Begins from a simulated compromised container or credential and tests how far an attacker can escalate from there.

Chains cloud IAM misconfigurations the same way a real attacker would, to reach a privilege the environment never intended to grant.

Tests whether a compromised container can escape to the underlying node or move laterally across the cluster.

Targets managed cloud services — storage, functions, secrets managers — for the misconfigurations that don't show up in a generic network scan.