Technology Engine
Cloud posture rules judge the cloud's configuration — is the bucket public, is the database encrypted. The Technology Engine goes one layer deeper: given that a PostgreSQL 12 instance is running on that host, is the version supported, are its defaults hardened, and does it reach end of life next quarter?
Coverage: 34 CIS technology benchmarks
Thirty-four benchmarks across nine families. These are named products, not vague categories:
| Family | Technologies |
|---|---|
| Databases | PostgreSQL, MySQL, MariaDB, MongoDB, Cassandra, Oracle DB, SQL Server, IBM Db2 |
| Operating systems | RHEL, Ubuntu, Debian, CentOS, SUSE |
| Web & app servers | Nginx, Apache HTTP, IIS, Tomcat, WebSphere |
| Containers & virtualisation | Docker, VMware ESXi |
| Network appliances | Cisco ASA, Cisco IOS XE, Cisco IOS XR, Cisco NX-OS, Palo Alto, FortiGate, Check Point |
| SaaS & DevOps | Microsoft 365, SharePoint, Google Workspace, Dynamics 365, Snowflake, GitLab |
Together these carry 8,991 technology control rows.
How detection works
Detection is agentless. The engine identifies running technology through cloud metadata, container image inspection and read-only process metadata — the same integrations that power the rest of the platform.
- Enumerate what is actually running, rather than what was formally provisioned.
- Match each detected technology and version to its CIS benchmark.
- Evaluate the benchmark's controls against the running configuration.
- Join the result to the identity, network and vulnerability graph.
Why the graph join matters
An unhardened database on an isolated subnet and one behind a public load balancer fail the same controls and are not the same problem. Because technology findings land on the same graph as everything else, each one carries whether the workload is internet-reachable and what identity it holds — which is what separates the two.
Shadow IT
By enumerating what runs rather than what was provisioned, the engine surfaces workloads that appear in no CMDB, no Terraform module and no ownership record. Those receive owner-suggestion signals from tags, IAM and network neighbours.
Collection method
Controls are marked by how they are collected — via API, or requiring an agent. Controls that can only be evaluated at the host level, and hardware-level controls that no remote collector can reach, are classified as manual rather than being reported as passing. A control that cannot be checked is never scored as if it were.
Related: CSPM covers the cloud's own configuration; the Technology Engine covers what runs on top of it. Most estates need both.