Integrate Pulumi CrossGuard Policy with Vulnetix. Enforce security and compliance policies on Pulumi infrastructure deployments and export violation findings for Vulnetix.
How Vulnetix compares: better together
Vulnetix does not replace Pulumi Policy. Keep running it. Vulnetix sits on top of Pulumi Policy (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Pulumi Policy is strongest at its core category and also carries features in Cloud Security & CSPM, just as Vulnetix spans categories.
| Capability | Vulnetix | Pulumi Policy |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✗ |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✓ Core: CrossGuard Policy Packs enforce security/cost/tagging/compliance guardrails during pulumi preview and up |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ~ Audit mode continuously scans live infrastructure discovered via Insights (incl. non-Pulumi/manual resources) for violations: CSPM-adjacent, though tied to the Pulumi policy model |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ✗ |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Pulumi Policy does well
- Policy as code in full programming languages (TypeScript/JavaScript, Python) plus OPA/Rego, far more expressive than declarative-only policy engines
- Pre-built Compliance Ready Policy packs for CIS, NIST, PCI DSS and ISO 27001 across AWS/Azure/GCP/Kubernetes, usable without writing custom code
- Dual enforcement modes: preventative (blocks non-compliant pulumi preview/up) and audit (continuous scanning of all infrastructure, including non-Pulumi and manually-created resources, with a violations dashboard)
- Cross-IaC scope: evaluates resources managed by Pulumi, Terraform, CloudFormation, or created manually, centrally managed via Pulumi Cloud with versioning and CI/CD integration
Where Vulnetix adds to it: Pulumi CrossGuard is a strong IaC policy-as-code engine with real compliance-framework packs and a live audit mode, but its universe is infrastructure configuration. Vulnetix brings native code and supply-chain scanning (SAST, SCA across 40+ ecosystems, container, secrets, malware/package firewall, SBOM) that CrossGuard has no engine for, and ingests CrossGuard policy violations into one deduped, exploit-intel-prioritised queue with versioned VEX, autofix and SSVC, better together, Vulnetix sits above CrossGuard's IaC guardrails.
No migration, no rip-and-replace. Pulumi Policy keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Pulumi Policy results in Vulnetix
Upload Pulumi Policy JSON output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.