Execution graph of AWS: verified contracts, least-privilege IAM policies, pre-flight authorization.
Free
Scanned where there is a package or repository to read, and every release diffed against the tool surface we already hold.