Know which threats
actually affect you.

InfraStack is a proactive AI security watchdog for startups, engineering teams and lean security teams. It continuously follows emerging vulnerabilities, exploits, vendor incidents, malicious packages and attacks on AI tools. It investigates how those threats relate to your technology stack, then sends evidence-backed alerts and remediation guidance in Slack or email.

No. InfraStack works independently of traditional security scanners. Tell it what you run, share dependency or configuration files, or connect GitHub with read-only access. It checks new threat intelligence against that context. No infrastructure agent, production probe or existing scanner is required to start.

Yes. It follows credible early warnings from researchers, exploit reports, vendor notices, malicious-package discoveries and attacks involving AI coding agents or MCP servers. It can investigate these signals before formal vulnerability IDs are assigned. Early reporting is not always conclusive, so InfraStack distinguishes confirmed details from uncertainty. It does not guarantee being first to every threat.

These products offer different kinds of code, dependency and cloud security coverage. InfraStack starts with a company-level question: does this emerging threat affect us?

It follows advisories, vendor incidents and researcher reports, then investigates them against the context you share or connect: code, dependencies, containers, cloud configuration, vendors and AI tools. Relevant findings arrive in your inbox or Slack with the evidence, what is still uncertain, and the recommended next steps.

An investigation can start before a CVE or package advisory exists. InfraStack works alongside your existing security tools. It does not replace their specialized scanning and does not probe production systems.

A CVE-to-dependency feed answers one question: does a published CVE match a package I use? InfraStack investigates a broader one: does this threat affect what we actually run?

For example, on October 29, 2026, tampered builds of the Claude Code extension were distributed through Cursor’s marketplace for about eleven hours. The attack planted an attacker’s SSH key and startup persistence, and attempted a reverse SSH tunnel. It was not a CVE, and it was not in any lockfile.

InfraStack’s investigation, published the next day, names the confirmed exposure (installs from Cursor’s marketplace in that window), the indicators to check on a developer machine, and the remediation order, including that updating the extension does not remove the persistence. Read the investigation.

It uses the stack information you share, including package manifests, Dockerfiles, Terraform, vendor lists, read-only GitHub context and previous team answers, to investigate relevant advisories. It provides evidence-backed assessments and asks for missing information when necessary. A repository match is not automatically proof that a vulnerable component is running in production.

No. InfraStack currently performs read-only investigations against shared context and repositories. It does not probe, log into, or scan running production systems and does not conduct active penetration tests. It complements dedicated scanners and pentesting tools by explaining emerging external threats and their potential relevance to your stack.

Yes. You can use InfraStack alongside Snyk, Wiz, Aikido, Dependabot, AWS Inspector and other security services without connecting them. Native ingestion of scanner and pentest findings is a possible future expansion, not something we offer today.

Not currently. InfraStack is read-only. It identifies threats, explains the evidence, and points to source-backed fixed versions, mitigations and next steps when available. It does not change your code, deploy patches, or modify infrastructure. Your team remains in control of remediation.

A general AI assistant can help when you ask a security question and provide the relevant context. InfraStack is built to monitor threat sources continuously, maintain the stack information you share and proactively investigate emerging issues without requiring someone to start every conversation.

Free to start. Every plan includes a monthly amount of agent usage, which is the model cost of the work you ask for. The Free plans include $10 a month, enough for your first full scan and a few dozen questions. Paid plans start at $20 a month by email and $149 a month in Slack, with more usage included. Extra usage costs the same rates, only if you turn it on, with a monthly cap you set. No per-seat fees and no charge per repository. See pricing.

Start free by email or add InfraStack to Slack. Describe your stack in a sentence and optionally share files or connect GitHub read-only. Your first scan is free. Start with email or choose Slack.