Environments

Capabilities

Verify Your Rented Machines

Shared infrastructure comes with risks you can’t see. Lava verifies the infrastructure you rent, from tenant isolation to configuration and firmware, and shows exactly where you’re exposed.

Know exactly what you’re running on

Lava verifies your rented infrastructure from the inside, before your workloads run and continuously while they’re running.

Verify tenant isolation

Confirm other tenants can’t reach your workloads or data. Test isolation and cross-tenant access across compute, network, and storage; including access left behind by previous tenants.

Management PlaneHandover ResidueHost & ContainerTenant ATenant BFabric PartitioningCriticalShared ServicesNetwork Segmentation

Find provider-side risks

Find risks in the infrastructure your provider gives you, and verify it. Get clear evidence of anything that’s wrong, what it exposes, and what your provider needs to fix.

Provider reportEvidence your provider can act on, ready to sendPDF · 6 findingsIsolation and exposure reviewgpu-pool-b · 8 nodes · evidence attachedReady to sendCriticalCross-partition traffic not blocked at the switchno_partition_enforcementCriticalTenant can read other servers’ P_Keysib_cross_tenant_pkey_visibleHighBMC reachable from the tenant VLANbmc_redfish_lan_sweepHighLocal scratch RAID not sanitized on handbackst_nvme_sanitizeShare with providerRe-verified automatically after each fix

Secure what you control

Continuously check your own configuration against hardening best practices. Detect attacks, unexpected changes, and any tampering on your nodes as they happen.

Your side of the boundaryHardening on the nodes you rent, re-checked every 4 hours8 nodes · checked 20m agoRestrict outbound egress to known endpoints5 of 8 nodes can still reach any destination on the internet5 nodesDrop privileged mode on the container runtime2 nodes hand CAP_SYS_ADMIN to the workloads they run2 nodesSecure Boot enforced on every nodeThe boot chain is verified before the OS loadsFixedRoot login over SSH disabledNo direct root session on any rented nodeFixedDisk encryption keys held by you, not the providerThe provider cannot read the volumes it hosts for youFixed

Know what firmware runs under you

See the firmware running across your rented infrastructure and verify it against known-good versions and vulnerabilities. Use the evidence for security reviews and compliance.

Firmware versionsHow each model’s fleet splits across versions · × devices on eachLast scan · 12m agoDell iDRAC 9412 devicesDell R760xa BIOS412 devicesNVIDIA BlueField-3256 devicesNVIDIA SN560096 devicesWEKA cluster18 devicescurrent releasebehind the current releasecarries a known CVE

Assess your neocloud in 2 minutes