Plan, approve, execute, and roll back infrastructure changes across cloud, network, identity, Kubernetes, endpoints, and security systems — from one control plane.
Nexplane is the control plane for infrastructure change.
# Patch critical Linux hosts across fleet
change_type: patch_os
targets: tag:criticality=high # 34 hosts
prechecks: disk_space, service_health
postchecks: reachability, service_health
rollback: restore_snapshot
► Lifecycle: Discover → Plan → Approve → Execute
► Blast radius: 34 hosts · 0 dependent services at risk
► Approved by: platform-lead@acme.com
✓ 34/34 hosts patched · services healthy
✓ Rollback snapshot retained · audit trail writtenWorks across your infrastructure
Terraform provisions. ServiceNow tickets. Datadog monitors. Backstage catalogs. Each tool owns a fragment. No system owns end-to-end infrastructure change execution — the gaps live between them.
Terraform, Pulumi, and CDK manage infrastructure state — but not operational changes, security remediations, or credential rotations.
ServiceNow and Jira track intent. They don't execute changes, verify results, or maintain rollback state. The gap between ticket and action is manual.
Datadog and Prometheus tell you when something broke. They don't tell you which change caused it or how to undo it safely.
The result: tribal knowledge, manual execution, no rollback plan, and an audit trail that lives in Slack.
Nexplane turns scattered infrastructure work into controlled, auditable, reversible change workflows.
Not the exotic stuff — the ordinary, high-stakes operations every team puts off because there's no safe way to do them. Here's each one, reviewable and reversible.
Access has to disappear from everywhere — AD, SSH, cloud IAM, SSO, VPN — and "everywhere" is a list nobody has in full.
one reviewed change that revokes across every system, verifies nothing was missed, and can restore access if the wrong person got caught in it.
AvailableYou can't safely rotate a shared secret until you know every service that reads it — and that list doesn't exist. Miss one and it fails silently, days later.
find every consumer, update them together, verify connectivity, and roll the whole thing back if anything can't reach the new secret.
AvailableThe patch is easy. The fear is the reboot on the box nobody fully understands, with no tested way back if it doesn't come up.
capture the exact state first, patch with pre- and post-checks, and restore the prior state if a host doesn't come back.
AvailableThe over-broad rule everyone knows is wrong — or an incident where you need to block something now. You can't prove what depends on it, and there's no clean undo.
a reviewed change with a real rollback — and for emergencies, a block that auto-expires so a temporary rule doesn't become permanent.
AvailableThe role with far more access than it uses, that nobody will touch — because you can't see what it actually uses, and tightening it wrong breaks a job at month-end.
change it through a reviewed, reversible request, so a wrong guess is a quick undo instead of a 2am reconstruction.
AvailableThe cert expiring in three weeks that fourteen services quietly depend on. Rotate it wrong and you take those services down.
rotate with the dependents mapped, verify the chain end to end, and roll back if validation fails.
AvailableYou don't touch these for years — you expect them to keep working — and then an end-of-life date, a CVE, or a vendor forces your hand. The problem was never willingness. It's that there's no safe way back if it goes wrong.
The distro hits end of life — no more security patches — so you're forced to move, on the box nobody wants to reboot, running an app whose engineers are long gone.
capture the exact machine state, upgrade reversibly, verify the app comes back, and restore the prior state in minutes if it doesn't.
AvailableThe 8-year-old app on dying hardware. Containerizing it is never just a Dockerfile — it's the dependencies, secrets, and state nobody documented, and you find out what you missed in production.
discover the app's actual runtime profile, generate a Dockerfile and Kubernetes manifests, deploy alongside the original, verify with health probes, and keep the legacy service running until you're ready to retire it.
AvailableThe brittle, load-bearing thing everyone routes around — until a dependency goes EOL, a CVE lands, or an auditor asks, and it's suddenly mandatory, on a deadline.
make the change reversible so you can actually start — snapshot, change, verify, roll back — instead of leaving it because touching it feels worse than ignoring it.
AvailableThe changes that reduce your attack surface, not in response to an incident, but before one. Each one is something most teams know they should do and never schedule. Here they're reviewable, reversible, and automated.
If your SSH CA key is old, compromised, or unknown, every certificate it ever signed is a liability. Most teams don't rotate it because the blast radius is the whole fleet.
generate a new CA, distribute the public key to all hosts, verify it's present before revoking the old one — a 7-phase operation that's safe to run because it doesn't cut anyone off until the new key is confirmed everywhere.
AvailableNew AWS accounts ship with no standard roles. Without a baseline, access proliferates — emergency credentials get created, never cleaned up, and nobody can answer "who can do what in this account."
create the standard read-only, security-audit, and break-glass roles in one reviewed change — idempotent, tagged, and rollback deletes only what was just created.
AvailableDomain Admins accumulates members over years. Stale accounts, service accounts with admin rights, and disabled-but-present users are a persistent risk that nobody reviews on a schedule.
query every privileged group, flag accounts by risk type — stale, service account with admin rights, disabled-but-present — and generate a batch of remediation change requests ready for review.
AvailableEvery enterprise has forgotten why infrastructure exists. Nexplane remembers the approvals, owners, dependencies, timelines, and rollback plans behind every change.
Most tools tell you what happened. Nexplane tells you what will happen — before you execute. Simulate blast radius, map dependency chains, and validate rollback strategy before any change touches production.
Relationships are what make changes safe or dangerous. Nexplane maps the connections between every asset so you understand dependencies before you act.
Continuous scanning surfaces prioritized, actionable recommendations. One click creates a change request — with prechecks, rollback plan, and approval gate already attached.
Every change should have a rollback plan, validation checks, last-known-good state, and audit trail. Most platforms claim rollback support. Nexplane enforces it architecturally — every change type is designed with an explicit rollback path, and the high-risk ones are live-verified against real infrastructure: the change executes, rollback triggers, and the system confirms it returned to prior state. Not mocks. Not assertions. Running code.
| Nexplane | SOAR (XSOAR, Tines) | ITSM (ServiceNow) | Runbooks (Confluence) | Terraform / Ansible | Cloud consoles (SSM) | |
|---|---|---|---|---|---|---|
| Full change lifecycle — plan, approve, execute, roll back | ✓ | ✗ (react only) | tickets only | ✗ (docs only) | ✗ (provision only) | ✗ (execute only) |
| Typed rollback per operation | ✓ | ✗ | ✗ | ✗ | partial (state / idempotent) | ✗ |
| Enforced rollback order (FILO) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Rollback verified against live infrastructure | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| Covers security ops, upgrades, and credential lifecycle | ✓ | partial | ✗ | ✗ | ✗ | partial |
| Proactive hardening + reactive response in one workflow | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
| AI agent interface (MCP) | ✓ | ✗ | ✗ | ✗ | ✗ | ✗ |
Terraform and Ansible are provisioning and automation tools — Nexplane doesn't replace them. SOAR tools react to incidents. ITSM tools track approvals. Runbooks document steps. None of them own the full change lifecycle, and none guarantee rollback in the right order.
Everything available in the UI is accessible through Nexplane's MCP server. Claude, ChatGPT, Cursor, Codex, Windsurf, and internal agents can reason about and act on infrastructure — without direct cloud access.
The agent never touches infrastructure directly. It proposes. The control plane validates, approves, executes, verifies — and can always undo.
Organized by workflow domain — not a logo wall.
Nexplane is free and open source — deploy it yourself, no license required. Drop us a line if you want a walkthrough, have a question, or just want to talk infrastructure.