The Security Graph
Model relationships between workloads, identities, network paths, and data stores to expose reachable attack paths — not just isolated findings.
Open source · Cloud-native · Graph-first
The open cloud security graph for teams who need context, not noise
OpenSourceOM connects assets, identities, and exposures into a living security graph — surfacing attack paths and the vulnerabilities that actually put your data at risk.
- Graph-native risk context
- Multi-cloud AWS · Azure · GCP
- Apache-2.0 open source
Cloud security built around context
Traditional scanners flood you with alerts. OpenSourceOM connects the dots — showing which vulnerabilities sit on paths to sensitive data and privileged access.
Risk that ranks itself
Prioritize CVEs and misconfigurations by reachability, path to data, and admin access — so your team fixes what attackers can actually reach first.
Multi-cloud inventory
Normalize assets across AWS, Azure, GCP, and Kubernetes with a unified graph schema. Add collectors of your own with the plugin SDK.
Policy-as-code CSPM
Check configurations against CIS, PCI, and custom guardrails. Map failed controls to graph nodes so remediation has context, not just ticket IDs.
Self-hosted & auditable
Run OpenSourceOM in your VPC. No black-box scoring — inspect the graph, rules, and enrichment pipelines in plain code.
Exports and plugins
Push prioritized findings to Jira, Slack, or SIEM. Tie CVE data to workload inventory and extend ingest with collector plugins.
The graph of vulns that matter to you
Inspired by graph-native CNAPP platforms, OpenSourceOM builds a queryable model of your environment. Ask questions like “Which critical CVEs are internet-exposed and can reach production databases?” — and get an answer in seconds.
- Attack path analysis — trace lateral movement from ingress to crown jewels.
- Identity blast radius — see what a compromised role can actually access.
- Exposure-aware prioritization — deprioritize findings with no reachable path.
Query
reachable(critical_cve) → datastore(prod) CVE-2024-1234 · OpenSSL
S3 bucket policy · Public list
IAM user · Unused access key
From alert fatigue to attack-path clarity
CNAPP platforms proved that context beats volume. OpenSourceOM brings graph-native security to teams that want transparency, control, and community-driven innovation.
Traditional scanning OpenSourceOM
Risk context Flat lists of CVEs and misconfigurations Graph paths from exposure to sensitive assets
Prioritization CVSS score and severity alone Reachability, path to data, and admin access
Deployment Vendor SaaS only Self-hosted in your cloud, auditable code
Extensibility Closed integrations Collector plugins and policy-as-code
Early stage · Community-driven
Your support shapes what we build next
OpenSourceOM is just getting started. Community momentum — stars, feedback, and word of mouth — directly influences how fast we ship and what we prioritize. Here is how you can help today.
-
Star the core repo
A GitHub star is a small action with real impact — it helps others discover the project and signals that open cloud security deserves more attention.
Star on GitHub -
Shape the roadmap
Open issues for feature requests, bugs, or ideas. Upvote discussions that matter to you so we know what the community needs most.
Browse issues -
Spread the word
Visibility is the biggest lever right now. Write about OpenSourceOM on Reddit, Hacker News, X/Twitter, LinkedIn, or wherever your cloud security peers hang out.
-
Community channels (coming soon)
We plan to launch Slack and Discord spaces for contributors and early adopters. Watch this site and the GitHub repo for announcements.
Coming soon
The more support we get, the harder we push this project forward. Thank you for being here this early.