Most tools attempt to a mix of both and at least claim that they could detect security violations (especially since you can customize which controls you want to look for).

Your site could really benefit from explaining what your differentiation is. Drawing the "path" sounds very cool, especially if you can do things like showing how an exposed VM could compromise an S3 bucket (via the VM's role).