Compare
One product for cloud security and AI security: attack paths across both, fixes as pull requests in your IaC code, and blocks for risky AI agent actions.
One product and one price. No per-seat charges, no per-resource metering.
Security Hub
Keep it on. Here is what Netlumi adds, point by point.
Security Hub collects findings about your AWS accounts, and its automated response changes the live resource. When the resource is defined in IaC code, the next deploy puts the old setting back. Netlumi traces the finding to the file and line that created the resource and opens a pull request with the fix. You review and merge, and your pipeline applies it.
Netlumi shows the attack paths to your data that are real in your account. It marks an issue critical or high only when the evidence shows it matters in your account, and names that evidence. Everything else is medium, low or posture.
Netlumi shows what each Amazon Bedrock agent can read, change or delete, tells you which data you could not get back, and what to do first. An optional gate (Business and Enterprise plans) can stop an agent action that would destroy data you cannot restore. Decoys tell you within minutes if an agent is being steered by something it read.
The same findings, attack paths and fix pull requests for Azure and Google Cloud, and checks on your repositories: secrets, Dockerfiles, AI usage and MCP configuration, with cloud findings traced to the IaC code that created them.
Keep Security Hub on. Netlumi reads your GuardDuty findings alongside its own rules, and shows whether Security Hub and its standards are enabled in each account as part of your posture.
The worked example: a Bedrock agent, a planted document, a customers table
Price
Teams otherwise buy a cloud posture tool, an AI security tool and a fix workflow separately, and pay for each. Netlumi is one subscription: €0 / €229 / €499 / €999 / €2,300 a month for the Developer, Starter, Growth, Business, Enterprise plans (Enterprise billed annually), with unlimited users. A team with 20 or more cloud accounts is the Business plan, €999 a month for up to 25 accounts, so nobody has to guess what the Starter price covers.
Kinds of tool
Findings for one cloud, from the provider. Automated response changes the live resource; the next deploy from your IaC code can put the problem back.
Netlumi: Netlumi finds the IaC code that created the resource and opens the pull request that fixes it, for AWS, Azure and Google Cloud. Drift detection shows when a live resource stops matching its code.
Free checks you run yourself. A list of findings, with no fix and no view of how they chain together.
Netlumi: Netlumi writes the fix as a pull request, checked before you see it and never applied for you, and shows the attack paths the findings form. The free scan of a public repository needs no sign-up.
Broad coverage, priced for large estates, usually through a sales process and an annual contract.
Netlumi: Self-serve plans from free. Starter ($249 a month) covers up to 3 cloud accounts with unlimited users, billed monthly with no annual commitment, or yearly for less. No per-seat and no per-resource charges.
Side by side
What Netlumi is: Cloud security (CSPM) · AI agent security · Attack paths across cloud and AI · Fixes as pull requests · Blocks for risky agent actions.
| Capability | Native cloud security services | Open-source scanners | Large platforms | Netlumi |
|---|---|---|---|---|
| Code-level fix pull requests | Changes the live resource | Alerts, no fix | Varies | Yes: a pull request in your IaC code, checked, never merged for you |
| AI agent attack paths | Varies | No | Varies | Yes: from untrusted input through a Bedrock agent and its tools to your data, with what is confirmed in your account |
| Runtime gate for agent actions | Varies | No | Varies | Yes: stops an action that would destroy data you cannot restore (Business and Enterprise, optional) |
| Decoys | Varies | Varies | Varies | Yes: tell you within minutes if an agent is being steered by something it read |
| Noise model | Severity per finding | Severity per finding | Varies | Critical and high only when the evidence shows the issue matters in your account |
| Free scan with no signup | No | You run it yourself | Varies | Yes: a public repository, no sign-up |
“Varies” means it depends on the tool. The Netlumi column is what the product does today; see sample output and trust and data handling.
Read-only access. Nothing to install.