moizuqaili
All work
Enterprise SaaSAI & Agentic Systems

Cygnus Cloud

Zero trust security posture graph

Platform
Web app
Built for
Security engineers
What I delivered
Attack path graph, triage flows
Tools
Figma, D3 prototypes
01

Executive summary

An interactive identity and resource graph that shows security teams attack paths instead of alert lists.

↓0%

Triage time

Verified post-launch

0x

Fixes per week

Verified post-launch

Series B

Raised post launch

Verified post-launch

02

The problem

SOC analysts triaged 2k findings a week with no sense of which ones chained into real risk.

03

Research insights

  1. 1Analysts think in paths, not findings.
  2. 2Executives need one number.
  3. 3Fix ownership was the real bottleneck.
04

Constraints

Graphs of 100k+ nodesLeast privilege viewsDense data, calm UI
05

Interactive prototype

This is the real cloud security console. Check the posture score, simulate an attacker reaching customer data, then apply the suggested fixes and watch attack paths close and the score rise.

Cygnus
Scanning 3 AWS accounts · 4,812 resourcesNorthwind · prod

Posture score

42of 100

At risk

8 open findings

4 paths to crown jewels

Last 13 weeks

Open by severity

Compliance

CIS210/214 · 98.1%
SOC 290/96 · 93.8%
ISO 27001111/114 · 97.4%

Findings · ranked by exploitability, not just severity

SeverityFindingResourceAccountAge
CriticalSSH open to the internetCYG-1042 · CIS 5.2 · on attack pathsg-0a91f3 · web-01prod-eu3d
CriticalBucket with customer PII is publicly readableCYG-1038 · CIS 2.1.5 · on attack paths3://nw-customer-exportsprod-eu11d
HighregreSSHion CVE 2024 6387 on internet facing hostCYG-1031 · CVE · EPSS 0.94 · on attack pathi-07c2 · web-01prod-eu6d
HighInstance role can read every S3 bucketCYG-1027 · Least privilege · on attack pathrole/web-appprod-eu24d
HighLambda function URL has no authenticationCYG-1019 · Exposure · on attack pathfn/etl-triggerdata2d
MediumETL role can read all Secrets Manager secretsCYG-1011 · Least privilege · on attack pathrole/etl-runnerdata40d
MediumMFA not enforced for 3 console usersCYG-0998 · CIS 1.10iam/usersroot org57d
LowCloudTrail log file validation disabledCYG-0974 · CIS 3.2trail/org-mainroot org90d

1 · Posture

A live score, severity breakdown and compliance coverage. Filter findings and hover any row to jump to its attack path or straight to the fix.

2 · Attack paths

See how an attacker gets from the internet to your customer data. Simulate the breach hop by hop, inspect each node, and find the one fix that breaks the most paths.

3 · Remediation

Every finding comes with a ready code change, its blast radius and impact. Open a pull request or apply directly, watch the pipeline run, and see the path and score update.

06

Solution walkthrough

01

Attack path graph

Focus+context graph highlights the shortest route to crown jewels.

02

Posture score

A single explainable score for leadership.

03

Auto routing fixes

Findings assigned to owners via code ownership data.

Next case study

Kite Commerce