Security overview
Sencai continuously scans and inventories the infrastructure it manages for you - cloud instances, container images, fleet hosts, and the credentials your team pushes to Git - and surfaces what it finds under Security in the left-hand navigation. This page maps the security-related screens, plus a short summary of how the platform itself is built to keep your data safe.
Three of them do not sit under Security in the sidebar, which is worth
knowing before you go looking: CIS hardening is under
Compliance & Audit (/gravity/inventory/cis), and IP allowlist
(/gravity/settings/ip-allowlist) and Audit Export
(/gravity/settings/audit-export) are under Settings.
What gets scanned, and where it shows up
Section titled “What gets scanned, and where it shows up”| Screen | What it covers |
|---|---|
| Vulnerabilities | Known CVEs in the container images your cloud instances run |
| CIS hardening | Lynis-based OS hardening scores for your enrolled fleet hosts |
| Secret findings | Leaked credentials and API keys detected in your Git repositories |
| Access management | Identities inside your connected cloud accounts, periodic access reviews, and just-in-time elevation |
| IP allowlist | Restrict which networks can reach your organization |
| WAF & DDoS | Web application firewall rules/ACLs and DDoS protection posture |
| Audit log | The tamper-evident record of everything that happens in your organization |
Most of these screens are read-heavy: they show you what the platform found and let you triage it (accept a risk, mark something fixed, acknowledge a finding) rather than requiring you to configure a scanner yourself. A few - WAF and IP allowlisting in particular - are configuration screens where you set the policy yourself; check each page for what’s enforced versus what’s recorded.
Who can see what
Section titled “Who can see what”Sencai’s organization roles apply here the same way they apply everywhere else in the platform. As a rule of thumb:
- Owner and Admin can see and act on everything in this section, including changing an IP allowlist or approving elevated access.
- Member can view findings and typically triage them (acknowledge, mark fixed) but not change organization-wide security settings.
- Auditor is a read-oriented role, useful for someone who needs visibility into findings and the audit trail without being able to change anything.
- Viewer can see most of what’s on this page but can’t take triage actions.
See Roles for the full breakdown of what each role can do across the platform, not just in this section.
The platform’s own security posture
Section titled “The platform’s own security posture”A few things that are true about how Sencai itself is built, independent of any feature you configure:
- Credentials are encrypted at rest. Cloud provider credentials you connect (see Connecting a provider) are encrypted before they’re stored - nobody browsing your organization’s data sees the raw key or secret.
- Your organization’s data is isolated from other organizations’. Every resource - instances, findings, audit entries, credentials - is scoped to the organization it belongs to.
- The audit trail is append-only and tamper-evident. Every audit entry is cryptographically linked to the one before it, so removing or altering a past entry is detectable. See Audit log.
- Two-factor authentication and single sign-on are both available. You can turn on TOTP-based 2FA for your own account, and organizations on the appropriate plan can connect Microsoft Entra ID or Google Workspace SSO. See Single sign-on and Account security.
- You can restrict which networks reach your organization at all, on top of normal login security - see IP allowlist.
What’s next
Section titled “What’s next”- Vulnerabilities - start here if you want to know what’s exposed on your running instances
- Access management - roles, cloud identity visibility, and just-in-time elevation
- Audit log - what’s recorded and how to export it
- Compliance - how these findings feed into NIS2 and other compliance work