Getting Started
Quick Start Guide
Welcome to EchelonGraph. Get up and running in under 10 minutes — connect your cloud, run your first scan, and see your entire attack surface.
1. Create Your Account
Sign up at echelongraph.io/signup with your work email. Your workspace is created with complete tenant isolation from day one — your data is fully separated from every other customer.
2. Connect Your Cloud Accounts
Navigate to Settings → Cloud Accounts and click Add Cloud Account. EchelonGraph connects using read-only credentials — we never request write, delete, or modify access to your cloud environment.
We support all three major cloud providers:
- AWS: Cross-account IAM Role with two AWS-managed policies —
SecurityAuditandViewOnlyAccess— which together cover core posture and CIEM. Neither includes Amazon Bedrock reads (AI-SPM) or the ECR image-pull actions, so also attach the small inline policy from the Integrations guide, or those scans return nothing with no error. The 1-click CloudFormation template attaches two of them. Add the inline policy yourself. - GCP: Service account or Workload Identity Federation with four read-only roles —
roles/viewer,roles/iam.securityReviewer(CIEM: basic Viewer cannot read IAM policy),roles/artifactregistry.reader(container SCA), androles/cloudasset.viewer(near-real-time change detection and complete resource discovery). - Azure: App Registration with
Readeron target subscriptions — this one role does cover posture, CIEM and AI-SPM, because Azure'sReadergrants*/read. AddAcrPullon any registries you want container images scanned *(Preview)*.
> This is a summary — grant the full set. Each cloud's complete, authoritative role list is on the Integrations page. Granting only the first role for AWS or GCP leaves a connection that looks healthy and populated while CIEM, container scanning and change detection are silently not running for you.
3. Run Your First Scan
Once connected, EchelonGraph automatically initiates an agentless scan. The scanner queries your cloud provider APIs to discover:
- Compute: VMs, serverless functions, container services
- Network: VPCs, subnets, security groups, firewalls, load balancers
- Storage: Object stores, block storage — with encryption and access policy checks
- Identity: IAM users, roles, policies, service accounts
- Data: Managed databases — encryption status, public access, backup configuration
- Certificates: TLS certificates and their expiry dates
The scan also runs 440+ misconfiguration rules mapped to CIS v2.0 benchmarks and automatically correlates known CVEs against your infrastructure.
No agents to install. No disk snapshots. No write permissions. Pure API-based discovery.
4. View Your Attack Surface
Navigate to the Attack Graph to see your interactive 3D blast radius graph. Click any node to explore:
- Asset properties and cloud metadata
- Known vulnerabilities with CVSS scores
- Attack path analysis showing reachable paths from the internet
- Blast radius impact — which resources are at risk if this node is compromised
5. Check Compliance
Go to Compliance to see live scores across 300+ frameworks: SOC 2, GDPR, ISO 27001, NIST CSF 2.0, PCI DSS 4.0, HIPAA, DPDP Act, ISMS-P, CIS AWS v3, CIS GCP v2, CIS Kubernetes v1.9, Pod Security Standards, NIST AI-RMF, EU AI Act, ISO 42001, MITRE ATLAS, and OWASP LLM Top 10. Each control shows Pass, Fail, Partial, or N/A — with actionable remediation guidance for every finding.
6. Invite Your Team
Navigate to Settings → Users to invite team members with role-based access:
- Viewer: Read-only access to dashboards and reports
- Analyst: Manage alerts, create reports, export data
- Operator: Manage scans, assets, and integrations
- Admin: Full tenant administration
Next Steps
- Integrations — Step-by-step AWS, GCP, Azure, and SSO setup guides
- Scanning Tiers — Compare agentless, network, and runtime scanning
- Security — Configure SSO, MFA, and RBAC for your organization
- Compliance — Deep dive into 300+ supported frameworks
- Data Sovereignty — Deployment options for strict data residency requirements