Replay exactly what changed, who changed it, and when
Investigations start with reconstruction. Someone greps logs across accounts while the incident is still open, trying to establish what the environment looked like an hour ago. imPAC keeps the evaluated configuration history continuously, so the first question is already answered. Cut investigation from 8 to 12 hours across a team down to 15 minutes for one person.
Built for security leads, incident commanders, and cloud operations teams running AWS, Azure, and GCP.
- 15 minutes
- to establish what changed, down from 8 to 12 hours
- 1 person
- runs the investigation instead of pulling in a team
- Agentless
- built from data your cloud already produces
- AWS + Azure
- change attribution to the individual actor today
Half your incident is spent establishing what the environment looked like before it broke.
The technical work of remediation is rarely the long part. The long part is reconstruction: pulling logs from multiple accounts, correlating timestamps across services, and working out which of the several hundred changes made that day is the one that matters. Every organisation we talk to does this by hand, during the incident, under pressure.
Logs tell you events happened, not what state resulted
A change event says an API call was made. It does not say what the resource configuration looked like before or after, and it does not say whether the resulting state violated a control. Reconstructing state from an event stream is possible and it is exactly what teams do at 2am, which is why it takes hours and produces disputed conclusions.
Nobody knows who made the change
Attribution usually means correlating an activity log entry to a directory identity by hand, if the correlation is even possible. Without it, the post-incident review produces a process recommendation instead of a conversation, and the same change happens again next quarter.
Entra display names correlated automatically.
AI agents are making changes faster than review can keep up
Your cloud already changed hundreds of times a day from engineers, pipelines, and third party tools. Copilots and agents now make changes too, at machine speed and often without an obvious human behind them. Reconstruction by hand was barely workable when every change had a person attached. It does not survive this.
From alert to root cause in four steps
Capture continuously, correlate across accounts, attribute to an actor, then export the timeline.
imPAC inventories configuration across AWS, Azure, and GCP agentlessly and records each evaluated state as it changes. Nothing needs to be enabled at incident time, because the record already exists. This is the part that has to be in place before you need it.
Incidents rarely stay inside one account. Changes are correlated into a single timeline so a permission change in one account and a storage change in another appear in the same view, in order, with the relationship between the affected assets visible.
See which identity made each change, resolved to a human where the cloud provider allows it. On Azure this means correlating activity log entries to Entra display names automatically, which is work most teams do by hand or skip. Available for AWS and Azure today.
Produce a clean change timeline with affected resources, before and after states, and actors, ready for the post-incident review, the regulator, or the customer notification. The same record satisfies the auditor who asks about the incident six months later.
One timeline, every account the incident touched
Changes correlated across accounts and regions in order, with before and after state and the actor behind each one.
What you get in the first 15 minutes
The question on the left, how the investigation goes with and without a retained history.
imPAC covers the cloud configuration layer: what changed, when, and who changed it. It is not runtime detection and it does not replace your EDR or SIEM. It answers the reconstruction question those tools leave to your team.
“When something goes wrong, imPAC gives us the context to respond in minutes rather than hours. The historical data means we are not scrambling. We already know who changed what, and when.”
-CIO, Food and Beverage Company
What a 15 minute investigation means for your team
Investigation in minutes
Cut the reconstruction phase from 8 to 12 hours down to a 15 minute triage.
One responder, not a war room
Stop pulling four engineers into a call to answer a question one person can now answer alone.
Start with facts
Begin the investigation with what changed rather than spending the first hours establishing it.
Attribution, not speculation
Post-incident reviews name the change and the actor, so the corrective action is specific.
Machine changes tracked too
Pipeline, third party, and AI agent changes are recorded on the same timeline as human ones.
Evidence ready afterwards
The same timeline satisfies the auditor, the regulator, and the customer asking what happened.
Frequently Asked Questions
How is this different from CloudTrail or Azure Activity Log?
Does this work if we did not have imPAC installed before the incident?
Do you support change attribution on GCP?
Does this replace our EDR or SIEM?
Can we automate the response, not just the investigation?
Bring us your last incident
Tell us roughly what happened and how long the reconstruction took. We will show you what the same investigation looks like when the change history is already there.