Coming soonKultarr is getting ready to launch.

Kultarr.
See pricing
Kultarr.
See pricing

Cloud security SaaSFor AWSComing soon

Understand what’s happening in your cloud.

Kultarr is a cloud security SaaS platform that helps AWS teams investigate infrastructure changes, understand security events and find risks from one web dashboard: who made each change in CloudTrail, which IAM permission allowed it, what it exposed, and how to fix it at the source.

See how it worksPricing: $99/month

Web application · Monthly subscription · Read-only AWS role · Nothing to install

What you get

Kultarr is software as a service, delivered entirely online.

Software in your browser
Kultarr is a web application. You sign in to your workspace dashboard from any modern browser; there is nothing to install and no agent to run.
Automated analysis of your AWS accounts
The software reads your AWS configuration and CloudTrail activity through a read-only IAM role you create, and builds the investigations, findings and timelines for you.
A recurring software subscription
Your subscription is access to the Kultarr software for your workspace, billed monthly. Updates to the software are included.
Not a consulting or managed service
Kultarr does not include consultants, a managed security service or analysts watching your accounts. Your team uses the software and decides what to change.

A change, explained

Something changed.
Kultarr explains why.

A security group on a production API started accepting SSH from the whole internet. Instead of one more alert, Kultarr shows the identity behind it, the permission that allowed it, what it exposed and the fix that will hold.

InvestigationsPublic SSH on prod-apiExample

Related events

  1. 14:31:48AssumeRoleterraform-deploy, session ci-run-8812
  2. 14:32:07AuthorizeSecurityGroupIngressprod-api, tcp/22 from 0.0.0.0/0
  3. 14:38:40Security Hub EC2.13Failed on prod-api
  4. 14:52:15GuardDuty port probetcp/22 probed from 198.51.100.77

4 signals · 1 case

Investigation

Example investigation. The account, names, addresses and identifiers are illustrative.

Before 14:32:07

prod-api inbound rules

  • HTTPS4430.0.0.0/0
  • PostgreSQL543210.20.0.0/16

After

One rule added by terraform-deploy

  • HTTPS4430.0.0.0/0
  • PostgreSQL543210.20.0.0/16
  • SSH220.0.0.0/0

Why it matters

Critical

Two instances behind this group have public addresses and a route to the internet. Within twenty minutes GuardDuty saw port 22 being probed.

Example investigation. The account, names, addresses and identifiers are illustrative.

The problem

The answer exists. It is spread across six places.

When a security group opens, a role gains a policy or a finding appears, the evidence is already in your AWS account. It sits in different consoles, in different formats, and each one answers only part of the question.

Teams without a dedicated cloud security function end up rebuilding the same timeline by hand, in the middle of an incident. Kultarr reads these sources together and keeps the connections between them.

  1. CloudTrailEvent history

    "eventName": "AuthorizeSecurityGroupIngress",
"sourceIPAddress": "203.0.113.24"

    Records the call, not whether it should have happened.

  2. IAMPolicies

    "Sid": "ManageSecurityGroups",
"Action": "ec2:*SecurityGroup*"

    Lists what the role may do, not which statement allowed this call.

  3. EC2Security groups

    prod-apiSSH220.0.0.0/0

    Shows the rule as it is now, not what it was before.

  4. Security HubFindings

    CriticalEC2.13Port 22 open to 0.0.0.0/0

    Flags the result, not the change or the person behind it.

  5. Terraformnetwork/security-groups.tf

    42  cidr_blocks = ["0.0.0.0/0"]

    Holds the intent, not what is running in the account.

  6. Incident channelMessages

    “Did anyone open 22 on prod-api? Was that the pipeline?”

    Has the context, spread across a hundred replies.

One investigation in KultarrSix sources, joined by the resource, the identity and the time.

Investigation

An investigation,
not another alert.

Alert dashboards tell you that something happened. Kultarr works the evidence the way an engineer would, and keeps each step so the next person can check it.

  1. 01Change investigation

    See exactly what changed

    Kultarr turns each CloudTrail management event into a readable change: the resource, the configuration before and after, the request, and the time it happened.

    ChangeCloudTrail
    Event
    AuthorizeSecurityGroupIngress
    Resource
    sg-0a41c2e7f3b9d8c16 (prod-api)
    Time
    2026-09-24 14:32:07 UTC
    Request ID
    4f8a2c1e-7b3d-4e9a…

    Inbound rules

    ChangeProtocolPortSource
    tcp4430.0.0.0/0
    tcp543210.20.0.0/16
    +tcp220.0.0.0/0

  2. 02Identity

    Know who made it, and how they got there

    Role sessions are followed back through the assume-role chain to the pipeline or person that started them, and each change is marked with its origin: approved automation, a manual change, or an out-of-band change to managed infrastructure.

    ActorApproved automation
    1. ci-run-8812Pipeline session, source identity
    2. terraform-deploysts:AssumeRole at 14:31:48
    3. AuthorizeSecurityGroupIngressCalled at 14:32:07 from 203.0.113.24

    Change origin

    terraform-deploy is the registered deployment role for this account. The same call made by a person in the console would be flagged as an out-of-band change.

    arn:aws:sts::111122223333:assumed-role/terraform-deploy/ci-run-8812

  3. 03Permissions

    See the permission that allowed it

    Kultarr evaluates the request the way AWS does, layer by layer: service control policies, permissions boundaries, session policies and identity policies, down to the statement that granted it.

    Why it was allowedAllowed

    ec2:AuthorizeSecurityGroupIngress on sg-0a41c2e7…

    1. Service control policyNo restriction
    2. Permissions boundaryNone attached
    3. Session policyNone
    4. Identity policyAllow
    // DeployNetworking
{
  "Sid": "ManageSecurityGroups",
  "Effect": "Allow",
  "Action": "ec2:*SecurityGroup*",
  "Resource": "*"
}

  4. 04Exposure and correlation

    Understand what it exposed

    The change is placed on the network path it affects, from the internet to the instances behind it. Findings from Security Hub and GuardDuty about the same resource join the same case instead of arriving as separate alerts.

    ExposureCritical
    1. 0.0.0.0/0Internet
    2. prod-apitcp/22 allowed
    3. subnet-public-aRoutes to igw-0e6a1d3c
    4. 2 instancesPublic IPv4 addresses

    Correlated into this case

    • Security HubEC2.13Failed
    • GuardDutyRecon:EC2/PortProbeUnprotectedPort
ChangeCloudTrail
Event
AuthorizeSecurityGroupIngress
Resource
sg-0a41c2e7f3b9d8c16 (prod-api)
Time
2026-09-24 14:32:07 UTC
Request ID
4f8a2c1e-7b3d-4e9a…

Inbound rules

ChangeProtocolPortSource
tcp4430.0.0.0/0
tcp543210.20.0.0/16
+tcp220.0.0.0/0

Example investigation. The account, names, addresses and identifiers are illustrative.

Timeline and correlation

Four tools noticed it. It is one case.

The role session, the change, the Security Hub finding and the GuardDuty probe are the same incident seen from four places. Kultarr joins them on the resource, the identity and the time, so the team works one case with one owner.

A case is closed when AWS says so. Marking it resolved and Kultarr confirming the condition is gone are recorded as two different things.

Case timelineExample
  1. Identity
    1. 14:31:48AssumeRoleterraform-deploy, session ci-run-8812
  2. Change
    1. 14:32:07AuthorizeSecurityGroupIngressprod-api, tcp/22 from 0.0.0.0/0
  3. Findings
    1. 14:38:40Security Hub EC2.13Failed on prod-api
  4. Threat
    1. 14:52:15GuardDuty port probetcp/22 probed from 198.51.100.77
  5. Response
    1. 15:06:12PR #214 openedProposed by Kultarr
    2. 15:41:30Verified resolvedRule gone from AWS
Case: Public SSH on prod-api6 events · owner @acme/platform · Verified resolved

Cloud visibility

Every part of the account,
in one picture.

Identity, storage, compute, network rules, the audit trail and the findings your AWS security services already produce, read together and kept connected, so a question about one of them can be answered with all of them.

  • IAM

    Users, roles, policies, access keys

    iam:AttachRolePolicydeploy-bot

  • S3

    Bucket policies and public access settings

    s3:PutBucketPolicyacme-exports

  • EC2

    Instances, interfaces, public addresses, routes

    ec2:AssociateAddressi-0c3f9a12…

Kultarr.

production

111122223333 · eu-west-1

  • Read-only roleConnected
  • Agents installedNone

  • Security groups

    Inbound and outbound rules

    ec2:AuthorizeSecurityGroupIngressprod-api

  • CloudTrail

    Trails and management events

    cloudtrail:StopLoggingmanagement-events

  • Configuration findings

    Security Hub, including AWS Config and Access Analyzer

    EC2.13 failedprod-api

Example account. Event names are real AWS API calls; resource names are illustrative.

Identity and IAM

See who can access what, and through which statement.

Kultarr maps users, roles and policies to the resources they can reach, after service control policies and permissions boundaries are applied. Each edge names the statement that grants it.

It also finds the indirect routes: a role anyone in a group can assume, or a function whose code a developer can replace while it runs with more access than they have.

Access mapExample

What alice can reach

  • Privilege pathsts:AssumeRole on admin-breakglassGranted by DeveloperAccess › AssumeSupportRolesRole assumption chain
  • Privilege pathlambda:UpdateFunctionCode on orders-apiGranted by DeveloperAccess › DeployFunctionsLambda code modification
  • Reads3:ListBucket on acme-tf-stateGranted by DeveloperAccess › ReadState

Exposure

Find risky configuration, ranked by what it actually exposes.

A port open to the internet matters when something behind it is reachable. Kultarr follows security group rules, public addresses and routes to the internet, and reads IAM for stale keys and broad grants, so a finding arrives with its path and a next step.

Findings from Security Hub, including those from GuardDuty, AWS Config and IAM Access Analyzer where you use them, are matched to the same resources.

FindingsExample

Why it matters

  1. 0.0.0.0/0Internet
  2. prod-apiSecurity group, tcp/22
  3. 2 EC2 instancesPublic IPv4, route to internet gateway

Reachable from any address, on instances that hold a public IP in a subnet that routes to the internet.

Next stepRemove the rule in Terraform through a reviewed pull request.

Understand before you fix

The right fix depends on how the change happened.

Closing the port in the console looks like the answer. Here it is the wrong one: the rule lives in Terraform, and the next deploy would open it again. Kultarr connects the evidence first, then recommends the change that will hold.

Evidence first
Every recommendation lists the facts it rests on, so a reviewer can check them.
Fix at the source
Managed resources are fixed in their code, so the fix survives the next deploy.
Confirmed in AWS
A case is resolved when Kultarr re-reads the account, not when a ticket closes.
RemediationExample

Evidence

  1. ChangeAuthorizeSecurityGroupIngress
  2. Actorterraform-deploy, approved automation
  3. PermissionDeployNetworking › ManageSecurityGroups
  4. ExposureSSH from the internet to 2 instances
  5. Source of truthnetwork/security-groups.tf:42

Recommended action

  • Infrastructure-code changeRecommendedRemove the rule where it is defined. Reviewed and merged by your team.
  • Direct AWS changeNot recommendedThe next terraform apply would put the rule back.
  • Advisory onlyRecord the finding and an owner, change nothing yet.

acme/infrastructure · network/security-groups.tf

36    vpc_id = aws_vpc.prod.id37  38-   ingress {39-     description = "Temporary SSH"40-     from_port   = 2241-     to_port     = 2242-     cidr_blocks = ["0.0.0.0/0"]43-   }
Your team reviews and merges. Kultarr then verifies AWS.

Example investigation. The account, names, addresses and identifiers are illustrative.

AWS integration

One read-only role per account. No agents.

Kultarr connects through a cross-account IAM role that you create and control. Connect as many accounts as you run; each has its own role and external ID, so revoking one does not touch the others.

  1. Deploy the role

    Kultarr generates a CloudFormation template for your account. Review every statement before you create the stack, or create the role yourself from the JSON or Terraform shown.

  2. Kultarr verifies it

    Kultarr assumes the role through AWS STS with an external ID unique to the connection, then checks that each permission works before the account is marked connected.

  3. Collection begins

    Configuration and change history are read with short-lived credentials. There is no agent to install and nothing runs inside your account.

  4. See the security model

Your AWS accounts

  • KultarrMonitoringRoleExternalId
  • KultarrMonitoringRoleExternalId
  • KultarrMonitoringRoleExternalId

Kultarr reads

  • CloudTrailManagement events
  • IAMUsers, roles, policies, keys
  • EC2 and VPCSecurity groups, interfaces, routes
  • S3Bucket configuration
  • Security HubGuardDuty, Config, Access Analyzer findings
  • OrganizationsService control policies, optional
# Policy KultarrReadOnly, as generated
- Sid: KultarrRead            Effect: Allow
- Sid: NeverMutate            Effect: Deny
- Sid: NeverReadDataContents  Effect: Deny
Account names and IDs are illustrative. Statement IDs are the ones the generated template contains.

Security model

A tool that investigates your cloud should need less access than your engineers.

What Kultarr can do in your account is written in the IAM policy it asks you to deploy, and checked in code, not promised in copy.

Read-only monitoring
Every action the monitoring role grants is a read. The template generator refuses to produce one containing an action that can change your account.
No access to your data
Configuration and metadata only. The role explicitly denies reading object contents, secrets, parameters, database items and decrypted data.
Changes need a person
Kultarr does not change your AWS accounts. It recommends the fix, and where you connect a repository it opens a pull request that your team reviews and merges.
Isolated workspaces
Each workspace is separated in the database by row-level security. Role connections use short-lived STS credentials; stored secrets are encrypted.

NeverReadDataContentsDeny

Explicitly denied to the monitoring role. An explicit deny outranks any allow, including one added later by mistake.

  • s3:GetObject
  • s3:GetObjectVersion
  • secretsmanager:GetSecretValue
  • ssm:GetParameter
  • ssm:GetParameters
  • ssm:GetParametersByPath
  • kms:Decrypt
  • dynamodb:GetItem
  • dynamodb:Query
  • dynamodb:Scan
  • dynamodb:BatchGetItem
  • rds-data:ExecuteStatement
  • rds-data:BatchExecuteStatement
  • rds:DownloadDBLogFilePortion
  • lambda:GetFunction
  • ecr:BatchGetImage
  • ecr:GetDownloadUrlForLayer

Optional remediation role

Documented, not used today: Kultarr does not currently make changes in AWS, and you do not need to deploy it. Its only action, limited to resources you tag:

  • ec2:RevokeSecurityGroupIngress

Pricing

One subscription. The whole product.

Kultarr is sold as a monthly software subscription. One plan includes every capability: AWS change investigation, IAM permission analysis, exposure visibility and security context, in one web dashboard.

Kultarr

$99/month (USD), billed monthly

US dollars, plus applicable sales tax or VAT, calculated at checkout.

Investigate AWS security changes, understand what happened, and identify what needs attention.

Request access: email ofirbe@kultarr.io

Self-service sign-up is not open yet. Request access and we will reply by email.

Included

  • AWS change investigation
  • CloudTrail investigation
  • IAM permission analysis
  • Network exposure visibility
  • Security findings with evidence and context
  • Infrastructure inventory
  • Terraform drift visibility
  • Investigation timelines

Not yet available to buy. Kultarr is in early access and still in development. Paid subscriptions cannot be purchased yet: checkout through Paddle opens when payments are enabled, and nothing can be bought or charged before then. The price and terms on this page are the ones that will apply.

Billing

  • Billed monthly in advance, in US dollars.
  • Renews automatically each month until you cancel.
  • Cancel from your workspace’s billing settings. Access continues until the end of the month you paid for.
  • Sales tax or VAT, where it applies, is calculated at checkout.
  • Sold through Paddle, our merchant of record, which handles payment, invoices and receipts.

Terms of ServiceRefund PolicyPrivacy Policy

The 3-day free trial

  • No payment details are needed to start.
  • The 3 days start when your first AWS account connection is verified, not at sign-up.
  • Nothing is charged when the trial ends. To keep using Kultarr, you subscribe through checkout.
  • One trial per workspace.

How the 3-day trial works

  1. Create your account

    Sign up for the Kultarr web application. No credit card.

  2. Connect AWS

    Create the read-only IAM role. Your 3 days start when it is verified.

  3. Investigate

    See what changed, who changed it, what it exposed and how to fix it.

Read-only AWS accessNo credit card for the trialNo automatic chargeCancel a subscription anytime

Common questions

Kultarr, in plain answers.

What is Kultarr?

Kultarr is a cloud security software-as-a-service (SaaS) platform for Amazon Web Services (AWS). You use it through a web dashboard in your browser, and it is sold as a monthly subscription. It investigates changes in AWS accounts: it connects each CloudTrail event to the identity that made it, the IAM permission that allowed it and what the change exposed, and recommends a fix at the source.

What a subscription includes

Is Kultarr software or a consulting service?

Software. Kultarr is a hosted web application that analyses your AWS accounts automatically through a read-only IAM role. A subscription gives your workspace access to that software. It does not include consultants, a managed security service or people monitoring your accounts; your team uses the dashboard and decides what to change.

What does Kultarr investigate in AWS?

Changes recorded as CloudTrail management events; IAM users, roles and policies, including role-assumption chains and indirect privilege paths; network exposure through security groups, public addresses and routes; S3 bucket configuration; and findings from AWS Security Hub, Amazon GuardDuty, AWS Config and IAM Access Analyzer where you use them.

What Kultarr reads

What does “change investigation” mean?

Taking one change in an AWS account and answering seven questions about it: who made it, what changed, when, where, which policy allowed it, what it exposed and what to do next. Kultarr keeps the evidence behind each answer so another engineer can check it.

The four investigation steps

How is Kultarr different from an alerting tool?

An alert says that something happened. Kultarr joins the CloudTrail event, the identity, the permission, the exposure and related Security Hub and GuardDuty findings into one case, and treats a case as resolved only when it re-reads the account and the condition is gone.

Who is Kultarr for, and which clouds does it support?

Businesses that run workloads on AWS, particularly engineering and platform teams without a dedicated cloud security function. Kultarr is offered to businesses and professionals, not consumers, and currently focuses on Amazon Web Services.

Does Kultarr make changes to my AWS accounts?

No. Kultarr connects through a read-only IAM role that you create, which also explicitly denies reading data contents such as S3 objects and secrets. It does not currently make changes in AWS accounts: it explains the recommended fix and, where you connect a repository, can open a pull request for your team to review and merge.

The security model

Can I sign up today?

Self-service sign-up is not open yet. To request access, email ofirbe@kultarr.io. When sign-up opens, the 3-day free trial and the monthly subscription described on this page apply.

How much does Kultarr cost?

One plan, $99 (USD) per month, with every capability included. It is billed monthly in advance and renews automatically until you cancel. Payment is processed by Paddle, our merchant of record, which also calculates any sales tax or VAT at checkout.

Pricing and billing

How does the free trial work?

The trial lasts 3 days and needs no payment details. It starts when your first AWS account connection is verified, so setup does not use it up. Nothing is charged when it ends: product access is restricted until you choose to subscribe through checkout. There is one trial per workspace.

How do I cancel, and can I get a refund?

Cancel from your workspace’s billing settings at any time. Cancelling stops future renewals, and access continues until the end of the month you have paid for. Refunds are handled by Paddle as merchant of record, as described in the Refund Policy, and your statutory consumer rights are not affected.

Refund Policy

Who operates Kultarr?

Kultarr is operated by Ofir Benav, an individual based in Israel, under the service name “Kultarr.”, which is not a separate legal entity. The Terms of Service and Privacy Policy give the operator’s details and contact address.

Terms of Service

Understand your AWS environment.

Kultarr is a web-based software subscription, $99 per month. Setup is one read-only IAM role per AWS account. Self-service sign-up is not open yet.

Request access: email ofirbe@kultarr.io

Accessibility options

Text size
Display

These options help with reading, but they are not how Kultarr. meets accessibility standards: the site itself is built for that. Read the Accessibility Statement.

Kultarr | AWS Security Investigation SaaS