InfraStack is a proactive AI security watchdog for startups, engineering teams and lean security teams. It continuously follows emerging vulnerabilities, exploits, vendor incidents, malicious packages and attacks on AI tools. It investigates how those threats relate to your technology stack, then sends evidence-backed alerts and remediation guidance in Slack or email.

No. InfraStack works independently of traditional security scanners. Tell it what you run, share dependency or configuration files, or connect GitHub with read-only access. It checks new threat intelligence against that context. No infrastructure agent, production probe or existing scanner is required to start.

Yes. It follows credible early warnings from researchers, exploit reports, vendor notices, malicious-package discoveries and attacks involving AI coding agents or MCP servers. It can investigate these threats before a CVE is assigned. Early reporting is not always conclusive, so InfraStack distinguishes confirmed details from uncertainty. It does not guarantee being first to every threat.

These products offer different kinds of code, dependency and cloud security coverage. InfraStack starts with a company-level question: does this emerging threat affect us?

It follows advisories, vendor incidents and researcher reports, then investigates them against the context you share or connect: code, dependencies, containers, cloud configuration, vendors and AI tools. Relevant findings arrive in your inbox or Slack with the evidence, what is still uncertain, and the recommended next steps.

An investigation can start before a CVE or package advisory exists. InfraStack works alongside your existing security tools. It does not replace their specialized scanning and does not probe production systems.

A CVE-to-dependency feed answers one question: does a published CVE match a package I use? InfraStack investigates a broader one: does this threat affect what we actually run?

For example, on October 29, 2026, tampered builds of the Claude Code extension were distributed through Cursor’s marketplace for about eleven hours. The attack planted an attacker’s SSH key and startup persistence, and attempted a reverse SSH tunnel. It was not a CVE, and it was not in any lockfile.

InfraStack’s investigation, published the next day, names the confirmed exposure (installs from Cursor’s marketplace in that window), the indicators to check on a developer machine, and the remediation order, including that updating the extension does not remove the persistence. Read the investigation.

It uses the stack information you share, including package manifests, Dockerfiles, Terraform, vendor lists, read-only GitHub context and previous team answers, to investigate relevant advisories. It provides evidence-backed assessments and asks for missing information when necessary. A repository match is not automatically proof that a vulnerable component is running in production.

No. The first check reads what any visitor can see of your website: its pages, DNS records, certificates and certificate logs, and the response headers of hosts on your domain. Everything else comes from what you connect or share: GitHub with read-only access, dependency and configuration files, what your team tells the agent. It never logs in, never sends exploit or fuzzing traffic, never port-scans and never changes anything. It complements scanners and penetration tests by judging each new threat against your stack and telling you which ones are yours.

Yes. You can use InfraStack alongside Snyk, Wiz, Aikido, Dependabot, AWS Inspector and other security services without connecting them. Native ingestion of scanner and pentest findings is a possible future expansion, not something we offer today.

Not currently. InfraStack is read-only. It identifies threats, explains the evidence, and points to source-backed fixed versions, mitigations and next steps when available. It does not change your code, deploy patches, or modify infrastructure. Your team remains in control of remediation.

A general AI assistant can help when you ask a security question and provide the relevant context. InfraStack is built to monitor threat sources continuously, maintain the stack information you share and proactively investigate emerging issues without requiring someone to start every conversation.

Free to start, and you pay for the work your agent does, not for seats. Every account starts with $5 of credits, once, enough for your first full scan and a few questions; after that, Free is pay as you go. Team is $50 a month with $50 of usage included and InfraStack in your Slack. Usage beyond that costs the same rates, under a monthly cap you set. No charge per person or per repository. See pricing.

Sign up free with GitHub, Google or Slack. Give it your site, connect GitHub read-only or drop in a lock file, and your first scan runs right away, free. Add InfraStack to Slack from your dashboard whenever you like. Get started.