# Puonarch

*/Startups/Puonarch*

## Startup Overview

This security policy engine statically analyzes deployment configurations to catch and block toxic privilege combinations before they reach production. Engineering teams integrate the tool directly into their continuous integration workflows to parse infrastructure-as-code and cloud identity permissions. By evaluating these policies in the build phase, the system prevents critical access overlaps without waiting for post-deployment scans.

Cloud security teams constantly fight alert fatigue generated by runtime vulnerability scanners that flag issues only after infrastructure is live. Manual identity and access management audits fail to keep pace with high-velocity release cycles, allowing compound misconfigurations to slip through undetected. Managing complex identity networks by hand leaves critical environments exposed to lateral movement and privilege escalation.

Unlike reactive cloud security posture managers such as Wiz or Orca Security, this approach operates entirely as a pipeline-native check. The engine delivers fully deterministic risk assessments by evaluating the deployment policies themselves, eliminating the need to install runtime agents. By mathematically proving policy safety at the commit level, it halts dangerous infrastructure modifications before they execute.

## Startup Founding Hypothesis

**Approach**: that statically analyzes deployment policies for toxic privilege combinations
**Competitors**:
- [Wiz](/Competitors/Wiz)
- [Orca Security](/Competitors/Orca_Security)
- [manual IAM audits](/Competitors/manual_IAM_audits)
**Differentiator2x2**: pipeline-native and fully deterministic without requiring runtime agents

## Startup Solution Coordinate

**Solution**: [Privilege Scope Analyzer](/Software/Privilege_Scope_Analyzer)

## Startup Position2x2

```mermaid
quadrantChart
x-axis Post-Deployment Scan --> Pipeline-Native
y-axis Probabilistic / Manual --> Fully Deterministic
Wiz: [0.25, 0.45]
Orca Security: [0.35, 0.35]
Manual IAM audits: [0.55, 0.15]
Puonarch: [0.85, 0.85]
```

## Startup Brand

**Voice**: Clinical and uncompromising, focused purely on deterministic security outcomes.
**Tagline**: Block toxic cloud privileges before they deploy.
**Icon Concept**: Keycard
**Palette Intent**: electric-signal
**Visual Identity**: Stark high-contrast neon green against deep charcoal pairs with monospace typography to evoke a sterile, code-native command environment.
**Archetype Reference**: the-sage

## Startup Customer Journey

```mermaid
flowchart LR
A[GitHub Marketplace] --> B[Free CLI Scanner]
B --> C[Terraform Manifest]
C --> D[Automated PR Comment]
D --> E[CI/CD Pipeline Gate]
E --> F[Enterprise License]
F --> G[Platform Engineering Team]
```

## Startup Proof Points

_Illustrative — target and order-of-magnitude estimate figures, not an achieved track record (this Thing is concept-stage)._

**Pilot Goals**:
- 14-day shadow deployment in a staging environment alongside an existing CSPM tool. Target Outcome: Prove the platform flags and blocks 100% of toxic privilege combinations in the pipeline before the CSPM detects them as live vulnerabilities.
- 30-day active pipeline integration across 10 high-velocity repositories. Target Outcome: Demonstrate an average scan time of under three seconds per run with zero false-positive deployment blocks.
**Target Metrics**:
- Aim: 100% block rate of deterministic toxic privilege combinations before infrastructure-as-code is applied
- Target: Sub-3-second average scan time for standard infrastructure-as-code modules within CI/CD pipelines
- Target: Zero runtime agent overhead added to the production cloud environment
- Aim: 100% reduction in manual IAM audit hours for routine infrastructure pull requests
**Target Case Studies**:
- Target: Mid-market SaaS engineering team transitioning to complex cloud architectures. Goal: Document the transition from manual, week-long IAM security reviews to automated pull request comments that block toxic privilege combinations instantly, sustaining 50+ daily deployments.
- Target: Enterprise FinTech DevSecOps team managing hundreds of repositories. Goal: Validate the mapping of custom IAM policies against strict compliance frameworks, demonstrating a total elimination of post-deployment CSPM alerts related to misconfigured cloud roles.
- Target: Early-stage startup lacking a dedicated security engineer. Goal: Show how implementing baseline IAM guardrails directly in CI/CD pipelines prevents accidental over-permissioning during rapid infrastructure-as-code prototyping.
**Testimonial Targets**:
- Target Role: Lead DevSecOps Engineer. Target Sentiment: Emphasize that the deterministic graph analysis eliminates the false-positive noise typical of probabilistic static IAM analyzers, building immediate trust in the pipeline gate.
- Target Role: VP of Engineering. Target Sentiment: Validate that the scanner evaluates standard infrastructure-as-code modules without blocking developer velocity, catching misconfigurations before the CSPM has to alert on live vulnerabilities.
- Target Role: Cloud Infrastructure Architect. Target Sentiment: Confirm that the automated pull request comments effectively replace manual IAM audits and drastically reduce code review cycles.

## Startup Top Risks

**Risks**:
- Severity: existential · Description: Incumbent CNAPP platforms like Wiz or Orca release native deterministic pipeline scanners that eliminate the need for a standalone static analysis tool. · Mitigation Status: in-progress
- Severity: high · Description: Custom enterprise CI/CD workflows and proprietary infrastructure-as-code templates prevent plug-and-play integrations, severely stalling deployment timelines. · Mitigation Status: unmitigated
- Severity: moderate · Description: The absence of runtime context generates a high volume of theoretical privilege warnings that DevOps teams ultimately filter out or ignore. · Mitigation Status: in-progress
- Severity: low · Description: Constant syntax updates to Terraform, CloudFormation, and Kubernetes manifests require continuous engineering maintenance to keep the static analyzer from breaking. · Mitigation Status: mitigated

## Startup Competitors

- [Wiz](/Competitors/Wiz) — CNAPP Incumbent
- [Orca Security](/Competitors/Orca_Security) — Agentless CNAPP
- [Manual IAM Audits](/Competitors/Manual_IAM_Audits) — Status Quo
- [Prisma Cloud](/Competitors/Prisma_Cloud) — Incumbent Suite
- [Tenable Cloud Security](/Competitors/Tenable_Cloud_Security) — CIEM Specialist

## Startup Token Hero

**Genre**: founding-hypothesis
**Rendered**: Reactive cloud security costs DevSecOps teams constant alert fatigue and exposure. Puonarch blocks toxic privileges in the pipeline so infrastructure is secure before it deploys.
**Mechanism**: spine-derived-v1
**Template Id**: spine-founding-hypothesis
**Vocab Fingerprint**: f19a68760a0181ab

## Startup Token Positioning

**Genre**: moore-positioning
**Rendered**: Pipeline-native IAM security policy engine for DevSecOps leads at cloud-native organizations. Unlike Wiz or Orca Security — block toxic privilege combinations before they reach production.
**Mechanism**: spine-derived-v1
**Template Id**: spine-moore-positioning
**Vocab Fingerprint**: bfe0d9103c038296

## Startup Token Pitch Deck

**Genre**: pitch-deck
**Rendered**: Problem: Wiz and Orca Security flag identity vulnerabilities only after resources are live, forcing a cycle of post-deployment firefighting
Solution: Reactive cloud security costs DevSecOps teams constant alert fatigue and exposure. Puonarch blocks toxic privileges in the pipeline so infrastructure is secure before it deploys.
Customer: DevSecOps leads at cloud-native organizations
Unlike: Wiz or Orca Security
**Mechanism**: spine-derived-v1
**Template Id**: spine-pitch-deck
**Vocab Fingerprint**: efa98b509572171e

## Startup Token M E D D P I C C

**Pain**: Wiz and Orca Security flag identity vulnerabilities only after resources are live, forcing a cycle of post-deployment firefighting
**Metrics**: Target: Production environments remain locked down by default, with every deployment mathematically verified as safe before execution.
**Rendered**: Pain: Wiz and Orca Security flag identity vulnerabilities only after resources are live, forcing a cycle of post-deployment firefighting
Economic buyer: DevSecOps Engineer
Metrics: Target: Production environments remain locked down by default, with every deployment mathematically verified as safe before execution.
Competition: Wiz or Orca Security
**Mechanism**: spine-derived-v1
**Competition**: Wiz or Orca Security
**Economic Buyer**: DevSecOps Engineer
**Vocab Fingerprint**: f17698397bf7934e

## Startup Token Cold Email

**Genre**: cold-email
**Rendered**: Subject: Pipeline-native IAM security policy engine for DevSecOps leads at cloud-native organizations

DevSecOps leads at cloud-native organizations — Wiz and Orca Security flag identity vulnerabilities only after resources are live, forcing a cycle of post-deployment firefighting Reactive cloud security costs DevSecOps teams constant alert fatigue and exposure. Puonarch blocks toxic privileges in the pipeline so infrastructure is secure before it deploys.
**Mechanism**: spine-derived-v1
**Template Id**: spine-cold-email
**Vocab Fingerprint**: 9c7750ad5da4b84f

## Startup Token Agent Spec

**Genre**: ai-agent-spec
**Rendered**: Pipeline-native IAM security policy engine. Reactive cloud security costs DevSecOps teams constant alert fatigue and exposure. Puonarch blocks toxic privileges in the pipeline so infrastructure is secure before it deploys. Serves DevSecOps leads at cloud-native organizations.
**Mechanism**: spine-derived-v1
**Template Id**: spine-ai-agent-spec
**Vocab Fingerprint**: a0412824adf5370f

## Neighborhood

### Candidate solutions

- [Audit Evidence Gathering](/Problems/Audit_Evidence_Gathering) — candidate solution for · Problems

### What it offers

- [Privilege Scope Analyzer](/Software/Privilege_Scope_Analyzer) — offers · Software
- [Ledger Trace](/Services/Ledger_Trace) — offers · Services
- [Ledger Vouching Service](/Agents/Ledger_Vouching_Service) — offers · Agents
- [Evidence Fetch Agent](/Agents/Evidence_Fetch_Agent) — offers · Agents

### Composed of

- [Evidence Vouching Service](/Services/Evidence_Vouching_Service) — composes · Services
- [ERP Extraction API](/Software/ERP_Extraction_API) — composes · Software
- [Artifact Extraction Agent](/Agents/Artifact_Extraction_Agent) — composes · Agents
- [Ledger Matching Worker](/Agents/Ledger_Matching_Worker) — composes · Agents
- [Multimodal Vision Engine](/Software/Multimodal_Vision_Engine) — composes · Software
- [Evidence Extraction Agent](/Agents/Evidence_Extraction_Agent) — composes · Agents
- [ERP Synchronization API](/Software/ERP_Synchronization_API) — composes · Software
- [Multimodal Parsing Engine](/Software/Multimodal_Parsing_Engine) — composes · Software
- [Ledger Matching Agent](/Agents/Ledger_Matching_Agent) — composes · Agents
- [Ledger Vouching Service](/Services/Ledger_Vouching_Service) — composes · Services
- [ERP Authentication Gateway](/Agents/ERP_Authentication_Gateway) — composes · Agents
- [Autonomous Tick-and-Tie Service](/Agents/Autonomous_Tick-and-Tie_Service) — composes · Agents
- [Portal Fetching Agent](/Agents/Portal_Fetching_Agent) — composes · Agents
- [Client Follow-Up Agent](/Agents/Client_Follow-Up_Agent) — composes · Agents
- [Multimodal Extraction API](/Agents/Multimodal_Extraction_API) — composes · Agents

### Embodies

- [Service-as-Software](/Theses/Service-as-Software) — embodies · Theses
- [Software](/Theses/Software) — embodies · Theses

### Competitors

- [Citrix ShareFile](/Competitors/Citrix_ShareFile) — competes with · Competitors
- [Caseware Working Papers](/Competitors/Caseware_Working_Papers) — competes with · Competitors
- [Suralink](/Competitors/Suralink) — competes with · Competitors
- [Spreadsheet Request Trackers](/Competitors/Spreadsheet_Request_Trackers) — competes with · Competitors
- [CCH Axcess Workpaper](/Competitors/CCH_Axcess_Workpaper) — competes with · Competitors
- [manual ticking-and-tying](/Competitors/manual_ticking-and-tying) — competes with · Competitors
- [CCH Axcess](/Competitors/CCH_Axcess) — competes with · Competitors
- [Side-By-Side Ticking](/Competitors/Side-By-Side_Ticking) — competes with · Competitors
- [Manual Ticking And Tying](/Competitors/Manual_Ticking_And_Tying) — competes with · Competitors
- [Suralink Client Portals](/Competitors/Suralink_Client_Portals) — competes with · Competitors
- [Manual PBC Trackers](/Competitors/Manual_PBC_Trackers) — competes with · Competitors
- [Suralink Request Portals](/Competitors/Suralink_Request_Portals) — competes with · Competitors
- [Prisma Cloud](/Competitors/Prisma_Cloud) — competes with · Competitors
- [Orca Security](/Competitors/Orca_Security) — competes with · Competitors
- [Wiz](/Competitors/Wiz) — competes with · Competitors
- [Manual IAM Audits](/Competitors/Manual_IAM_Audits) — competes with · Competitors
- [Tenable Cloud Security](/Competitors/Tenable_Cloud_Security) — competes with · Competitors
- [Manual Email Chases](/Competitors/Manual_Email_Chases) — competes with · Competitors
- [Mercer Audit Agent](/Competitors/Mercer_Audit_Agent) — competes with · Competitors
- [Microsoft Excel Spreadsheets](/Competitors/Microsoft_Excel_Spreadsheets) — competes with · Competitors
- [Thomson Reuters AdvanceFlow](/Competitors/Thomson_Reuters_AdvanceFlow) — competes with · Competitors
- [Mercer](/Competitors/Mercer) — competes with · Competitors

### Entrant in opportunity

- [Automated Audit Evidence for Auditors](/Opportunities/Automated_Audit_Evidence_for_Auditors) — is entrant in · Opportunities

### Who it serves

- [Public Accounting Firm](/CompanyTypes/Public_Accounting_Firm) — serves · CompanyTypes

### Similar Startups

- [Domill](/Startups/Domill) — similar · Startups
- [Archos](/Startups/Archos) — similar · Startups
- [Zenentinel](/Startups/Zenentinel) — similar · Startups
- [Hexharbor](/Startups/Hexharbor) — similar · Startups
- [Posept](/Startups/Posept) — similar · Startups
- [Continuousrope](/Startups/Continuousrope) — similar · Startups
- [Weldedrock](/Startups/Weldedrock) — similar · Startups
- [Accirm](/Startups/Accirm) — similar · Startups
- [Aegispark](/Startups/Aegispark) — similar · Startups
- [Safetymissing](/Startups/Safetymissing) — similar · Startups
- [Leap](/Startups/Leap) — similar · Startups
- [Staborus](/Startups/Staborus) — similar · Startups
- [Choruild](/Startups/Choruild) — similar · Startups
- [Atonyx](/Startups/Atonyx) — similar · Startups
- [Zenithember](/Startups/Zenithember) — similar · Startups
- [Incisive Software](/Startups/Incisive_Software) — similar · Startups
- [Critiver](/Startups/Critiver) — similar · Startups
- [Corelamp](/Startups/Corelamp) — similar · Startups
- [Rebanyon](/Startups/Rebanyon) — similar · Startups
- [Dalatigue](/Startups/Dalatigue) — similar · Startups