LAUNCH CLOUD_PRO HEALTHCARE GOVERNMENT ORACLE_PRO ENTERPRISE_APPS COMMAND CENTER RECON
Tier: CLOUD_PRO  |  Pricing: Contact sales  |  Agents reporting (11): bastion, conduit, forge, pipefix, pulse, scout, secure_code, sentinel, shadow, telco, watch  |  Scan date: 2026-09-20
700
Total Findings
250
Critical
205
High
193
Medium
52
Low
3
Clouds Scanned

FINDINGS (700) — TOP 120 SHOWN

CRITICALbastionP90BAS-209F92C6

Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)

Resource: nsg-dev-open
PROD · 2026-09-20 21:28:51
Detector: BAS-001
Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)
Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access.
Proposed fix
Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $127,329 · Blast radius: single resource
Citation: CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-2607DB99

Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)

Resource: nsg-prod-web
PROD · 2026-09-20 21:28:51
Detector: BAS-001
Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)
Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access.
Proposed fix
Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $127,329 · Blast radius: single resource
Citation: CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-445ECD36

Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)

Resource: titan-proof-open-0920160806
PROD · 2026-09-20 21:28:51
Detector: BAS-001
Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)
Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access.
Proposed fix
Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $127,329 · Blast radius: single resource
Citation: CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-BB7FE1A8

Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)

Resource: default-allow-icmp
PROD · 2026-09-20 21:28:51
Detector: BAS-001
Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)
Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access.
Proposed fix
Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $127,329 · Blast radius: single resource
Citation: CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-06656517

Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)

Resource: default-allow-rdp
PROD · 2026-09-20 21:28:51
Detector: BAS-001
Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)
Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access.
Proposed fix
Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $127,329 · Blast radius: single resource
Citation: CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-EE511CFC

Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)

Resource: default-allow-ssh
PROD · 2026-09-20 21:28:51
Detector: BAS-001
Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)
Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access.
Proposed fix
Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $127,329 · Blast radius: single resource
Citation: CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-445ECD36

Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)

Resource: titan-proof-open-0920160806
PROD · 2026-09-20 21:28:51
Detector: BAS-001
Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)
Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access.
Proposed fix
Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $127,329 · Blast radius: single resource
Citation: CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-15EF6834

DNS record points to deallocated cloud resource (subdomain takeover risk)

Resource: pip-orphan-02
PROD · 2026-09-20 21:28:51
Detector: BAS-004
DNS record points to deallocated cloud resource (subdomain takeover risk)
Remove orphan DNS records. Attacker can claim the deallocated resource and serve content under your domain.
Proposed fix
Delete CNAME / A record pointing to dead resource. Audit DNS zone for dangling records via dig + cloud resource inventory.
Effort: 60 min (~$145 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: OWASP Subdomain Takeover; NIST 800-81r2
CRITICALbastionP90BAS-30087CB3

DNS record points to deallocated cloud resource (subdomain takeover risk)

Resource: pip-orphan-01
PROD · 2026-09-20 21:28:51
Detector: BAS-004
DNS record points to deallocated cloud resource (subdomain takeover risk)
Remove orphan DNS records. Attacker can claim the deallocated resource and serve content under your domain.
Proposed fix
Delete CNAME / A record pointing to dead resource. Audit DNS zone for dangling records via dig + cloud resource inventory.
Effort: 60 min (~$145 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: OWASP Subdomain Takeover; NIST 800-81r2
CRITICALbastionP90BAS-004BBBD4

DNS record points to deallocated cloud resource (subdomain takeover risk)

Resource: vm-titan-idle
PROD · 2026-09-20 21:28:51
Detector: BAS-004
DNS record points to deallocated cloud resource (subdomain takeover risk)
Remove orphan DNS records. Attacker can claim the deallocated resource and serve content under your domain.
Proposed fix
Delete CNAME / A record pointing to dead resource. Audit DNS zone for dangling records via dig + cloud resource inventory.
Effort: 60 min (~$145 labour) · Expected annual loss: $44,390 · Blast radius: \b(vm|instance|disk|nic|function|container)\b
Citation: OWASP Subdomain Takeover; NIST 800-81r2
CRITICALbastionP90BAS-C0608CA2

DNS record points to deallocated cloud resource (subdomain takeover risk)

Resource: vol-083692f4e6e56f243
PROD · 2026-09-20 21:28:51
Detector: BAS-004
DNS record points to deallocated cloud resource (subdomain takeover risk)
Remove orphan DNS records. Attacker can claim the deallocated resource and serve content under your domain.
Proposed fix
Delete CNAME / A record pointing to dead resource. Audit DNS zone for dangling records via dig + cloud resource inventory.
Effort: 60 min (~$145 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: OWASP Subdomain Takeover; NIST 800-81r2
CRITICALbastionP90BAS-3A0708CD

DNS record points to deallocated cloud resource (subdomain takeover risk)

Resource: 3.212.57.216
PROD · 2026-09-20 21:28:51
Detector: BAS-004
DNS record points to deallocated cloud resource (subdomain takeover risk)
Remove orphan DNS records. Attacker can claim the deallocated resource and serve content under your domain.
Proposed fix
Delete CNAME / A record pointing to dead resource. Audit DNS zone for dangling records via dig + cloud resource inventory.
Effort: 60 min (~$145 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: OWASP Subdomain Takeover; NIST 800-81r2
CRITICALbastionP90BAS-ABD73699

DNS record points to deallocated cloud resource (subdomain takeover risk)

Resource: titan-proof-orphan-0920160806
PROD · 2026-09-20 21:28:51
Detector: BAS-004
DNS record points to deallocated cloud resource (subdomain takeover risk)
Remove orphan DNS records. Attacker can claim the deallocated resource and serve content under your domain.
Proposed fix
Delete CNAME / A record pointing to dead resource. Audit DNS zone for dangling records via dig + cloud resource inventory.
Effort: 60 min (~$145 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: OWASP Subdomain Takeover; NIST 800-81r2
CRITICALbastionP90BAS-59E809E3

DNS record points to deallocated cloud resource (subdomain takeover risk)

Resource: titan-proof-ip-0920160806
PROD · 2026-09-20 21:28:51
Detector: BAS-004
DNS record points to deallocated cloud resource (subdomain takeover risk)
Remove orphan DNS records. Attacker can claim the deallocated resource and serve content under your domain.
Proposed fix
Delete CNAME / A record pointing to dead resource. Audit DNS zone for dangling records via dig + cloud resource inventory.
Effort: 60 min (~$145 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: OWASP Subdomain Takeover; NIST 800-81r2
CRITICALbastionP90BAS-DF711B54

Privileged AD / IAM group has member outside approved baseline

Resource: acrtitan0920160806
PROD · 2026-09-20 21:28:51
Detector: BAS-005
Privileged AD / IAM group has member outside approved baseline
Review and revoke. Privileged group membership must match approved access list. Investigate when added and by whom.
Proposed fix
Remove from privileged group. Audit who added them via Security log Event 4728 / 4732. Document approved baseline in identity governance tool.
Effort: 240 min (~$580 labour) · Expected annual loss: $63,664 · Blast radius: single resource
Citation: NIST 800-53 AC-6; CIS AD 1.1; HIPAA 164.308(a)(4)
CRITICALbastionP90BAS-D294960F

RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet

Resource: nsg-dev-open
PROD · 2026-09-20 21:28:51
Detector: BAS-009
RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet
Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector.
Proposed fix
AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall.
Effort: 45 min (~$109 labour) · Expected annual loss: $97,664 · Blast radius: single resource
Citation: CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-8BAA24D4

RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet

Resource: nsg-prod-web
PROD · 2026-09-20 21:28:51
Detector: BAS-009
RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet
Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector.
Proposed fix
AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall.
Effort: 45 min (~$109 labour) · Expected annual loss: $97,664 · Blast radius: single resource
Citation: CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-9D1600A7

RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet

Resource: titan-proof-open-0920160806
PROD · 2026-09-20 21:28:51
Detector: BAS-009
RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet
Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector.
Proposed fix
AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall.
Effort: 45 min (~$109 labour) · Expected annual loss: $97,664 · Blast radius: single resource
Citation: CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-E4C4B7F9

RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet

Resource: default-allow-icmp
PROD · 2026-09-20 21:28:51
Detector: BAS-009
RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet
Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector.
Proposed fix
AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall.
Effort: 45 min (~$109 labour) · Expected annual loss: $97,664 · Blast radius: single resource
Citation: CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-08E0F363

RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet

Resource: default-allow-rdp
PROD · 2026-09-20 21:28:51
Detector: BAS-009
RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet
Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector.
Proposed fix
AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall.
Effort: 45 min (~$109 labour) · Expected annual loss: $97,664 · Blast radius: single resource
Citation: CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-6104C2E4

RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet

Resource: default-allow-ssh
PROD · 2026-09-20 21:28:51
Detector: BAS-009
RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet
Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector.
Proposed fix
AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall.
Effort: 45 min (~$109 labour) · Expected annual loss: $97,664 · Blast radius: single resource
Citation: CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-9D1600A7

RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet

Resource: titan-proof-open-0920160806
PROD · 2026-09-20 21:28:51
Detector: BAS-009
RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet
Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector.
Proposed fix
AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall.
Effort: 45 min (~$109 labour) · Expected annual loss: $97,664 · Blast radius: single resource
Citation: CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(1)
CRITICALforgeP90FRG-065E0682

Auto-revoke unexpected privileged group member

Resource: acrtitan0920160806
PROD · 2026-09-20 21:28:53
Detector: FRG-007
Auto-revoke unexpected privileged group member
Remove from privileged group. Trigger access review. Notify security team for investigation.
Proposed fix
AD: Remove-ADGroupMember; Azure: Remove-AzRoleAssignment; Notify security team via ticket
Effort: 240 min (~$580 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: Maps BAS-005
CRITICALforgeP90FRG-80DF45B7

Auto-disable vendor default account (admin/admin / sa/blank etc)

Resource: acrtitan0920160806
PROD · 2026-09-20 21:28:53
Detector: FRG-011
Auto-disable vendor default account (admin/admin / sa/blank etc)
Disable account. If account is required for the application, rename and set strong password.
Proposed fix
Disable in source system. Document override if account is functionally required (rare)
Effort: 10 min (~$24 labour) · Expected annual loss: $29,243 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: Maps CMP-014
CRITICALshadowP90SHD-D28AE71B

Personal cloud access key stored in repo or on endpoint

Resource: SHD-010-target
PROD · 2026-09-20 21:29:15
Detector: SHD-010
Personal cloud access key stored in repo or on endpoint
Rotate key immediately. Migrate workload to managed identity / IAM role / OIDC federation.
Proposed fix
Rotate via cloud provider; remove from repo (git filter-repo); migrate to managed identity / role
Effort: 40 min (~$97 labour) · Expected annual loss: $51,847 · Blast radius: single resource
Citation: OWASP Secrets Management Cheat Sheet; PCI-DSS 8.2
CRITICALbastionP90BAS-066C11E2

Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)

Resource: BAS-001-target
PROD · 2026-09-20 21:29:15
Detector: BAS-001
Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)
Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access.
Proposed fix
Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $127,329 · Blast radius: single resource
Citation: CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA 164.312(e)(1)
CRITICALbastionP90BAS-76D7075B

DNS record points to deallocated cloud resource (subdomain takeover risk)

Resource: BAS-004-target
PROD · 2026-09-20 21:29:15
Detector: BAS-004
DNS record points to deallocated cloud resource (subdomain takeover risk)
Remove orphan DNS records. Attacker can claim the deallocated resource and serve content under your domain.
Proposed fix
Delete CNAME / A record pointing to dead resource. Audit DNS zone for dangling records via dig + cloud resource inventory.
Effort: 60 min (~$145 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: OWASP Subdomain Takeover; NIST 800-81r2
CRITICALbastionP90BAS-7AD0FAD3

Privileged AD / IAM group has member outside approved baseline

Resource: BAS-005-target
PROD · 2026-09-20 21:29:15
Detector: BAS-005
Privileged AD / IAM group has member outside approved baseline
Review and revoke. Privileged group membership must match approved access list. Investigate when added and by whom.
Proposed fix
Remove from privileged group. Audit who added them via Security log Event 4728 / 4732. Document approved baseline in identity governance tool.
Effort: 240 min (~$580 labour) · Expected annual loss: $63,664 · Blast radius: single resource
Citation: NIST 800-53 AC-6; CIS AD 1.1; HIPAA 164.308(a)(4)
CRITICALbastionP90BAS-5A3643AA

RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet

Resource: BAS-009-target
PROD · 2026-09-20 21:29:15
Detector: BAS-009
RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet
Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector.
Proposed fix
AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall.
Effort: 45 min (~$109 labour) · Expected annual loss: $97,664 · Blast radius: single resource
Citation: CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(1)
CRITICALscoutP90SCT-7D5576B8

Storage bucket / container is publicly readable

Resource: SCT-001-target
UNKNOWN · PROD · 2026-09-20 21:29:15
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-01262F5C

Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)

Resource: SCT-002-target
UNKNOWN · PROD · 2026-09-20 21:29:15
Detector: SCT-002
Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)
Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access.
Proposed fix
Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $103,693 · Blast radius: single resource
Citation: CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2.1
CRITICALscoutP90SCT-ACCC5878

IAM user with console access does not have MFA enrolled

Resource: SCT-004-target
UNKNOWN · PROD · 2026-09-20 21:29:15
Detector: SCT-004
IAM user with console access does not have MFA enrolled
Require MFA for all human IAM users. For programmatic access, prefer SSO / federated identity over long-lived keys.
Proposed fix
Enforce MFA via account policy. AWS: SCP requiring MFA; Azure: Conditional Access policy; GCP: org policy iam.requireMFA
Effort: 40 min (~$97 labour) · Expected annual loss: $88,634 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: NIST 800-53 IA-2(1); CIS Azure 1.1; CIS AWS 1.10; HIPAA 164.312(d)
CRITICALscoutP90SCT-8F130DB8

Storage account allows anonymous (public) blob access

Resource: SCT-010-target
UNKNOWN · PROD · 2026-09-20 21:29:15
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALsentinelP90SEN-EF8AB13D

Data exfiltration size threshold exceeded (>500MB outbound to external destination)

Resource: SEN-004-target
PROD · 2026-09-20 21:29:15
Detector: SEN-004
Data exfiltration size threshold exceeded (>500MB outbound to external destination)
Block destination at firewall. Investigate user/host. Preserve forensic evidence.
Proposed fix
Block destination IP/domain. EDR isolate host. Notify IR team. File breach assessment if PHI/CHD involved
Effort: 45 min (~$109 labour) · Expected annual loss: $63,664 · Blast radius: single resource
Citation: MITRE ATT&CK TA0010; HIPAA 164.312(e)(1)
CRITICALsentinelP90SEN-EE2C8C44

Suspicious process execution detected (mimikatz / lsass dump tool / pwdump)

Resource: SEN-005-target
PROD · 2026-09-20 21:29:15
Detector: SEN-005
Suspicious process execution detected (mimikatz / lsass dump tool / pwdump)
INCIDENT. Isolate host immediately. Assume credential theft. Force domain-wide password reset for any account that authenticated from this host in last 30 days.
Proposed fix
EDR network-isolate. Pull memory dump for forensics. Reset all KRBTGT, DA, service accounts that touched this host
Effort: 60 min (~$145 labour) · Expected annual loss: $38,016 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: MITRE ATT&CK T1003; NIST 800-53 SI-3
CRITICALsentinelP90SEN-CF067A5F

Token theft / replay indicator (same token authenticated from geographically distant locations)

Resource: SEN-009-target
PROD · 2026-09-20 21:29:15
Detector: SEN-009
Token theft / replay indicator (same token authenticated from geographically distant locations)
Revoke token immediately. Force user re-auth with hardware MFA. Investigate token issuance path.
Proposed fix
Revoke session/token, terminate all related sessions, force step-up auth
Effort: 40 min (~$97 labour) · Expected annual loss: $23,457 · Blast radius: single resource
Citation: MITRE ATT&CK T1550; NIST 800-53 IA-2
CRITICALforgeP90FRG-40479BB5

Auto-revoke unexpected privileged group member

Resource: FRG-007-target
PROD · 2026-09-20 21:29:16
Detector: FRG-007
Auto-revoke unexpected privileged group member
Remove from privileged group. Trigger access review. Notify security team for investigation.
Proposed fix
AD: Remove-ADGroupMember; Azure: Remove-AzRoleAssignment; Notify security team via ticket
Effort: 240 min (~$580 labour) · Expected annual loss: $40,229 · Blast radius: single resource
Citation: Maps BAS-005
CRITICALforgeP90FRG-B7EF8422

Auto-disable vendor default account (admin/admin / sa/blank etc)

Resource: FRG-011-target
PROD · 2026-09-20 21:29:16
Detector: FRG-011
Auto-disable vendor default account (admin/admin / sa/blank etc)
Disable account. If account is required for the application, rename and set strong password.
Proposed fix
Disable in source system. Document override if account is functionally required (rare)
Effort: 10 min (~$24 labour) · Expected annual loss: $29,243 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: Maps CMP-014
CRITICALpulseP90PLS-DB4B0E81

SIEM not receiving logs from critical application in last 24h

Resource: PLS-005-target
UNCLASSIFIED · 2026-09-20 21:29:16
Detector: PLS-005
SIEM not receiving logs from critical application in last 24h
Critical app logs must reach SIEM for IR + audit. 24h gap is incident.
Proposed fix
Per-source freshness check; ops paged on stale source.
Effort: 60 min (~$145 labour) · Expected annual loss: $89,341 · Blast radius: single resource
Citation: PCI-DSS 10.5; HIPAA 164.312(b)
CRITICALconduitP90CDT-BE84D6BC

Credit-card PAN (Luhn-valid) detected in outbound HTTP body

Resource: CDT-003-target
PROD · 2026-09-20 21:29:17
Detector: CDT-003
Credit-card PAN (Luhn-valid) detected in outbound HTTP body
Block transmission. Investigate sender. PAN should only flow over PCI-scope networks to sanctioned processors.
Proposed fix
DLP: detect 13-19 digit PAN with Luhn validation; block all non-PCI-segment outbound; alert
Effort: 60 min (~$145 labour) · Expected annual loss: $51,847 · Blast radius: single resource
Citation: PCI-DSS 3.4; 4.1
CRITICALconduitP90CDT-8A54C907

Secret / API key pattern detected in outbound channel

Resource: CDT-005-target
PROD · 2026-09-20 21:29:17
Detector: CDT-005
Secret / API key pattern detected in outbound channel
Block transmission. Rotate the key. Investigate source of leak.
Proposed fix
DLP regex: detect AWS / Azure / GitHub / Stripe / generic secret patterns; block; rotate exposed credentials
Effort: 60 min (~$145 labour) · Expected annual loss: $51,847 · Blast radius: single resource
Citation: OWASP Secrets Management; PCI-DSS 8.2
CRITICALpulseP90PLS-45D2174C

SIEM not receiving logs from critical application in last 24h

Resource: titan-proof-cui-0920160806
UNCLASSIFIED · 2026-09-20 21:28:59
Detector: PLS-005
SIEM not receiving logs from critical application in last 24h
Critical app logs must reach SIEM for IR + audit. 24h gap is incident.
Proposed fix
Per-source freshness check; ops paged on stale source.
Effort: 60 min (~$145 labour) · Expected annual loss: $89,341 · Blast radius: single resource
Citation: PCI-DSS 10.5; HIPAA 164.312(b)
CRITICALpulseP90PLS-CB0DEBF1

SIEM not receiving logs from critical application in last 24h

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:28:59
Detector: PLS-005
SIEM not receiving logs from critical application in last 24h
Critical app logs must reach SIEM for IR + audit. 24h gap is incident.
Proposed fix
Per-source freshness check; ops paged on stale source.
Effort: 60 min (~$145 labour) · Expected annual loss: $89,341 · Blast radius: single resource
Citation: PCI-DSS 10.5; HIPAA 164.312(b)
CRITICALpulseP90PLS-A9D18194

SIEM not receiving logs from critical application in last 24h

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:28:59
Detector: PLS-005
SIEM not receiving logs from critical application in last 24h
Critical app logs must reach SIEM for IR + audit. 24h gap is incident.
Proposed fix
Per-source freshness check; ops paged on stale source.
Effort: 60 min (~$145 labour) · Expected annual loss: $89,341 · Blast radius: single resource
Citation: PCI-DSS 10.5; HIPAA 164.312(b)
CRITICALpulseP90PLS-53FD6387

SIEM not receiving logs from critical application in last 24h

Resource: cloudtrail
UNCLASSIFIED · 2026-09-20 21:28:59
Detector: PLS-005
SIEM not receiving logs from critical application in last 24h
Critical app logs must reach SIEM for IR + audit. 24h gap is incident.
Proposed fix
Per-source freshness check; ops paged on stale source.
Effort: 60 min (~$145 labour) · Expected annual loss: $89,341 · Blast radius: single resource
Citation: PCI-DSS 10.5; HIPAA 164.312(b)
CRITICALpulseP90PLS-CB0DEBF1

SIEM not receiving logs from critical application in last 24h

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:28:59
Detector: PLS-005
SIEM not receiving logs from critical application in last 24h
Critical app logs must reach SIEM for IR + audit. 24h gap is incident.
Proposed fix
Per-source freshness check; ops paged on stale source.
Effort: 60 min (~$145 labour) · Expected annual loss: $89,341 · Blast radius: single resource
Citation: PCI-DSS 10.5; HIPAA 164.312(b)
CRITICALpulseP90PLS-A9D18194

SIEM not receiving logs from critical application in last 24h

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:28:59
Detector: PLS-005
SIEM not receiving logs from critical application in last 24h
Critical app logs must reach SIEM for IR + audit. 24h gap is incident.
Proposed fix
Per-source freshness check; ops paged on stale source.
Effort: 60 min (~$145 labour) · Expected annual loss: $89,341 · Blast radius: single resource
Citation: PCI-DSS 10.5; HIPAA 164.312(b)
CRITICALscoutP90SCT-8D2899EA

Storage bucket / container is publicly readable

Resource: sttitanphi0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-DED42321

Storage bucket / container is publicly readable

Resource: sttitanprod0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-C29558C7

Storage bucket / container is publicly readable

Resource: nsg-dev-open
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-FDFFFFE2

Storage bucket / container is publicly readable

Resource: nsg-prod-web
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-947AC321

Storage bucket / container is publicly readable

Resource: kv-titan-prod-0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-DCB76009

Storage bucket / container is publicly readable

Resource: kv-titan-dev-0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-C618DF57

Storage bucket / container is publicly readable

Resource: acrtitan0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-4BFC760B

Storage bucket / container is publicly readable

Resource: titan-proof-cui-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-546E28C2

Storage bucket / container is publicly readable

Resource: titan-proof-dev-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-8B08EAAA

Storage bucket / container is publicly readable

Resource: titan-proof-prod-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-F51EA737

Storage bucket / container is publicly readable

Resource: titan-proof-open-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-546E28C2

Storage bucket / container is publicly readable

Resource: titan-proof-dev-0920160806
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-8B08EAAA

Storage bucket / container is publicly readable

Resource: titan-proof-prod-0920160806
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-0CE08D15

Storage bucket / container is publicly readable

Resource: default-allow-icmp
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-184C1E90

Storage bucket / container is publicly readable

Resource: default-allow-rdp
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-887C7F02

Storage bucket / container is publicly readable

Resource: default-allow-ssh
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-F51EA737

Storage bucket / container is publicly readable

Resource: titan-proof-open-0920160806
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-001
Storage bucket / container is publicly readable
Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level.
Proposed fix
AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket>
Effort: 40 min (~$97 labour) · Expected annual loss: $177,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164.312(a)(1)
CRITICALscoutP90SCT-2C1941C9

Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)

Resource: nsg-dev-open
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-002
Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)
Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access.
Proposed fix
Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $103,693 · Blast radius: single resource
Citation: CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2.1
CRITICALscoutP90SCT-E127F912

Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)

Resource: nsg-prod-web
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-002
Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)
Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access.
Proposed fix
Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $103,693 · Blast radius: single resource
Citation: CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2.1
CRITICALscoutP90SCT-052E7A76

Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)

Resource: titan-proof-open-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-002
Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)
Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access.
Proposed fix
Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $103,693 · Blast radius: single resource
Citation: CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2.1
CRITICALscoutP90SCT-9A7ECC7E

Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)

Resource: default-allow-icmp
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-002
Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)
Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access.
Proposed fix
Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $103,693 · Blast radius: single resource
Citation: CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2.1
CRITICALscoutP90SCT-5A10544F

Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)

Resource: default-allow-rdp
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-002
Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)
Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access.
Proposed fix
Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $103,693 · Blast radius: single resource
Citation: CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2.1
CRITICALscoutP90SCT-9F386210

Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)

Resource: default-allow-ssh
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-002
Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)
Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access.
Proposed fix
Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $103,693 · Blast radius: single resource
Citation: CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2.1
CRITICALscoutP90SCT-052E7A76

Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)

Resource: titan-proof-open-0920160806
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-002
Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)
Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access.
Proposed fix
Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr>
Effort: 90 min (~$218 labour) · Expected annual loss: $103,693 · Blast radius: single resource
Citation: CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2.1
CRITICALscoutP90SCT-A1724D2E

Storage account allows anonymous (public) blob access

Resource: sttitanphi0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-101AAF42

Storage account allows anonymous (public) blob access

Resource: sttitanprod0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-B302D2EE

Storage account allows anonymous (public) blob access

Resource: nsg-dev-open
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-64841EFB

Storage account allows anonymous (public) blob access

Resource: nsg-prod-web
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-2D03648C

Storage account allows anonymous (public) blob access

Resource: kv-titan-prod-0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-97F06D9B

Storage account allows anonymous (public) blob access

Resource: kv-titan-dev-0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-17DE473D

Storage account allows anonymous (public) blob access

Resource: acrtitan0920160806
AZURE · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-8B2D05A3

Storage account allows anonymous (public) blob access

Resource: titan-proof-cui-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-06FDC98C

Storage account allows anonymous (public) blob access

Resource: titan-proof-dev-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-71B222AF

Storage account allows anonymous (public) blob access

Resource: titan-proof-prod-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-7E92478D

Storage account allows anonymous (public) blob access

Resource: titan-proof-open-0920160806
AWS · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-06FDC98C

Storage account allows anonymous (public) blob access

Resource: titan-proof-dev-0920160806
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-71B222AF

Storage account allows anonymous (public) blob access

Resource: titan-proof-prod-0920160806
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-215E87D4

Storage account allows anonymous (public) blob access

Resource: default-allow-icmp
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-6DF49767

Storage account allows anonymous (public) blob access

Resource: default-allow-rdp
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-0CD2BE6F

Storage account allows anonymous (public) blob access

Resource: default-allow-ssh
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALscoutP90SCT-7E92478D

Storage account allows anonymous (public) blob access

Resource: titan-proof-open-0920160806
GCP · PROD · 2026-09-20 21:29:01
Detector: SCT-010
Storage account allows anonymous (public) blob access
Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk.
Proposed fix
Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access
Effort: 90 min (~$218 labour) · Expected annual loss: $245,268 · Blast radius: \b(resource group|vpc|vnet|cluster|workspace|project|account)\b
Citation: HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICALsecure_codeP90COD-26D43C2B

CI/CD pipeline secrets leaked to build logs

Resource: titan-proof-cui-0920160806
UNCLASSIFIED · 2026-09-20 21:29:02
Detector: COD-011
CI/CD pipeline secrets leaked to build logs
Redact secrets in log output. Use CI native secret masking. Rotate any exposed secrets.
Proposed fix
GitHub Actions: ::add-mask::; GitLab CI: variable masking; rotate exposed secrets immediately
Effort: 60 min (~$145 labour) · Expected annual loss: $15,249 · Blast radius: single resource
Citation: OWASP A09:2021; CWE-532
CRITICALsecure_codeP90COD-BEB81DA2

CI/CD pipeline secrets leaked to build logs

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:29:02
Detector: COD-011
CI/CD pipeline secrets leaked to build logs
Redact secrets in log output. Use CI native secret masking. Rotate any exposed secrets.
Proposed fix
GitHub Actions: ::add-mask::; GitLab CI: variable masking; rotate exposed secrets immediately
Effort: 60 min (~$145 labour) · Expected annual loss: $14,311 · Blast radius: single resource
Citation: OWASP A09:2021; CWE-532
CRITICALsecure_codeP90COD-2AB7BC55

CI/CD pipeline secrets leaked to build logs

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:29:02
Detector: COD-011
CI/CD pipeline secrets leaked to build logs
Redact secrets in log output. Use CI native secret masking. Rotate any exposed secrets.
Proposed fix
GitHub Actions: ::add-mask::; GitLab CI: variable masking; rotate exposed secrets immediately
Effort: 60 min (~$145 labour) · Expected annual loss: $14,311 · Blast radius: single resource
Citation: OWASP A09:2021; CWE-532
CRITICALsecure_codeP90COD-7BC0A2E1

CI/CD pipeline secrets leaked to build logs

Resource: cloudtrail
UNCLASSIFIED · 2026-09-20 21:29:02
Detector: COD-011
CI/CD pipeline secrets leaked to build logs
Redact secrets in log output. Use CI native secret masking. Rotate any exposed secrets.
Proposed fix
GitHub Actions: ::add-mask::; GitLab CI: variable masking; rotate exposed secrets immediately
Effort: 60 min (~$145 labour) · Expected annual loss: $14,311 · Blast radius: single resource
Citation: OWASP A09:2021; CWE-532
CRITICALsecure_codeP90COD-BEB81DA2

CI/CD pipeline secrets leaked to build logs

Resource: titan-proof-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:29:02
Detector: COD-011
CI/CD pipeline secrets leaked to build logs
Redact secrets in log output. Use CI native secret masking. Rotate any exposed secrets.
Proposed fix
GitHub Actions: ::add-mask::; GitLab CI: variable masking; rotate exposed secrets immediately
Effort: 60 min (~$145 labour) · Expected annual loss: $14,311 · Blast radius: single resource
Citation: OWASP A09:2021; CWE-532
CRITICALsecure_codeP90COD-2AB7BC55

CI/CD pipeline secrets leaked to build logs

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:29:02
Detector: COD-011
CI/CD pipeline secrets leaked to build logs
Redact secrets in log output. Use CI native secret masking. Rotate any exposed secrets.
Proposed fix
GitHub Actions: ::add-mask::; GitLab CI: variable masking; rotate exposed secrets immediately
Effort: 60 min (~$145 labour) · Expected annual loss: $14,311 · Blast radius: single resource
Citation: OWASP A09:2021; CWE-532
CRITICALtelcoP90TLC-8D72567D

TR-069 / CWMP management interface exposed to internet

Resource: titan-proof-cui-0920160806
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Expected annual loss: $30,498 · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALtelcoP90TLC-6D656309

TR-069 / CWMP management interface exposed to internet

Resource: sttitanphi0920160806
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALtelcoP90TLC-A62C471F

TR-069 / CWMP management interface exposed to internet

Resource: sttitanprod0920160806
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALtelcoP90TLC-48D1EDAB

TR-069 / CWMP management interface exposed to internet

Resource: nsg-prod-web
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALtelcoP90TLC-88123CE3

TR-069 / CWMP management interface exposed to internet

Resource: kv-titan-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALtelcoP90TLC-C41ACC75

TR-069 / CWMP management interface exposed to internet

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALtelcoP90TLC-C41ACC75

TR-069 / CWMP management interface exposed to internet

Resource: titan-proof-prod-0920160806
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALforgeP90FRG-E6D9BED6

Auto-revoke 0.0.0.0/0 inbound rule on management port

Resource: nsg-dev-open
PROD · 2026-09-20 21:28:53
Detector: FRG-001
Auto-revoke 0.0.0.0/0 inbound rule on management port
Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule.
Proposed fix
AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Blast radius: single resource
Citation: Maps SCT-002 / BAS-001
CRITICALforgeP90FRG-D505B6F0

Auto-revoke 0.0.0.0/0 inbound rule on management port

Resource: nsg-prod-web
PROD · 2026-09-20 21:28:53
Detector: FRG-001
Auto-revoke 0.0.0.0/0 inbound rule on management port
Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule.
Proposed fix
AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Blast radius: single resource
Citation: Maps SCT-002 / BAS-001
CRITICALforgeP90FRG-CA9E990D

Auto-revoke 0.0.0.0/0 inbound rule on management port

Resource: titan-proof-open-0920160806
PROD · 2026-09-20 21:28:53
Detector: FRG-001
Auto-revoke 0.0.0.0/0 inbound rule on management port
Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule.
Proposed fix
AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Blast radius: single resource
Citation: Maps SCT-002 / BAS-001
CRITICALforgeP90FRG-4AF507AA

Auto-revoke 0.0.0.0/0 inbound rule on management port

Resource: default-allow-icmp
PROD · 2026-09-20 21:28:53
Detector: FRG-001
Auto-revoke 0.0.0.0/0 inbound rule on management port
Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule.
Proposed fix
AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Blast radius: single resource
Citation: Maps SCT-002 / BAS-001
CRITICALforgeP90FRG-5CA37A3A

Auto-revoke 0.0.0.0/0 inbound rule on management port

Resource: default-allow-rdp
PROD · 2026-09-20 21:28:53
Detector: FRG-001
Auto-revoke 0.0.0.0/0 inbound rule on management port
Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule.
Proposed fix
AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Blast radius: single resource
Citation: Maps SCT-002 / BAS-001
CRITICALforgeP90FRG-9979E8A0

Auto-revoke 0.0.0.0/0 inbound rule on management port

Resource: default-allow-ssh
PROD · 2026-09-20 21:28:53
Detector: FRG-001
Auto-revoke 0.0.0.0/0 inbound rule on management port
Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule.
Proposed fix
AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Blast radius: single resource
Citation: Maps SCT-002 / BAS-001
CRITICALforgeP90FRG-CA9E990D

Auto-revoke 0.0.0.0/0 inbound rule on management port

Resource: titan-proof-open-0920160806
PROD · 2026-09-20 21:28:53
Detector: FRG-001
Auto-revoke 0.0.0.0/0 inbound rule on management port
Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule.
Proposed fix
AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Blast radius: single resource
Citation: Maps SCT-002 / BAS-001
CRITICALsentinelP90SEN-DD33ECC3

Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in

Resource: SEN-014-target
PROD · 2026-09-20 21:29:15
Detector: SEN-014
Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in
Restrict the rule to known CIDRs, a bastion, or just-in-time access.
Proposed fix
Azure: az network nsg rule update --source-address-prefixes <cidr> | AWS: aws ec2 revoke-security-group-ingress --cidr 0.0.0.0/0 | GCP: gcloud compute firewall-rules update --source-ranges <cidr>
Effort: 90 min (~$218 labour) · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: MITRE ATT&CK T1190, T1133; CIS 4.1 / 5.2; NIST 800-53 SC-7
CRITICALforgeP90FRG-B08620BC

Auto-revoke 0.0.0.0/0 inbound rule on management port

Resource: FRG-001-target
PROD · 2026-09-20 21:29:16
Detector: FRG-001
Auto-revoke 0.0.0.0/0 inbound rule on management port
Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule.
Proposed fix
AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr>
Effort: 90 min (~$218 labour) · Blast radius: single resource
Citation: Maps SCT-002 / BAS-001
CRITICALsentinelP90SEN-E7B9A185

Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in

Resource: nsg-dev-open
AZURE · PROD · 2026-09-20 21:29:02
Detector: SEN-014
inbound rule allows 0.0.0.0/0 on port(s) ['22', '3389']
Restrict the rule to known CIDRs, a bastion, or just-in-time access.
Proposed fix
Azure: az network nsg rule update --source-address-prefixes <cidr> | AWS: aws ec2 revoke-security-group-ingress --cidr 0.0.0.0/0 | GCP: gcloud compute firewall-rules update --source-ranges <cidr>
Effort: 90 min (~$218 labour) · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: MITRE ATT&CK T1190, T1133; CIS 4.1 / 5.2; NIST 800-53 SC-7
CRITICALsentinelP90SEN-C42C6CC2

Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in

Resource: nsg-prod-web
AZURE · PROD · 2026-09-20 21:29:02
Detector: SEN-014
inbound rule allows 0.0.0.0/0 on port(s) ['22', '3389']
Restrict the rule to known CIDRs, a bastion, or just-in-time access.
Proposed fix
Azure: az network nsg rule update --source-address-prefixes <cidr> | AWS: aws ec2 revoke-security-group-ingress --cidr 0.0.0.0/0 | GCP: gcloud compute firewall-rules update --source-ranges <cidr>
Effort: 90 min (~$218 labour) · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: MITRE ATT&CK T1190, T1133; CIS 4.1 / 5.2; NIST 800-53 SC-7
CRITICALsentinelP90SEN-018CEE17

Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in

Resource: titan-proof-open-0920160806
AWS · PROD · 2026-09-20 21:29:02
Detector: SEN-014
inbound rule allows 0.0.0.0/0 on port(s) ['22', '3389']
Restrict the rule to known CIDRs, a bastion, or just-in-time access.
Proposed fix
Azure: az network nsg rule update --source-address-prefixes <cidr> | AWS: aws ec2 revoke-security-group-ingress --cidr 0.0.0.0/0 | GCP: gcloud compute firewall-rules update --source-ranges <cidr>
Effort: 90 min (~$218 labour) · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: MITRE ATT&CK T1190, T1133; CIS 4.1 / 5.2; NIST 800-53 SC-7
CRITICALsentinelP90SEN-A1E6D0B0

Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in

Resource: default-allow-icmp
GCP · PROD · 2026-09-20 21:29:02
Detector: SEN-014
inbound rule allows 0.0.0.0/0 on port(s) []
Restrict the rule to known CIDRs, a bastion, or just-in-time access.
Proposed fix
Azure: az network nsg rule update --source-address-prefixes <cidr> | AWS: aws ec2 revoke-security-group-ingress --cidr 0.0.0.0/0 | GCP: gcloud compute firewall-rules update --source-ranges <cidr>
Effort: 90 min (~$218 labour) · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: MITRE ATT&CK T1190, T1133; CIS 4.1 / 5.2; NIST 800-53 SC-7
CRITICALsentinelP90SEN-74BD7B7C

Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in

Resource: default-allow-rdp
GCP · PROD · 2026-09-20 21:29:02
Detector: SEN-014
inbound rule allows 0.0.0.0/0 on port(s) ['3389']
Restrict the rule to known CIDRs, a bastion, or just-in-time access.
Proposed fix
Azure: az network nsg rule update --source-address-prefixes <cidr> | AWS: aws ec2 revoke-security-group-ingress --cidr 0.0.0.0/0 | GCP: gcloud compute firewall-rules update --source-ranges <cidr>
Effort: 90 min (~$218 labour) · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: MITRE ATT&CK T1190, T1133; CIS 4.1 / 5.2; NIST 800-53 SC-7
CRITICALsentinelP90SEN-BE32BC6A

Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in

Resource: default-allow-ssh
GCP · PROD · 2026-09-20 21:29:02
Detector: SEN-014
inbound rule allows 0.0.0.0/0 on port(s) ['22']
Restrict the rule to known CIDRs, a bastion, or just-in-time access.
Proposed fix
Azure: az network nsg rule update --source-address-prefixes <cidr> | AWS: aws ec2 revoke-security-group-ingress --cidr 0.0.0.0/0 | GCP: gcloud compute firewall-rules update --source-ranges <cidr>
Effort: 90 min (~$218 labour) · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: MITRE ATT&CK T1190, T1133; CIS 4.1 / 5.2; NIST 800-53 SC-7
CRITICALsentinelP90SEN-018CEE17

Admin / database port reachable from any source address (0.0.0.0/0): spoofed or real, everything gets in

Resource: titan-proof-open-0920160806
GCP · PROD · 2026-09-20 21:29:02
Detector: SEN-014
inbound rule allows 0.0.0.0/0 on port(s) ['22', '3389']
Restrict the rule to known CIDRs, a bastion, or just-in-time access.
Proposed fix
Azure: az network nsg rule update --source-address-prefixes <cidr> | AWS: aws ec2 revoke-security-group-ingress --cidr 0.0.0.0/0 | GCP: gcloud compute firewall-rules update --source-ranges <cidr>
Effort: 90 min (~$218 labour) · Blast radius: \b(database|storage account|bucket|key vault|namespace)\b
Citation: MITRE ATT&CK T1190, T1133; CIS 4.1 / 5.2; NIST 800-53 SC-7
CRITICALtelcoP90TLC-0E8F9D98

TR-069 / CWMP management interface exposed to internet

Resource: nsg-dev-open
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALtelcoP90TLC-3F808EAA

TR-069 / CWMP management interface exposed to internet

Resource: kv-titan-dev-0920160806
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
CRITICALtelcoP90TLC-99211051

TR-069 / CWMP management interface exposed to internet

Resource: acrtitan0920160806
UNCLASSIFIED · 2026-09-20 21:29:05
Detector: TLC-010
TR-069 / CWMP management interface exposed to internet
TR-069 internet exposure = mass takeover risk. Restrict to ACS subnet and TLS-mutual-authenticated.
Proposed fix
Drop port 7547 from internet-facing interfaces; mTLS to ACS only; rotate certs annually.
Effort: 60 min (~$145 labour) · Blast radius: single resource
Citation: Broadband Forum TR-069; CISA Advisory 2024
MOREfull run

580 further findings in this run

Showing the 120 highest-severity of 700 findings for this tier. The complete set ships in the customer report and is available in the Command Center.
TITAN AI - CLOUD_PRO tier live proof - generated 2026-09-20
All 700 findings auto-forwarded to Jira (Incident + Change Request tables)
titanaisec.com