Plexavo
Plexavo is an open-source AWS security scanner that analyzes IAM policies, storage configurations, logging settings, and network controls to surface misconfigurations and privilege-escalation paths. Unlike many commercial tools, it runs entirely on local credentials without sending data to external services, ensuring complete control and privacy. The core is released under AGPL-3.0, allowing anyone to inspect, modify, or contribute to every security check. The scanner is designed for low-noise, signal-first output, focusing on actionable findings rather than overwhelming lists. It chains together privilege-escalation vectors that are often overlooked by point-in-time checks, providing a more realistic view of potential attack paths. Users can install it via pip and scan an AWS profile with a single command. Plexavo’s roadmap includes a hosted version with continuous monitoring, AI-driven explanations, compliance tagging, and auto-fix capabilities, while the CLI core remains free and open source.
- Category
- Open Source
- Pricing
- Free
Problem solved
Organizations need a transparent, auditable way to assess their AWS security posture without relying on proprietary, black-box tools. Plexavo fills this gap by offering a free, open-source scanner that detects misconfigurations and complex privilege-escalation chains, all within the user's own environment.
Use cases
- Audit AWS IAM, storage, logging, and networking for misconfigurations
- Detect privilege-escalation chains across AWS services
- Integrate into CI/CD pipelines for pre-deployment security checks
- Run ad-hoc security scans from a local machine
- Replace or supplement commercial cloud security posture management tools
- Educate teams by reading open-source security checks and contributing
Audience
- Developers
- Startups
- Enterprise
- Hobbyists
Pros
- Fully open-source and auditable (AGPL-3.0)
- Runs locally with your own AWS credentials
- Detects privilege-escalation chains often missed by other tools
- Low-noise, signal-first output
- Free for unlimited scanning
Cons
- Hosted version with additional features still in development
- Currently supports AWS only
- No built-in continuous monitoring (roadmap)
- Findings may require manual interpretation without AI narration
- No out-of-the-box compliance mappings (roadmap)
Official website: https://plexavo.com/
Canonical LambdaBase page: https://www.lambdabase.com/tools/plexavo