed to your AWS account. This role grants read-only access to security-relevant AWS services, including EC2, RDS, S3, IAM, VPC, ECS, EKS, CloudTrail, SecurityHub, GuardDuty, and others.

Scans are non-intrusive. Pump never modifies your infrastructure, creates resources, or writes data to your account. The PUMP\_SECURE role includes the AWS-managed `SecurityAudit` policy plus a custom `PumpSecure` policy that covers additional read-only actions across services like Bedrock, ECR, EFS, Lambda, and API Gateway.

### Supported Cloud Providers

Pump Secure is currently available for AWS. GCP and Azure support is not yet available.

### What Pump Secure Is Not

Pump Secure runs compliance checks and configuration audits. It does not perform active penetration testing, network intrusion testing, or exploit simulation. The "Pump Pentest for AWS" framework option in the framework picker is a Pump-curated set of compliance checks, not an automated pentest.

### Key Concepts

**Framework.** A collection of security controls defined by an industry standard or regulatory body. Examples: AWS Well-Architected Framework, CIS Controls, HIPAA, SOC 2, ISO 27001. Pump Secure supports 39 frameworks. You choose which ones to activate.

**Check.** A single security control that evaluates one aspect of your AWS configuration. A check can map to multiple frameworks. For example, "Ensure no security groups allow ingress from 0.0.0.0/0 to MySQL port 3306" may appear under CIS, AWS Well-Architected, and MITRE ATT\&CK simultaneously.

**Finding.** The result of running a check against a specific resource. A finding is either passed or failed.

**Severity.** Each failed finding is classified as Critical, High, Medium, or Low based on the potential security impact.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://help.pump.co/pump-secure/how-pump-secure-works.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.