Since we launched Sensei last year, it’s primarily done one job: scan your repositories, find what's wrong, and open the pull request that fixes it. Today that loop extends to your cloud.
DefectDojo Pro can now onboard your AWS accounts, Azure subscriptions, and GCP projects, scan them for misconfigurations, and let Sensei remediate what it finds in one of two ways: an infrastructure-as-code pull request, or a live change to the cloud resource itself. We call the second one Fix in Cloud, and it ships with the thing security teams actually need before they trust automated cloud fixes in production: an undo button.
Cloud misconfigurations are rarely exotic. It's the public S3 bucket, the security group open to the internet, the storage account that allows public blob access. They're also rarely singular. The same issue shows up in every AWS account, every Azure subscription, and every GCP project, and closing each one means a ticket plus a console click-path someone has to get exactly right. The finding count stays red while everyone does the same fix forty times.
CSPM tools have gotten good at producing that red count. What most of them don't do is close it. Sensei CSPM was built for the second half of the job: turning cloud posture findings into cloud fixes you can apply, track, and undo.
Cloud accounts, onboarded in bulk. Connect AWS, Azure, and GCP through a Cloud Connection: one shared read-only credential that discovers every account it can see (AWS Organizations member accounts, Azure subscriptions, GCP projects) and onboards many of them at once. Onboarding a single account with its own credential works too. Scan credentials are read-only, full stop.
Cloud posture scanning. Run scans on demand from the Sensei hub. Results land in DefectDojo like any other scanner's findings: deduplicated, prioritized, and recorded against the cloud resource they concern, so an S3 bucket or a security group is tracked the same way a file and line number would be. Re-scanning an account updates the same findings instead of duplicating them.
Two ways to fix. If the infrastructure is owned by code, Sensei opens the IaC pull request, same as it does for application findings. If it's click-ops infrastructure with no code to change, Fix in Cloud applies the change directly through the provider API, using a separate write credential you grant only for remediation. Granting it never widens what scans can see.
Every direct fix is reversible and human-approved. Nothing runs without the approval dialog, which states the exact action, the resource it will change, and the cloud permissions it requires. Before Sensei touches anything, it captures the resource's prior state. Every action lands in a Cloud Remediations ledger with a per-row Revert. And if the resource has drifted since the fix, the revert refuses rather than guessing.
Impact you can show. Cloud fixes draw from the same fix quota as code fixes, and the hub breaks the total down by capability, so you can show exactly how much of Sensei's work went to your cloud.
Fix in Cloud launches with the classics, the misconfigurations behind a depressing share of real breaches:
The catalog is small on purpose. Every action in it is non-destructive, captures prior state, and has a tested inverse. Destructive changes stay on the IaC pull request path. We would rather grow the list carefully than ship a fix we can't undo.
Sensei CSPM is rolling out now to DefectDojo Pro. Cloud accounts are licensed alongside repositories, so if you already run Sensei, adding your AWS, Azure, and GCP accounts is a licensing conversation, not a migration. Book a demo to see Fix in Cloud run against a live account.