Posture
Nobody told Atlex what you run. It went and looked. Including the parts nobody wrote down.
checkout-apiRepository
deploy-prodPipeline
checkoutECS service
orders-syncLambda
orders-dbRDS
discover · source · lifecycle
what is Atlex?
OrganizationAtlex
IntroducingThe scientific method
for shipping software.
Read-only access to your cloud and code. Atlex maps everything you run, then finds what is wrong with it.
Free for 14 days. No card, and nothing to install.
Nobody has the whole picture
Cloud here, code there, tickets somewhere else.
Atlex joins them up
A repo to the service it ships. A ticket to the deploy that shipped it.
Then it finds what is wrong
Outages, exposed dependencies, drifted controls, risky pull requests.
SREPlatformDevOpsSecurityEngineering leadership
Scroll to explore
Atlex alertcheckout service is throwing 5xxcheckout is unhealthy
checkout-alb
deploy-production
PR #1482 merged
PAY-318
Suppose something breaks
Atlex is already looking
Further back than the alarm said
Across tools that cannot see each other
From the alarm to the commit
Checkout starts throwing 5xx. Before anyone opens a laptop, Atlex has followed the edges back to the change that caused it.
Nobody asks Atlex to do any of this. The incident opens itself, the risk is already ranked, the control was checked this morning, the pull request gets read before it lands.
Reachability risk
400 CVEs. Three can hurt you. Atlex knows which. Everything else is noise, and it says so.
orders-dbthe thing at risk
checkoutwrites on every order
orders-webhookwrites on every event
reports-rendererreads nightlyOther cloud
What can reach orders-db?
Two of the three sit behind a public load balancer.
OSV · blast radius · lifecycle
Code review
Most reviewers read the code. This one has seen it run. It catches what a diff can't show you.
src/http/client.tsHigh
39 export function makeClient(o) {
40- const opts = merge({}, o);
40+ for (const k of keys(o)) {
41+ if (BLOCKED.has(k)) throw
42+ }
43 return axios.create(opts);
Deploys to
checkout
Environment
production · public
Depended on by
6 services
Right now
open incident
Ranked
#1 of 47 findings
This one pull request pulled in the top of the list.
diff + graph, before merge
Trace
The last postmortem your team pieces together from Slack. Atlex hands you the cause. Cited, not guessed.
- 02:00checkout unhealthy5xx 12% · threshold 2%
- 01:58traffic still arrivingtarget group healthy
- 01:46deploy-production ran14 min before the alarm
- 01:44PR #1482 mergedretry budget for orders-dbMost likely cause
- yest.PAY-318payments board
One merge, sixteen minutes before the alarm.
graph + config history + deploys
Security
Same rules, same facts, same findings. Every single run. A clean result is evidence, not a screenshot.
.env.productionrepo · api
8NODE_ENV=production
9DATABASE_URL=••••••••••••
10REDIS_URL=••••••••••
11AWS_SECRET_KEY=••••••••••••••AKIA4F2K9QJ7XB
12STRIPE_KEY=••••••••••••
13SENTRY_DSN=••••••••••
14JWT_SIGNING_KEY=••••••••
Secret in sourceline 11 · value never stored
Found in the file, and never kept.
cloud config · deps · secrets
Compliance
The audit prepares itself. Every finding is already tagged to the control it satisfies.
PCI · CIS · point-in-time
QA
A tester that wants your code to fail. It probes every change like an adversary would.
app.acme.com/checkout
Cart0 items
Total$0.00
Delivery$0.00
Place order
QA bugs0 open
QA-118500 · POST /api/orders
It clicked the thing nobody tests, and filed what happened.
coming soon
First principles
Worked out from the job each figure replaces: the tracing, the catalog, the triage, the setup.
- 67min
- saved per incident
- 0hrs
- maintaining a catalog
- 70%
- of findings deprioritised
- 10min
- to your first graph
Meet 
Atlex AI
It answers from your graph, not from a model. Ask what broke, what changed, or what you are running - in your own words.
atlas.com/ask
Ask from the app, or from Slack without leaving the channel.
Grounded in your estate
It answers from the resources, deploys and repositories Atlex has actually read - so it can follow a dependency six hops out and still be talking about your system.
Cited, every claim
Each statement carries a link to the exact node it came from. Checking its work is one click, not a leap of faith.
Honest about the gaps
When your data doesn’t support an answer, it says so and names what it couldn’t see - rather than producing something plausible.
It can read everything.
It can change nothing.
One read-only role, and nothing to run. The credentials Atlex holds cannot express a write, so there is no code path in the product that could make one, and the worst a bug can do is show you something wrong.