soft guideINFRASTRUCTURE & ADVISORY

Secure / Level 2 of 3

The controls auditors
and attackers test first.

Everything in Platform, plus organization guardrails, admission and network policy, one controlled way out to the internet, and the evidence an auditor asks for.

Level 1

Platform

You have a product. You need somewhere production-grade to run it.

Level 2

Secure

Everything in Platform, plus the controls auditors and attackers both test first.

Level 3

AI Factory

Agents that operate production and fix your CI, on top of Secure or alongside a platform you already run. For enterprises.

What Secure includes

Everything in Platform, plus the controls auditors and attackers both test first.

Discuss Secure ↗
  • Organization guardrails: SCPs and RCPs with offline tests
  • Admission policy, tested both ways, enforced in production
  • Default-deny network policy with declared capabilities
  • One controlled path to the internet
  • Secrets with rotation; backups with tested restores
  • Evidence pack mapped to CIS and AWS Foundational Security Best Practices

Security is part of the work

Understand the risk.
Know the next step.

Controls that are proven.
Every policy ships with proof that it blocks what it should.
Several fences, not one.
Independent layers, so one mistake is caught by the next.
Evidence, not promises.
Changes to guardrails are checked against how your organization really behaves.

Start with a review

Not ready for the whole level?
Start with a review.

01

Security posture & guidance

Security-minded infrastructure advice grounded in configuration and architecture. Get a clearer picture of exposure, ownership, and the changes that deserve attention first.

Discuss this review ↗

What we can work through

  • AWS IAM policies, roles, and access paths
  • Network segmentation, ingress, and exposure reviews
  • Logging, encryption configuration, and secrets management guidance
  • Risk prioritization, remediation planning, and follow-up reviews
What you take away

A documented posture assessment with evidence, practical recommendations, ownership suggestions, and remediation priorities.

Soft Guide does not provide penetration testing, offensive security, exploitation, or red-team services. A configuration review is not a certification, compliance attestation, or guarantee that a system is secure.

How it is built

Look inside.

05

One way out to the internet

Every outbound connection from a cluster leaves through a single allowlisting exit, behind independent fences at the routing, network-policy and application layers.

  • AWS
  • Kubernetes
  • Cilium
  • Envoy
  • Security
06

Network access a service declares, not one it inherits

Default-deny networking where each workload declares what it depends on, each destination admits exactly those callers, and a narrowly privileged pipeline applies the policies.

  • Kubernetes
  • Cilium
  • GitOps
  • Flux
  • Security
07

Admission policies that are proven to block

Kubernetes admission policies that ship with proof that they reject what they should, reported in development and enforced in production.

  • Kubernetes
  • Kyverno
  • Security
  • GitOps
08

Guardrails an account inherits on day one

Organization-wide guardrails consolidated from per-account copies into one baseline, changed only with evidence that nothing legitimate breaks.

  • AWS
  • Security
  • Pulumi

Start a conversation

Bring your infrastructure
into focus.

Tell me what you are building, operating, or trying to improve.

Let’s talk