[ PLATFORM // DIGITALOCEAN ]
Security for DigitalOcean.
Lean cloud, sharp edges.
Droplets, firewalls, Kubernetes, and Spaces assessed with the same rigor as hyperscalers — sized for teams that outgrew DIY scripts.
500+
Droplets
40+
K8s clusters
Read
API token scope
14 droplets · 2 firewalls misaligned
Spaces: 1 public-read ACL
What we assess
in DigitalOcean.
Platform-native domains — not a generic cloud checklist pasted from another provider.
Droplets
SSH exposure, outdated images, monitoring agents.
Firewalls
Tag coverage, default allow rules.
Kubernetes
DOKS RBAC, public load balancers, network policies.
Spaces
ACLs, CDN origins, CORS misconfigs.
Databases
Trusted sources, TLS, connection pooling exposure.
VPC
Peering routes, NAT gateways.
Accounts
API token scopes, 2FA enforcement.
App Platform
Environment secrets, build logs leakage.
Onboarding preview
from checklist.
Steps align with NNSEC_Onboarding_Checklist — full runbook generates after discovery wizard.
- 01
Read token
Scoped PAT with read-only permissions.
- 02
Tag prod
Resource tags define assessment boundary.
- 03
Agent optional
nnsec-agent on droplets for deeper telemetry.
- 04
Scan
API poll + agent events merged.
- 05
Alerts
P1/P2 to Slack + email.
- 06
Grow tier
Add AWS/Azure when you scale past single cloud.
Tools we deploy
and integrate.
Open-source and native cloud APIs — no proprietary agent required unless noted for on-prem.
Connector · Personal access token with read scope — rotatable from DO control panel.
Framework mapping
for DigitalOcean.
Evidence exports attach findings to auditor-friendly control IDs.
SOC 2 logical access
SOC 2
GDPR
EU customer data
PCI
Smaller cardholder envs
[ TIERS ]
Connector included by tier
| foundation · $3,500 | ☑ |
| growth · $5,000 | ☑ |
| scale · $8,000 | ☑ |
| enterprise · $12,000 | ☑ |
Customer story
SSH surface −90%
Dev tools company locked bastion pattern across 120 droplets.
DevTools
FAQ
API-only works; agent adds file integrity and runtime signals.
Connect DigitalOcean to NorthSec AI
Core coverage · read-only · per-tenant KMS