Exaforce + AWS
Exaforce connects Amazon Bedrock and AgentCore activity to the identities behind it, the tools it calls and the data it touches. Agentless, read only, and built 100% on AWS.
Better together
Teams building with Amazon Bedrock and Amazon Bedrock AgentCore keep hitting the same wall. Security can’t approve what it can’t see: which agent acted, whose permissions it used, what it reached, and whether any of that was expected.
Those answers live in different places. The AI services, cloud logs, identities, and the systems the agents actually touch. An allowed API call can still be risky. Without a connected view, security reviews drag and AI projects sit in pilot.
Exaforce connects Bedrock and AgentCore signals with CloudTrail, IAM context, and the identity and security tools you already run. Session stitching ties each agent action to the role it used, the tool it called and the resource it reached, so you get an evidence-linked timeline instead of a pile of logs.
AWS controls decide what an agent is allowed to do. Exaforce shows what it actually did.
Deployment
Exaforce collects AWS telemetry through least-privilege, read-only cross-account roles. One CloudFormation stack, no agents to install. Coverage follows the logging you have enabled.
Competencies
Threat Detection and Response · Identity and Access Management
Agentic AI Applications · Generative AI Applications
Available for purchase, including private offers
AWS-native architecture
AWS integrations
Connect the AI services first, then the AWS telemetry that gives them meaning. What’s available depends on the logging you have enabled.
AI on AWS
Model and agent activity. CloudTrail supplies the API audit record for Bedrock calls. Model inputs and outputs need separate Bedrock invocation logging for supported APIs.
AI on AWS
Agents, memory and gateway activity, so you can see which agent ran, what it called and on whose behalf. Relevant AgentCore data events need to be enabled.
Identity and activity
The roles, keys and permission sets that agents and people run with, mapped back to a human owner.
Identity and activity
API activity across every account, stitched into complete sessions rather than left as isolated events, and queryable months back without a separate archive.
Identity and activity
Object reads and writes that show what data an agent actually touched. S3 data events need to be enabled.
AWS security services
Every finding gets ingested and enriched with the identity behind the activity, the events that led to it, the resources affected and related activity elsewhere in the account. Findings become plain-language assessments that say what happened, why it matters and what to do next.
AWS security services
Resource configuration and change history, so an investigation can show what a resource looked like before and after the activity in question.
AWS security services
The network view. Where traffic went, how much moved, and whether a suspected exfiltration attempt actually transferred data.
AWS security services
Cluster audit activity and configuration, with Exaforce detections on top for the container layer most tools treat as a black box.
AWS security services
One connection covers every account and region, and new accounts are picked up as they’re created.
Exaforce can also act through the AWS controls you already have: isolate an EC2 instance or an EKS host, disable an IAM or IAM Identity Center user, update a security group or network ACL. Every action runs automatically or waits for one-click approval, and you grant only the ones you intend to use.
Context
AWS produces a lot of volume, but it’s almost never where an investigation ends.
Exaforce reads more than 100 sources across identity, endpoint, SaaS, network, code, email and cloud security, and lands all of them in the same real-time model as your AWS data. Identities, sessions, resources and behavior are connected rather than sitting in separate tools, which is what lets a verdict account for things no single AWS service can see.
That changes what a finding means:
Enrichment runs the same way on everything: who owns the resource, what the data is worth, how that identity normally behaves, what the rest of your tooling already knows. It’s the work an analyst does by hand on the findings they have time for, applied to all of them.
Put it to work
AI agents 01
Bedrock and AgentCore agents tied to the identity each one runs as, with the evidence security needs to sign off. Exaforce shows which agent acted, the role and permissions it used, the tools it called and the resources it reached, all as one stitched session. When an agent reaches past its normal workload you see the reach, the owner and the permissions behind it, not just an alert.
Coding agents 02
Repo access, the permissions they run with, and the MCP servers and skills wired in, each one tied back to the developer and risk scored. When an AI coding assistant uses AWS credentials from a developer’s device, Exaforce correlates that credential access with endpoint and AWS activity.
Everyday AI 03
AI chat tied to the person behind it, with secrets and sensitive data in prompts flagged. Works with enterprise AI plans. You get approved and unapproved agents, skills and MCP servers by team, and a finding when a setting drifts instead of a quarterly review.
AWS security 04
The same platform works every GuardDuty finding to a verdict with the evidence attached, and resolves every policy attached to every identity into a plain answer about what it can reach and what it actually uses. AI is where we lead, not where we stop.
Results
Aggregate findings across Exaforce customer environments during 2025, based on 79 billion events and 1.29 million alerts.
GuardDuty alerts used to eat up hours of our team’s time. With Exaforce MDR, that dropped to almost zero. We’re not just getting alerts, we’re getting answers.
Exaforce has significantly improved our SOC efficacy by augmenting threat detection and response for AWS and Azure with AI. Its auto-triage of third-party alerts and rule-free detection streamlines our response and saves us dozens of hours, letting our team focus on mitigating threats, while their exploration capabilities offer greater visibility into all our Cloud services.
Pioneering early with Exaforce and their novel agentic SOC platform has significantly enhanced our detection and response for cloud services, such as GitHub, used by our development teams, in spotting identity misuse. The platform delivered actionable cloud insights within 24 hours of onboarding - one example was identifying 3rd party vendor misuse of their credentials in our environment. The rich data platform provides quick answers to hard questions & tasks across our SaaS and IaaS environments.
AI-driven analysis is essential for modern security operations, and Exaforce demonstrates how AI can act as a true investigation partner. The company's platform enables our team to operate with the depth and context that traditionally requires a full SOC and significant manual effort, helping us to scale our security efforts to meet our growing needs.
I like Exaforce's approach to Security Operations. They have both human review and an AI platform to facilitate better data ingestion, alerting, case management, and investigation. They're very receptive to feedback and are collaborative on new features they release as well as one they want to develop. My team uses Exaforce almost every day for some sort of look up, investigation, or continuing to build out remediation automation.
Exaforce has absolutely changed how I rely on my SIEM day to day. Previously, it was just a repository of old logs. Now we can threat hunt very easily and respond to alerts very quickly.
Compliance
Exaforce is audited and certified by industry-leading third party standards.
Solution brief
A closer look at how Exaforce connects agents, identities and AWS activity: what we read from Bedrock, AgentCore, CloudTrail and IAM, how session stitching builds an evidence-linked timeline, and what that gives a security team reviewing an AI workload.
Download the solution brief (PDF)Looking for the GuardDuty brief? Read it here.
Resources
AWS validated us for AI and Security. Here is what that means.
Achieving both AWS Security Competency and AWS AI Competency, across four categories that map exactly to what we built.
Lessons from the hallways at my first AWS re:Invent
What hallway conversations and roundtables at re:Invent revealed about real-world cloud security.
Exaforce selected to join the 2025 AWS Generative AI Accelerator
Exaforce is honored to be part of AWS’s global program supporting the most promising generative AI startups.
Do you feel in control? Analysis of AWS CloudControl API as an attack tool
Abusing AWS CloudControl API to stealthily enumerate resources, persist in accounts, and evade detection.
How agentic AI simplifies GuardDuty incident response playbook execution
Agentic AI automates GuardDuty playbook steps, shrinking hours of log stitching and identity checks into minutes for faster, consistent response.
