Aperio
The facts below are what the maker publishes about Aperio, checked and dated. Our editors have not written about it yet.
The facts
Each one read from Aperio's own pages, with the date it was checked.
Where it runs
- Approval controls
- Agent proposals require human approval before provider-side writes, and response actions use two-person approval.checked 9 Oct 2026
- Human approval
- Agent proposals require human approval before provider-side writes, and response actions are described as human-gated with separation of duties.checked 9 Oct 2026
What it does
- Connector limits
- Okta, 1Password, Microsoft 365, and Atlassian are listed as connection-only, with their rule packs pending.checked 9 Oct 2026
- Deployment
- Aperio can be run with a self-hosted Compose deployment and requires PostgreSQL 15 or later for the documented local setup.checked 9 Oct 2026
- Detection coverage
- The repository lists detections for public GitHub repositories, Slack workspace 2FA enforcement, and several Google Workspace sharing, admin, Gmail, delegation, and OAuth risks.checked 9 Oct 2026
- Findings
- Findings support evidence persistence, severity scoring, deduplication, risk exceptions, and automatic resolution when a signal disappears on a later sync.checked 9 Oct 2026
- Incident handling
- It opens and deduplicates incidents with evidence and a replayable timeline, and can auto-resolve findings after a later sync no longer detects the signal.checked 9 Oct 2026
- License
- The repository identifies Aperio as MIT licensed.checked 9 Oct 2026
- OAuth inventory
- A per-user Google Workspace token scan catalogs third-party OAuth apps and assigns CRITICAL, HIGH, MEDIUM, or LOW risk levels based on scope sensitivity.checked 9 Oct 2026
- Purpose
- Aperio is an open-source SaaS Detection & Response platform for detecting SaaS posture risks, inventorying OAuth shadow IT, and streaming findings to security systems.checked 9 Oct 2026
- Remediation
- The repository lists working remediation handlers for suspending Okta users, resetting Okta MFA, and revoking Slack OAuth apps; other handlers are described as stubbed and pluggable.checked 9 Oct 2026
- SaaS connectors
- Built-in connectors cover GitHub, Slack, Google Workspace, Okta, 1Password, Microsoft 365, and Atlassian Jira and Confluence.checked 9 Oct 2026
- Security
- Connector credentials are encrypted at rest with AES-256-GCM; the stack also lists cookie sessions, TOTP MFA, and role-based access control.checked 9 Oct 2026
- Security controls
- The repository describes AES-256-GCM encryption for credentials, cookie sessions, TOTP MFA, role-based access control, and organization-scoped tenant isolation.checked 9 Oct 2026
- SIEM delivery
- SIEM deliveries use a durable outbox with retries and deduplication by finding and destination.checked 9 Oct 2026
- SIEM integrations
- SIEM destinations include Splunk HEC, Panther, Panopticon, Elasticsearch, Datadog Logs, generic webhooks, and JSON Lines files.checked 9 Oct 2026
- Tenant isolation
- The repository describes Aperio as multi-tenant, with organization scoping and tenant isolation enforced at route, repository, and integration layers.checked 9 Oct 2026
The company
- Founded
- 2020checked 28 Sep 2026
- Headquarters
- San Francisco, California, United Stateschecked 28 Sep 2026
- Maker
- The GitHub repository is published under the writer organization.checked 9 Oct 2026
Alternatives to Aperio
- 1
SpinOne
WebAPIExtensionLinux7.6From $3 a month - 2
Microsoft Defender for Business
AndroidiOSAPImacOS7.5 - 3
iboss Cloud
AndroidiOSWebAPI7.1 - 4
Obsidian Security
Free planWebAPIExtensionLinux7.1Free plan - 5
AppOmni
WebAPI6.7From $7,500 a year - 6
FailSafe
Free planWebAPI6.6From $9 a month