Detect → Contain
Continuously evaluate Organization activity against code-defined policies and automatically contain risky principals — SCP attach, IAM deny, or key deactivation.
Govern your AWS Organization with code-defined SCPs
0scp brings detection, automatic containment, cost budgets, an attack-graph, and an optional AI autopilot to your AWS Organization — running entirely inside your own account.
Cost budgets
Per-user and per-group spend budgets. Notify, report, or block over-budget principals using the same containment engine.
Attack-graph
A live graph of principals, resources, and cross-account relationships so you can reason about blast radius before you act.
AI autopilot
An opt-in Amazon Bedrock assistant that analyzes platform data and proposes or auto-enforces guardrails — fully auditable.