Skip to main content
Odin’s Cloud section scans your AWS, Azure, and GCP estate with Heimdall, Borg’s cloud scanner. It builds an inventory of your cloud resources, checks them against security rules, and tracks how your posture changes over time.
Cloud is enabled per organisation. If you don’t see a Cloud group in the sidebar, contact your account manager to have it turned on.
The section has four pages:
  • Overview: posture score, provider breakdown, account health, and the highest-severity findings
  • Accounts: connect cloud accounts and schedule their scans
  • Assets: the inventory of discovered resources
  • Settings: your own cloud security rules

​
Getting started

1

Connect an account

Open Cloud → Accounts and follow the connect wizard for AWS, Azure, or GCP. See Connecting cloud accounts.
2

Wait for the first scan

The overview shows a first scan running state until discovery completes. Resources then appear under Cloud → Assets.
3

Turn on CSPM scanning

Discovery builds the inventory; CSPM scans evaluate it against security rules. Add a CSPM schedule on the account, or run one on demand from the account’s actions menu.
Until you connect your first account the overview shows a prompt to do so instead of the posture cards.

​
Posture score

The headline card scores your estate out of 100, based on account health and how many assets are publicly exposed. Beside it are your total asset count and your publicly exposed asset count, which turns red as soon as it is above zero. Odin takes a snapshot of the score once a day. The badge next to the score is the change since the previous snapshot, and the sparkline covers the last 30 days.

​
Provider breakdown

One card per provider (AWS, Azure, and Google Cloud) with its account count, asset count, finding count, and critical finding count. A provider you haven’t connected is drawn with a dashed border.

​
Accounts status

A count of your accounts by connection status, so a degraded or errored connection is visible without opening the Accounts page. See account statuses for what each one means.

​
Risk trend

A 30-day chart of your posture score. It needs at least two daily snapshots before it renders, so expect it to be empty on your first day.

​
Critical findings

The highest-severity cloud findings across all your accounts, with a count of critical findings against the total. This stays empty until CSPM scanning runs, because discovery alone doesn’t produce findings.
Cloud findings are separate from the Findings page, which covers pentest, threat model, and imported findings. Cloud findings are shown here and on each asset’s detail page.

​
Billing

Cloud scanning consumes credits under the Cloud Review product. You can see the usage on the Usage chart and each individual deduction on the Ledger tab of the Billing page.