Skip to content
HANU
Deploy Hanu
Menu

By role

Startups and small teams

You are the security team. Hanu is the part of that job a small team cannot do by hand — one stack, opinionated defaults, nothing that needs a dedicated person to operate.

security platform for startupssecurity without a security teamself-hosted security for startups

What changes

One stack in your own cloud covers cloud, code, identity and CI/CD, with defaults that stay quiet until a chain actually forms. You get a security function before you can afford to hire one.

Five tools is not a security programme

A solo engineer cannot run a CSPM, a scanner, a secret detector and an identity review in four consoles. Hanu ingests all of it into one graph, so the review is one queue instead of four.

The quiet default matters more than the feature list

Tuning rules is the thing small teams never get to. Correlation is time-windowed and history-relative, so an alert means a chain formed — not that a checkbox is unticked on a bucket nobody uses.

Cost that does not scale with your log volume

Self-hosted Community edition costs nothing to run in production. There is no per-GB ingest meter waiting to punish the month you turn on VPC flow logs.

A reasonable first fortnight

Not a migration plan — the first two weeks, in the order that produces something useful fastest.

  1. Deploy the stack from docker-compose.selfhost.yml and connect read-only AWS, Azure or GCP roles.
  2. Connect GitHub so findings land as check runs on pull requests rather than in a console you forget to open.
  3. Turn on the supply-chain and secret-hygiene packs first; they catch the failures that end small companies.
  4. Read the first compound risks together — the evidence trail doubles as a security briefing for the team.

Questions this role tends to ask

We have no security engineer. How much work is this?
One docker compose up on a host you already have, three read-only cloud roles, and a GitHub connection. The default rule set is deliberately conservative, so the queue stays short enough for an engineer to work alongside their normal job. Most teams run the first full scan on day one and the first real fix on day two.
What does it cost at our size?
Nothing, if you self-host. The Community edition is the full detection and correlation engine under the Elastic License 2.0, with no seat count, no ingest meter and no time limit. Paid editions exist for multi-cloud depth, the continuous detection feed and SOC features — none of which a five-person team needs on day one.
Is a self-hosted stack realistic without an ops team?
The documented minimum is 2 vCPU, 6 GB RAM and 10 GB disk for all eight services, including its own Postgres, Neo4j, Redis and MinIO. If you can run a container on a box, you can run this. There is no cluster requirement and no external service to depend on.
What should we turn on first?
Secret hygiene, supply-chain provenance and the pull-request gate. Between them they catch the failures that actually end small companies: a credential committed to a public repository, a dependency that changed hands, and a build step nobody reviewed.

What it is not

Hanu is not a SIEM and does not try to be one — it correlates and hands the result to the response process you already run. It is not a certified SOC 2 Type II service for self-hosted customers; the evidence engines and audit trail support your own controls. And it does not cover Oracle Cloud, which exists in the codebase as stubs only.

Run it in your own account

One Docker Compose stack, your datastores, read-only credentials into your clouds. The Community edition is free to run in production.

Deploy HanuSee what is paid