luiacuaniello/perspectivegraph

PerspectiveGraph joins what you already run - Trivy, Semgrep, Cloud Custodian, Falco, plus your
AWS and Kubernetes state - into one graph of your *real* environment, and asks a single question
of it: **can someone get from the internet, through privilege that is too broad, to something
worth stealing?**
On a pull request it asks that question **before the merge**: the check goes red only when *this
change* opens a route, and the fix comes back as its own pull request. Open source (Apache 2.0),
runs on your infrastructure, collects no telemetry.
*Twelve seconds of make demo: what is exploitable now → the ranked routes → one route's kill
chain and the fix it generates → whether the scores can be trusted. Sample scanner output and
seeded verdicts, not a real environment.*
- **See it running** - the same dashboard, published read-only. Nothing to install.
- **Read the documentation** - the manual, one page per subject, with search.
- **Check your own AWS account** - one read-only command, no deployment.
- **Put it on your pull requests** - ten lines of YAML.
A score here is what the model concludes from the evidence it was given, not a measured
frequency: **nothing has been calibrated against field data yet**, and the engine says so itself
rather than rounding up. What is measured, and what is not.
Check your own account in 30 seconds
No deployment, no Docker, nothing ingested. One static binary asks **AWS's own policy
evaluator** which of your roles can reach administrator - applying the service control
policies, permission boundaries and condition keys that a policy reader on its own does not
see:
It is **read-only and free**: each check is one iam:SimulatePrincipalPolicy dry run, which
creates nothing and costs nothing, and the only permissions it needs are that and
iam:ListRoles, both inside SecurityAudit. Windows builds are on the
releases page; every binary
is signed with cosign and carries SLSA provenance, and two commands
verify both before you run anything.
Add -compare and it also runs the engine over the same account, **exiting non-zero where the
two disagree**. That is how the engine's
first real false positive
was found, and how it stays fixed. If it disagrees on yours,
report it: no report is more useful. From here, how to evaluate this walks to a
verdict on your own estate in stages that each end in an answer.
See the whole engine in 90 seconds
Pulls the **published, cosign-signed images**, feeds them sample Trivy / Semgrep / Custodian /
Falco / Kubernetes / IAM / SSO output, and prints the top attack path with its generated fix.
Dashboard on **http://localhost:3000**, make down to tear it down. It needs Docker, jq and
curl, compiles nothing, and takes about 23 seconds from an empty image cache; make demo-build
is the same demo built from your working tree.
On Kubernetes, the chart is an
official package on Artifact Hub:
On one machine - a VM with Docker and a DNS name - one command sets up TLS, generated
credentials, an authenticated bus and daily backups, and starts it:
production on one machine.
The chart and the three images it runs (ghcr.io/luiacuaniello/perspectivegraph, -dashboard
and -postgres) are signed with cosign keyless and carry an SPDX SBOM and SLSA provenance:
verify them rather than taking the supply chain on trust.
The dashboard opens on the decision, not the inventory: what is being exploited now, the fewest
changes that remove the most risk, and how far the numbers can be trusted. Routes are ranked by
triage priority - what the route reaches, whether runtime confirmed it, how exposed the entry
is - so a lower-scoring route can outrank a higher-scoring one.
| | |
|---|---|
| | |
| Why the route is P1, one probability with its range, and every hop with what it lets the attacker do and where its probability came from. | Whether the engine's own scores held up against recorded outcomes - and whether there are enough of them to say. |