Start Free Trial
Now available on AWS Marketplace

AWS cloud security posture management for teams without a security team

bearhug is an AWS CSPM that finds misconfigurations continuously and fixes them in one click. It scans your AWS accounts, explains every finding in plain English and lets you remediate without touching the console. $100 per AWS account per month.

Under 5 min setup
Subscribe via AWS Marketplace
Continuous monitoring with real-time alerts when things change
One-click fixes, no console access needed
Dashboard
Tech Friendly
Critical
2
High
14
Medium
38
Low
67
Info
142
Priority findings
Database is exposed to the public
An S3 bucket holding production backups allows access from anyone on the internet. This could lead to a severe data breach if discovered.
Critical
Fix: We will automatically block all public access policies for this specific bucket.
Remediate View Details
Unused admin access found
An IAM role with full admin privileges hasn't been used in 90 days. This is a risk if the credentials are compromised.
High

Your security posture, explained so your whole team gets it.

AWS security shouldn't be this hard

Most cloud security tools are built for enterprises with full-time security staff. If that's not you, you're stuck choosing between overspending and ignoring the problem.

Enterprise tools start at $20,000+ a year

The big names in cloud security are priced for companies with dedicated budgets and dedicated teams to run them. If you're growing fast and security isn't your core business, that maths doesn't work.

AWS alerts are unreadable

Security Hub fires hundreds of findings in technical jargon. Even your developers struggle to work out what's urgent and what can wait.

Fixing issues eats up dev time

Reading docs, understanding the risk, figuring out the fix, testing it won't break anything. Each finding can take hours to resolve properly.

Customers and investors want proof

Enterprise prospects send security questionnaires. Investors ask about your posture during due diligence. "We're working on it" isn't good enough.

Enterprise-grade AWS security, priced for startups

The cloud security posture management (CSPM) that enterprise companies pay tens of thousands for, built on AWS Security Hub and GuardDuty. It catches misconfigurations across every account for one flat price, with no per-asset counting. See how bearhug helps start-ups.

Plain English Mode

Toggle between technical detail and clear, jargon-free explanations. Share security reports with your CEO, board, or investors in language they actually understand.

Explore plain-English AWS security findings

One-Click Fixes

Every finding includes a recommended remediation you can apply directly from the dashboard. Review the proposed change, click to apply. Rollback included.

Explore one-click AWS remediation

Real-Time Alerts

Continuous monitoring catches new issues as your AWS environment changes. Get notified when something needs attention, not three months later during an audit.

Explore real-time AWS security alerts

Build Stronger Compliance Foundations

bearhug enhances your security posture to help you align with frameworks like GDPR, SOC 2, ISO 27001, PCI-DSS, and Cyber Essentials, making audits smoother and less stressful.

Built on AWS-Native Security

Powered by Security Hub and GuardDuty. The same security intelligence that enterprise teams rely on.

Multi-Account Support

See your security posture across production, staging, and development from a single dashboard. Add or remove accounts any time.

Explore multi-account AWS security dashboard

Connect your AWS account in under 5 minutes

14-day free trial. Billed through AWS Marketplace. No long-term commitment.

How bearhug secures your AWS account in three steps

No consultants. No complex setup. No learning curve.

1

Connect your AWS account

One-click setup directly from AWS Marketplace. Give it read-only access to your account. It takes under five minutes and nothing to install.

2

See risks in plain English

bearhug scans your account and translates every finding into language anyone on your team can understand. Toggle between friendly and technical views any time.

3

Fix with one click

Each finding comes with a recommended fix you can apply in one click. Review what will change, hit the button, done. Rollback available if needed.

See what bearhug looks like inside

Keep your network's front and back doors locked to stay safe online
Region: London High
Production Account EC2 Security Group Updated 2 hours ago
This check makes sure the main security settings for your virtual network are as tight as possible. It's important that these settings don't allow traffic to freely come in or go out. We suggest removing any rules that allow unrestricted access and only opening specific ports that your applications actually need.
Recommended fix

We'll remove the overly permissive inbound and outbound rules on this security group and replace them with rules that only allow traffic on ports your application is actively using.

Remediate Suppress View Raw Finding
Findings
Click to try
Keep your cloud storage private by limiting who can access it.
AWS S3 Bucket Ireland
High
Keep your Amazon storage backups private to protect your data.
AWS EC2 Snapshot Block Public Access Ireland
High
ECS containers should be limited to read-only access to root filesystems
AWS ECS Task Definition Frankfurt
High
Keep your network's front and back doors locked to stay safe online
AWS EC2 Security Group London
High
Keep your online storage private to protect your important files.
AWS S3 Bucket N. Virginia
Medium
To keep your website secure, use special codes when sharing private content with visitors.
AWS CloudFront Distribution Global
Medium
Findings translated into plain English
Alert Email
Sent automatically
We found something
We noticed something odd in one of your AWS accounts.
Production Account · 31 March 2026
Our security system detected unusual activity involving one of your data storage areas. Someone with access to your system is interacting with the data in a way that's different from their normal behaviour.
Log in to investigate
Real-time alerts straight to your inbox

A CSPM at a fraction of enterprise prices

The closest comparable CSPM charges $850 a month, billed annually, with limits on the number of assets. bearhug is $100 per AWS account per month, flat. Everything included, nothing hidden.

FLAT RATE
$100
per AWS account per month
All security checks and findings
Plain English and technical views
One-click remediation
Real-time monitoring and alerts
Compliance alignment (GDPR, SOC 2, ISO 27001, PCI DSS, Cyber Essentials)
Multi-account dashboard

Billed in USD through your AWS Marketplace account. The 14-day trial does not convert to paid automatically.

No per-asset counting
One account, one price, regardless of how many resources you run. No surprises as you scale.
Billed straight to your AWS account
Charges appear on your existing AWS invoice, in USD, through AWS Marketplace. There is no separate vendor invoice, no procurement and no new vendor to onboard.
No long-term commitment
Cancel from your AWS console. Your plan runs to the end of the current billing month and then stops, with no cancellation hoops.

bearhug compared with enterprise CSPM and DIY

Enterprise-grade security at a price that makes sense for growing teams.

Feature bearhug Enterprise CSPM DIY / Manual
Plain English explanations
One-click remediation Some
Compliance alignment
Setup time 5 minutes Weeks Ongoing
Price $100/month $20,000+/yr "Free" (dev time)
Security expertise required No Yes Yes
AWS-native tools Varies

Common questions

A cloud security platform that monitors your AWS accounts for vulnerabilities, explains what's wrong in plain language, and gives you one-click fixes. The technical term is CSPM (Cloud Security Posture Management), but you don't need to know that to use it.

Register on our sign-up page, then activate your trial through AWS Marketplace and connect your AWS account. You get 14 days with full access to every feature. The trial does not convert to a paid plan automatically. To keep using bearhug afterwards, subscribe to the $100 per AWS account per month plan, billed in USD through your AWS Marketplace account.

Through AWS Marketplace, directly onto your existing AWS bill. No separate invoicing, no credit card details to enter. The charge appears on your regular AWS statement.

Not yet. We're focused exclusively on AWS right now because that's where our deep expertise is. We'd rather do one cloud properly than three clouds badly.

bearhug integrates with Security Hub and GuardDuty. These are the same services enterprise security teams use. We pull in their findings and make them accessible.

No. That's the whole point. bearhug translates security findings into plain English and provides one-click fixes. If you can read a dashboard and click a button, you can secure your AWS account.

To run the 14-day free trial, yes. During onboarding you'll give bearhug limited access to your AWS environment so it can start fixing your security issues. If you'd like to look around first, take a tour of our demo dashboard before committing.

Get started for free

Your AWS account has risks right now. Connect in five minutes and start finding them. 14-day free trial, billed through AWS Marketplace, no long-term commitment.

No credit card. No procurement. Starts from your AWS console.