Act's research team uncovered a cross-tenant security flaw in Amazon Athena that exposed recent SQL queries, Account IDs, and sensitive data from unrelated AWS accounts. By passing Catalog=system via an API parameter, queries bypassed standard validation to read shared logs directly from Trino's runtime table. We reported the issue to AWS, and they resolved it globally in four days with no action required on your end.

Access is the foundation of cloud security, and it is also the thing engineers dread touching. The documentation manages to be both overwhelming and insufficient, the AI models are confidently wrong, and questions that sound trivial turn into afternoons of work.

Act Security has acquired Cloud Copilot, its first deal just one month after emerging from stealth, and will use the AWS access-control technology to launch Amphi, a free, open-source toolkit for cloud engineers

Introducing Amphi: a suite of free, open-source tools built to take the guesswork out of managing cloud access policies. The Amphi was built on a simple belief: the tools for getting access right should be out in the open, ready for any engineer to pick up and use.

You can’t secure what you can’t see. AWS has dozens of policy types scattered across dozens of services, regions, and accounts. IAM Collect is built to find them all. Answer your questions, secure your accounts, and protect your data.

Say goodbye to trial-and-error deployments. Use IAM Test to evaluate your IAM policy logic entirely client-side, right before you deploy.

AWS just made managing access to S3 much more powerful, and a bit more complicated. S3 now supports attribute-based access control (ABAC) for general-purpose S3 buckets. With iam-lens, you can simulate and understand exactly how enabling ABAC on a bucket will affect access to a bucket before enabling it. Just add --s3-abac-override enabled to your simulate and who-can commands to see the effects of enabling ABAC on a bucket.

More than 500 practitioners sorted 23 cloud security problems by how much risk each one really creates. Access came out on top, vulnerabilities came out last, and AI is the reason those two moved in opposite directions.

Ancient Greece didn't get remembered for its scaffolding. It got remembered for its foundations. The columns, the proportions, the basic architectural principles that were so solid that people kept building on top of them for two thousand years. That's the idea behind Act, and it's also the thesis behind our investment.