Your CNAPP has hundreds of controls. Praxis tells you which one to switch on first — and shows the math.
Image-assurance and runtime controls ship switched off, and every finding looks urgent. Praxis reads what your CNAPP and your clusters already know, and ranks the controls to apply by a fixed, explainable formula — so “why is this first?” always has an answer your auditor can check.
-
01
P2 · highBlock critically vulnerable imagesregistry.demo/card-processor:2.4.1data-sensitive; Policy state: not enabled in 'Registry gate'PCI 6.3ISO A.8.8BDDK m.16T11900.56
-
02
P2 · highLimit container privileges at runtimecheckout/web-frontendinternet-facing; Policy state: partially enabled in 'Privilege limits'PCI 7.2ISO A.8.2BDDK m.11T16110.51
-
03
P2 · highBlock docker.sock and dangerous hostPath mountsinternal-tools/build-runnerhigh blast radiusPCI 2.2ISO A.8.2BDDK m.11T16100.51
Security teams don’t lack findings. They lack an order.
Everything is critical
Thousands of findings, each with its own severity. Nothing says which control, switched on today, removes the most risk.
“Why this one?”
A ranking nobody can explain does not survive a change board, let alone an audit. A model’s opinion is not evidence.
Afraid to break production
Turning a runtime control on in block mode is a risk of its own. Teams need a safe first step, not a big switch.
Three steps, no agents, nothing written to your cluster
Collect
A read-only collector reads the cluster’s topology, RBAC and workload settings, and the policies your CNAPP already has. No Secrets, no write access.
Score
Each recommended control is ranked by a deterministic formula: threat, exposure, data sensitivity and blast radius, minus the cost of applying it.
Act
You get a ranked task list with the reasons behind every score, audit-mode policy files to review, and evidence mapped to the regulations you answer to.
Built for teams that have to defend every decision
A formula, never a verdict
The score is arithmetic you can recompute by hand. An optional local AI model writes the explanation of a score that is already final — it can never change it.
Mapped to your regulators
Every control carries requirement-level references to PCI-DSS v4.0 and ISO/IEC 27001:2022, and article (Madde) references to BDDK and KVKK.
Generate, never apply
Deploy plans are policy files in audit mode for your team to review and roll out. Praxis itself never changes a policy.
Runs where your data lives
On-premises and air-gapped installs, signed offline bundles, no telemetry and no call-home. A hosted option exists for teams that want it.
Two places Praxis earns its keep
Banks and regulated industries
Evidence reports and signed audit packages for BDDK, KVKK, PCI-DSS and ISO 27001, MFA for every account and a tamper-evident audit log.
Banking & compliance →Managed security providers
One server for many customers: tenants, customer-scoped users, per-customer reports and audit packages.
For MSSPs →On top of the platform you already run
Praxis reads from your existing CNAPP through its own API, or through the Kubernetes-native policy objects many runtime-security tools already create. Adding a vendor is one adapter; the scoring engine never changes.
See your own clusters ranked
Bring one cluster. We run the read-only collector with you and walk through the list it produces.