-
-
Complete AWS Security Visibility
-
- Built in New Zealand. Scan your entire AWS environment—find misconfigurations and fix them fast.
-
-
- Start Free Scan →
-
-
-
See All Your AWS Security Gaps
-
- Start your first scan in under 5 minutes. Free tier available.
-
-
-
-
-
Built in New Zealand for Growing Tech Teams
-
Join teams across NZ and beyond securing their AWS environments—SaaS, fintech, and healthtech.
-
-
-
-
4
-
AWS services scanned
-
-
-
25+
-
Security checks
-
-
-
-
< 5 min
-
Time to first scan
-
-
-
-
What teams securing AWS are saying
-
-
-
- "We knew we had security gaps but didn't know where to start. Teemops showed us exactly what to fix first. Saved us from hiring a consultant."
-
-
-
-
-
CTO
-
NZ SaaS Company (50 employees)
-
-
-
-
-
- "The compliance reporting alone is worth it. Our auditors love the CIS benchmark reports."
-
-
-
-
-
VP Engineering
-
Fintech Startup
-
-
-
-
-
-
Need More?
-
- For organizations with complex requirements, custom integrations, or regulatory needs—let's talk.
-
-
- • Unlimited AWS accounts
- • Custom compliance frameworks
- • Dedicated support
- • Volume discounts
-
-
- Contact Sales
-
-
-
-
-
- §1 · Hero + jump nav
- Everything TOPS does
- 74 checks across 11 AWS services. Self-hosted. Apache-2.0.
-
-
- Findings · Scanning · Filtering · Remediation ·
- Insights · Teams
-
-
- Note 1 — this page is scanned, not read
- The reader has decided we're interesting and is now checking whether we do the one specific
- thing they need. Optimise for someone using ⌘F. Sticky jump nav under the main nav on
- lg+; drop it below md rather than stacking two sticky bars.
-
-
- Note 2 — reorganised, not edited
- The current page (../pages/features.md, 333 lines) is a generic CSPM feature list:
- scanning, compliance, multi-account, alerts, remediation, reporting, integrations. Three of
- those sections describe things that don't exist or are now wrong. This is organised around what
- we actually ship.
-
-
-
-
-
- §2 · Durable findings
- Findings that persist
- One record per resource and rule — not one row per scan.
-
-
-
-
- - Mark resolved or ignored — it stays that way through the next scan
- - First-seen and last-seen on every finding
- - Reappears automatically if the misconfiguration comes back
-
-
-
- Note 3 — the anatomy figure
- Ships #81 and #90. Every element on this card is a separate capability, labelled once; the
- sections below refer back to it rather than re-explaining.
-
-
- Note 4 — "51 days open" is the number that sells this
- It is only computable because a finding is a durable record (#81). A per-scan row cannot
- produce it.
-
-
-
-
-
- §3 · Scanning
- Scan what you need, when you need it
-
-
-
Whole benchmark
-
CIS AWS Foundations, or the general "basic" profile.
-
-
-
One service
-
Changed one S3 policy? Scan S3 and get an answer in a
- fraction of the time.
-
-
Regions run in parallel. A ten-region account isn't ten times the wait.
-
- Coverage
-
- | Service | Checks | Service | Checks |
|---|
- | S3 | n | IAM | n |
- | EC2 | n | RDS | n |
- | CloudTrail | n | KMS | n |
- | Lambda | n | DynamoDB | n |
- | ELBv2 | n | SNS | n |
- | SQS | n | 11 services · 74 checks |
-
- See every check → docs
-
-
- Note 5 — the coverage table is the ⌘F target
- Highest-value block on the page for an evaluator. Per-service counts must be
- generated from the rule JSON via scan:validate-rules, never typed.
- A stale count here is exactly the small inaccuracy that loses a technical buyer.
-
-
- Note 6 — link out, don't inline
- Full listing of all 74 checks belongs in the docs, not on this page.
-
-
-
-
-
- §4 · Filter and slice
- Cut 400 findings down to the 8 you're working on
-
-
-
-
- Account: prod ▾
- Service: S3 ▾
- Benchmark: CIS 2.x ▾
- Severity: Critical ▾
- Status: Open ▾
- 12 results
-
-
-
- /findings?service=s3&benchmark=cis&status=open
-
-
- ↑ every filter is in the URL — bookmark it, paste it in Slack, send it to the person who owns S3
-
-
-
- Note 7 — render the URL as visible monospace, not a caption
- Ships #85, #87, #83. The URL is the section; it should not be styled as an aside.
-
-
- Note 8 — one sentence on why benchmark filtering works
- Findings record which benchmark raised them (a74a6c3), so a compliance question has
- a direct answer.
-
-
-
-
-
- §5 · Remediation
- Every finding tells you how to fix it
-
-
-
In the list
-
-
One line. No click needed.
-
-
-
On the finding
-
- - Open the RDS console
- - Modify → Connectivity
- - Public access → No
- - Apply immediately
-
-
AWS docs →
-
-
Step-by-step guidance on every critical and high finding.
-
-
- Note 9 — the split is the real product behaviour
- Ships #82. A one-liner everywhere, full steps on critical and high. Do not
- imply step-by-step exists on all 74 checks — the README is precise about this and the site must
- match it.
-
-
-
-
-
- §6 · Insights
- Where the problems actually are
-
-
-
By service
-
With a severity breakdown per service, so "42 in S3" becomes
- "12 critical in S3".
-
-
-
By benchmark
-
Which controls are failing, and how badly.
-
-
- Also: findings trend over a period, severity distribution, remediation rate.
-
-
- Note 10 — the "also" line is table stakes and gets one line
- Ships #88 and #89. Trend / distribution / remediation-rate already existed and must not get
- equal billing with the two groupings.
-
-
- Note 11 — no score, no grade, no single health number anywhere on this page
-
-
-
-
-
- §7 · Teams and isolation
- Built multi-tenant from the schema up
- Organisations · team roles · every query scoped by organisation.
- Run one instance for several clients, or several teams, without one seeing another's findings.
-
- Note 12 — short, and aimed at agencies and MSPs
- A real segment for a self-hosted scanner. It is genuinely enforced rather than aspirational, so
- we can state it flatly.
-
-
-
-
-
- §8 · What we don't do
- What TOPS doesn't do (yet)
-
- - Azure or GCP — AWS only
- - Auto-remediation — we tell you the fix, you apply it
- - Real-time alerting / webhooks — scans are on demand
- - Agent-based runtime monitoring — this is config scanning
-
- Roadmap → github.com/teemops/tops
-
- Note 13 — recommend keeping this section
- It disqualifies bad-fit visitors before they install and bounce, it is unusual enough to be
- memorable, and on an open-source project it reads as confidence. It also lets us delete the
- current page's "Real-time Alerts" and "Integrations (future)" sections honestly instead of
- leaving them as vapour.
-
-
- Note 14 — only an asset while it's accurate
- Verify every line against the roadmap before shipping.
-
-
-
-
-
- §9 · CTA
-
-
- $ bash <(curl -fsSL https://raw.githubusercontent.com/teemops/tops/develop/install.sh)
- ⧉ Copy
-
-
Read the script first → ★ Star on GitHub
-
-
Note 15 — no paid alternative offered, here or anywhere on this page
- Same block as
homepage §9. The only commercial mention on the site is
- the footer line in homepage §10.
-
-
-
-
- Removed from the current features page
-
-
Deleted
-
- - Three "Score" tiles (
../html/features.html:285, 303, 321) — feature removed
- in a246323
- - "Real-time Alerts" section — does not exist; now one line in §8
- - "Integrations (future)" section — does not exist; now one line in §8
- - "Reporting & Exports" as a headline section — demote to a line unless we can
- screenshot it
- - All "Start Free Scan" CTAs
-
-
-
-
-
-
-
- §1 · Nav
-
-
▣ TOPS
-
Features How it works Docs
-
★ Star on GitHub 1.2k
-
- Note 1 — what's missing is the point
- No Pricing item and no Login / Sign up. There is nothing to sign up for, and a
- nav link named "Pricing" on a free project invites the "so what's the catch" reflex we have
- nothing to answer with. The GitHub button is the persistent right-hand action instead.
- Sticky on scroll; collapses to hamburger + GitHub button below md.
-
-
- Note 2 — star count
- Live from the GitHub API, cached. Render the button without a count if the call fails rather
- than blocking paint.
-
-
-
-
-
- §2 · Hero
-
-
-
Find what's wrong in your AWS account. Then fix it.
-
- Open-source AWS security scanning you run yourself. 74 checks, every finding carries the
- fix, and the ones you've triaged stay triaged.
-
-
- $ bash <(curl -fsSL https://raw.githubusercontent.com/teemops/tops/develop/install.sh)
- ⧉ Copy
-
-
Docker is the whole list.
-
- ★ Star on GitHub
- Docs →
-
-
-
-
-
Findings
-
-
- All accounts ▾
- S3 ▾
- CIS ▾
-
-
-
-
-
-
-
- Note 3 — this panel replaces the security score
- The current hero is built around a 78/100 Security Score
- (../html/index.html:104). That feature was deleted in a246323
- (issue #91 — pinned at 0, could not improve). The replacement shows what we built
- instead of it: a findings register where every row has a severity, a remediation, a
- benchmark tag, and a status that persists.
-
-
- Note 4 — three different statuses, deliberately
- Open / Ignored / Resolved on screen at once is the entire pitch for issue #90 in one
- glance. Do not let this become three Opens. The cis-* tags are issue #87 made
- visible; use real rule IDs.
-
-
- Note 5 — the filter chips must match the real UI
- They are decorative here, but this panel becomes a real screenshot as soon as one is captured,
- and it must not look like a downgrade when it does.
-
-
- Note 6 — the copy button is the conversion event
- Click-to-copy with a "Copied" toast. Instrument it. Below lg the panel drops under
- the copy and the command wraps to two lines — do not hide it on mobile, people screenshot it.
-
-
-
-
-
- §3 · Proof strip
-
- 74 checks · 11 AWS services · CIS AWS Foundations ·
- Apache-2.0 · Docker Compose, nothing else
-
-
- Note 7 — all five are verifiable
- Thin band, single row, no icons. Numbers come from the rule set, not from a copywriter —
- scan:validate-rules is the source and they must be regenerated when rules change.
-
-
-
-
-
- §3b · Free. Forever. — decision pending
-
-
Free. Forever.
-
- Apache-2.0. Every check, unlimited AWS accounts, unlimited users. No trial, no seats, no
- edition above this one, and no feature we've held back to sell you later.
-
-
Read the licence
-
- Note 8 — this is the open question
- /pricing 301s here (#free). Whether the band earns homepage space is
- the last structural decision in this set — see ../pricing.md. Recommendation: keep
- it, keep it small. Every visitor arriving from a commercial CSPM carries the assumption that
- there is a catch, and one unambiguous paragraph is cheaper than losing them to that suspicion.
- It must read as a statement of fact, not a sales counter-argument: no comparison table, no
- "unlike other vendors", no exclamation marks.
-
-
-
-
-
- §4 · The problem
- Most scanners hand you a PDF. Then another one.
-
-
Every scan starts from zero
-
You triaged it last week. It's back.
-
400 findings, no idea which 3 matter
-
- Note 9 — keep the ordering aligned
- §5 answers the first two cards, §8 answers the third. If the cards get reordered in copy, the
- sections move with them.
-
-
-
-
-
- §5 · Durable findings — the differentiator
- A finding is a record, not a row in a report
-
-
Diagram — same finding across two scans,
status intact. Custom illustration.
-
-
Scan on Monday
- HIGH · Root account has no MFA
- → you mark it Ignored: "root is break-glass only"
-
Scan on Friday
- HIGH · Root account has no MFA
- → still Ignored
-
Your triage survives. So does the first-seen date.
-
-
- Note 10 — the one claim a competitor's free tier can't make
- Ships issues #81 and #90. This is the section to get right. A diagram, not a screenshot — a
- screenshot cannot show time.
-
-
- Note 11 — copy constraint
- Must not say "we track findings over time"; every vendor says that. Say what breaks without it:
- you re-triage the same thing every week. Keep the first-seen / last-seen line — "how
- long has this been open" is the question a durable record answers and a per-scan row cannot.
-
-
-
-
-
- §6 · How it works
-
-
-
① Install
-
$ bash <(curl …)
Docker Compose. No PHP, no database.
-
-
-
② Connect an account
-
A CloudFormation stack grants TOPS a read-only audit role.
-
-
-
③ Scan
-
Findings appear as they are produced.
-
-
You don't need an AWS account to try it.
-
- Note 12 — "read-only" goes in the step, not the small print
- It is the first objection a CTO has, and answering it early is worth more than a trust badge.
-
-
- Note 13 — no total time claimed here
- 7494959 instrumented scan phases to baseline where the time goes. Do not put a
- number on this page until the instrumentation supports one.
-
-
-
-
-
- §7 · Scope a scan
- Scan one service, not the whole benchmark
-
-
-
New scan
-
-
Account
-
prod-1234 ▾
-
Profile
-
CIS AWS Foundations ▾
-
Services
-
- ✓ S3IAMEC2
- RDS+7 more
-
-
Start scan
-
-
-
-
Chasing one S3 change? Scan S3.
-
Regions run in parallel, so more regions doesn't mean a longer wait.
-
-
- Note 14 — one sentence is the right budget for multi-region
- Ships #84 and #92. Parallel regions is an implementation win, not a buying reason. Becomes a
- screenshot of the real New Scan modal once captured.
-
-
-
-
-
- §8 · Insights
- Know which three things matter
-
-
-
Findings by service
-
-
…each with a severity breakdown
-
-
-
Findings by benchmark
-
- - CIS 1.x18
- - CIS 2.x40
- - CIS 3.x11
-
-
-
Click through to a filtered, shareable list →
-
- Note 15 — no total, no score, no headline metric
- Ships #88, #89 and — via the caption — #83 and #85/#87. Resist adding a single health number
- here; that instinct is what produced the security score in the first place.
-
-
- Note 16 — say "shareable", not "URL state"
- Shareable is the user-facing value of filters living in the URL.
-
-
-
-
-
- §9 · Final CTA
-
-
One command. Docker is the only prerequisite.
-
- $ bash <(curl -fsSL https://raw.githubusercontent.com/teemops/tops/develop/install.sh)
- ⧉ Copy
-
-
Read the script first → ★ Star on GitHub
-
- Note 17 — "read the script first" is a trust signal that costs nothing
- Links to the curl -o install.sh variant in the docs. Lands with exactly the
- audience we want.
-
-
-
-
-
- §10 · Footer — and the one Teem link
-
-
Product
Features
How it works
Insights
-
Docs
Install
Scanning AWS
Configuration
-
Project
GitHub
Issues
Releases
-
Legal
Licence
Trademark
Privacy
-
-
-
- Teem is the company behind the open source software.
- For AWS security auditing, view their website →
- teem.cloud
-
-
-
-
-
- TOPS is free and open source under Apache-2.0. Apache-2.0
-
-
-
- Note 18 — this band is the only commercial mention on the entire site
- Not a card, not a banner, not a CTA — a sentence and a link, below the fold of every page, in
- body-text weight. Anyone who needs a vendor will find it; nobody who just wants the software
- has to step around it.
-
-
- Note 19 — treat these as constraints, not preferences
- One placement, site-wide — footer only, never nav/hero/mid-page/banner.
- No commercial verbs — no "get support", "talk to sales", "enterprise",
- "pricing", "book a demo". rel="noopener", new tab — a visitor
- leaving for teem.cloud must not lose the install command they were about to copy.
- Wording is fixed (product-owner supplied); copywriting may fix punctuation and
- nothing else. Apache-2.0 sits below it, so the last thing on every page is the
- free-software statement rather than the company.
-
-
- Note 20 — the Red Hat split
- Forever-free software here; a company behind it for customers who need stability or help with
- setup and management. Everything about that lives on teem.cloud and is not explained
- here. Red Hat works because fedoraproject.org does not sell RHEL — the moment teemops.com
- describes support offerings, every free claim on the site reads as a funnel. The old "Company"
- footer column is renamed Project for the same reason.
-
-
-
-
-
- Removed from the current homepage
-
-
Deleted
-
- - Security Score panel (
../html/index.html:104) — the feature no longer exists
- - All "Start Free Scan" CTAs — nothing to sign up for
- - "No credit card required. Free tier available forever." — implies a paid tier above it
- - Social proof / customer logo section — no customers to name; a row of grey placeholder
- logos reads worse than no section at all
- - Pricing teaser with $/mo, and the "Pricing" nav item — there is no pricing
- - The three-card "who runs it" block from the first draft of this wireframe — replaced by
- the single footer line in §10
-
-
-
-
-
- Assets still needed
-
- | Asset | Blocking? | Note |
|---|
- | Findings list screenshot | §2 — yes | Needs realistic data with all three statuses visible |
- | Rescan diagram | §5 — yes | Custom illustration; nothing existing works |
- | New Scan modal screenshot | §7 — no | Wireframe box is adequate for review |
- | Insights screenshot | §8 — no | Same |
- | Live GitHub star count | §1 — no | Degrade to a plain button |
-
-
-
-
-
-
- Recommendation
- Delete the pricing page. Keep the URL.
-
- teemops.com sells nothing. No tiers, no managed-hosting cards, no service offers, no
- "talk to us". The software is Apache-2.0 and stays that way, and the company behind it gets
- exactly one sentence in the footer of every page.
-
-
- This page exists only because /pricing is currently in the nav and the sitemap,
- and "deleted the page" is not a complete answer for a URL people will still type, search for
- and link to.
-
-
-
-
- What replaces it
- teemops.com/pricing → 301 → teemops.com/#free
-
- A permanent redirect to a short "Free. Forever." band on the homepage, sitting
- between the proof strip (§3) and the problem section (§4).
-
-
-
-
-
Free. Forever.
-
- Apache-2.0. Every check, unlimited AWS accounts, unlimited users. No trial, no seats, no
- edition above this one, and no feature we've held back to sell you later.
-
-
Read the licence
-
-
- Note 1 — four lines and a link
- That is the whole answer. Giving it a dedicated page would make it look like a longer answer
- than it is.
-
-
- Note 2 — why keep the route at all
- "is X free" and "X pricing" are the highest-intent sceptical queries an open-source project
- gets, and they are exactly the ones a commercial competitor's comparison page will try to own.
- Landing them on a two-sentence "yes, actually free" costs one redirect rule.
-
-
- Note 3 — the open judgement call
- Does this band belong on the homepage at all? The hero already says open-source and
- self-hosted, and §3 already shows the Apache-2.0 badge; an argument exists that a whole band
- restating it protests too much. Recommendation: keep it, keep it small. If it
- is cut, point the redirect at the features-page FAQ instead of #free, so the URL
- still lands somewhere that answers the question.
-
-
-
-
- The Red Hat framing — where each half is said
- Product owner, 2026-08-02:
-
- We provide open source, forever free software, but we have a company behind this so if a
- customer needs stability and a different level of support during setup or management of the
- software, Teem will support.
-
-
-
- | Claim | Said on |
|---|
- | The software is free, forever, no held-back features | teemops.com — loudly, repeatedly |
- | A company stands behind it | teemops.com — one footer sentence, once |
- | What that company will do for you, and what it costs | teem.cloud only |
-
-
-
- Note 4 — the discipline this needs
- Red Hat works because fedoraproject.org does not sell RHEL. The moment teemops.com starts
- describing support tiers, response times or engagement models, every free claim on the site
- reads as a funnel. The footer link is load-bearing because it is the only one — it is
- a door, not a pitch.
-
-
- Note 5 — so, explicitly none of these
- No support page, no enterprise page, no contact-sales form, no "need help?" callout, no
- comparison table with a paid column. People looking to spend money are good at finding where to
- spend it.
-
-
-
-
- Consequences for the rest of the site
-
- | File / element | Action |
|---|
- | Nav "Pricing & support" item | Remove → Features · How it works · Docs + GitHub button |
- | Homepage three-card paid block | Remove (was in the first draft of this set) |
- ../pages/pricing.md — 230 lines | Delete, not rewrite |
- ../html/pricing.html — 588 lines | Delete |
- ../pricing-strategy.md — 431 lines | Move, don't delete — only written-down SMB segment analysis; plausible input for teem.cloud |
- ../content-plan.md site structure | Drop /pricing; drop /contact on the same logic |
- "free tier" wording across ../pages/*.md | Reword — "free tier" implies a paid tier above it. The word is just free |
-
-
- Note 6 — /contact is a sales channel wearing a different hat
- GitHub issues is the contact channel for a project; teem.cloud can own the rest. Flagged, not
- actioned in this set.
-
-
-
-
- Removed from the current pricing page
-
-
Deleted
-
- - Free / Starter ($149) / Pro ($449) / Business tiers — priced a SaaS we are not shipping
- - "20% off annual" — no subscription product to discount
- - Per-tier limits on AWS accounts, scan frequency, check count, history, users — none of
- these limits exist in the software, and inventing them contradicts the licence
- - "Not competing on price with DIY/open source" positioning — we are the open
- source
- - The managed-hosting and support-services cards drafted earlier in this wireframe set —
- those belong on teem.cloud, which is out of scope for
-
design/marketing/web/
-
-
-
-