Infrastructure that
never drifts.
Fortify Core runs refresh-only Terraform plans against your live cloud, classifies every change by blast radius, and opens the pull request that puts state back where your code says it should be.
- 18s
- median detect → PR
- 62k
- resources under watch
- 99.98%
- scan success rate
- SOC 2
- Type II audited
- from_port = 22+ from_port = 443+ cidr_blocks = ["10.0.0.0/8"]
Detection tools hand you a diff and a shrug.
Fewer than 30% of teams have any automated remediation path. Everyone else pays for drift twice — once in incidents, once in the cleanup sprint.
Without Fortify Core
- A security group gets widened in the console during a 2am incident
- terraform plan starts failing weeks later, mid-deploy
- Orphaned resources quietly inflate the monthly bill
- Compliance evidence no longer matches live infrastructure
With Fortify Core
- Refresh-only plans every 15 minutes across every environment
- Severity scored LOW → CRITICAL by resource type and blast radius
- Remediation pull request opened automatically, diff included
- Low-risk drift self-heals after a delay you configure
Engineered for modern DevOps
Bridge the gap between manual operations and infrastructure as code.
Deep drift forensics
Generic monitors tell you a value changed. Fortify Core tells you which IAM principal changed it, from which surface, and what it exposed.
GitHub native
Remediation pull requests land in your repository with the plan output, a change table and a rationale. Review, approve, merge — state is back in sync.
- branch fortify/drift-482-sg-web
- 3 files changed · +12 −4
- checks: terraform validate ✓ · tfsec ✓
Multi-cloud support
AWS, Azure and GCP unified behind one drift feed, one severity model, one audit trail.
Governance guardrails
Freeze critical resources, require two approvals on IAM changes, and set per- environment severity thresholds that gate auto-apply.
Agentless install
Connect via OIDC with read-only credentials. No agents in your VPC, nothing to patch, nothing with write access to production.
Get startedThe three screens your team will actually live in.
aws_security_group.web_tier
ingress 0.0.0.0/0 added on :22
2mCRITICALaws_iam_role.deployer
policy AdministratorAccess attached
26mHIGHaws_instance.worker_nodes
instance_type t3.medium → t3.large
1hMEDIUMaws_s3_bucket.assets_prod
tags.Environment prod → staging
3hLOW
production-eu-west-1
fix: restore ingress rules on web_tier security group
Drift detected at 14:22:04 UTC. An ingress rule allowing 0.0.0.0/0 on port 22 was added outside Terraform. This PR restores the committed configuration.
resource "aws_security_group_rule" "ssh" {- cidr_blocks = ["0.0.0.0/0"]+ cidr_blocks = ["10.0.0.0/8"]}
Fortify Core · #infra-alerts
CRITICAL drift in production-eu-west-1
- · aws_security_group.web_tier — ingress opened
- · detected 14:22:04 UTC by ops-oncall@acme
- · remediation PR #482 opened
Live in under ten minutes
No agents to deploy, no write access to your cloud, no changes to how your team already ships Terraform.
- 01
Connect repo and cloud
Install the GitHub App, point Fortify Core at the folder holding your Terraform, and add read-only cloud credentials encrypted with AES-256-GCM.
~4 minutes · no agents
- 02
Scan on your schedule
We run terraform init and a refresh-only plan, parse the JSON output, and record every added, removed or modified resource with a severity score.
15 min · hourly · daily
- 03
Drift gets fixed, not filed
A remediation pull request lands in your repo with the diff and rationale. Merge it yourself, or let low-risk drift self-heal after your configured delay.
median 18s detect → PR
Less than one incident, every month
14-day free trial on every plan. No credit card to start.
$199/mo
For small platform teams getting drift under control.
- 3 environments · up to 250 resources
- Hourly drift scanning
- Severity classification
- Slack & email alerts
- 30-day drift history
$399/mo
Automated remediation for teams shipping every day.
- 15 environments · up to 2,000 resources
- 15-minute drift scanning
- Auto-remediation pull requests
- Self-healing with delay controls
- Slack & PagerDuty alerts
- 1-year drift history
$999/mo
Compliance, scale and control across the whole org.
- Unlimited environments and resources
- SSO / SAML and granular RBAC
- Custom governance policies
- Audit log export
- 24/7 priority support
Your infrastructure already drifted today.
Connect a repo, run one scan, and see exactly what changed outside Terraform — free for 14 days.