What's coming
Where CBX Guard is headed — real-time detection, guided remediation, and more providers.
What's coming
Coming soon. CBX Guard is announced and in active development. This page is a roadmap, not a commitment — scope and timing may change. Talk to us about early access.
CBX Guard launches focused on the highest-leverage moment in the infrastructure lifecycle: the pull request, on AWS. From there, the same Verdict Console grows along three lines.
Real-time detection
Today's gate runs at merge time. Next, CBX Guard listens to your cloud directly — resolving and judging changes as they actually happen, not only when they flow through a pull request. The same rubric, the same four tiers, applied to console clicks and out-of-band changes too — so a dangerous change made outside your IaC pipeline doesn't slip past the gate.
From verdict to remediation
Verdicts already tell you why a change is dangerous and how to fix it. The next step is to help you act on it — guided, least-privilege remediation suggested right alongside the verdict, so closing a finding is as fast as understanding it. Read-only-first still holds: nothing changes your infrastructure without an explicit, separate action you take.
More of your stack
- More clouds. AWS first, with additional providers to follow as the resolved-effect model extends to their resource graphs.
- More danger classes. The verdict rubric is built as one consistent framework across many classes of risk — network exposure, identity and privilege escalation, public data exposure, destructive change. Each comes online as its detection is proven against real accounts, held to the same precision bar before it's allowed to interrupt you.
Want to shape the roadmap or get early access? Get in touch — we'd love to put CBX Guard in front of your pull requests.