Command Center

Posture

Total findings

1500

532 critical

Critical

532

act on these first

High

501

Agents reporting

of 0 run

Clouds assessed

Azure · AWS · GCP

Finding counts are MEASURED — each one came from a real API response about a real resource. Risk exposure is MODELLED from published industry anchors and is an estimate for prioritisation, not a prediction.

Distribution

By cloud

aws442

-417

azure333

gcp308

By environment

prod723

unclassified580

gov105

dev92

By agent

pipefix384

scout182

audit146

cmmc_readiness105

forge88

sentinel56

bastion54

agent_shield48

pulse48

ledger42

comply36

predict36

Findings, highest priority first

Severity	Agent	Finding	Resource	Cloud	Env	Control
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-cui-0920200156	AWS	unclassified	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Indirect prompt injection via documents (hidden text, metadata)	titan-proof-cui-0920200156	AWS	unclassified	OWASP LLM01; MITRE ATLAS T0011 Prompt Injection
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-dev-0920200156	AWS	dev	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-prod-0920200156	AWS	prod	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	cloudtrail	AWS	-	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-dev-0920200156	AWS	dev	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-prod-0920200156	AWS	prod	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-cui-0920200156	AWS	unclassified	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Indirect prompt injection via documents (hidden text, metadata)	titan-proof-cui-0920200156	AWS	unclassified	OWASP LLM01; MITRE ATLAS T0011 Prompt Injection
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-dev-0920200156	AWS	dev	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-prod-0920200156	AWS	prod	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	cloudtrail	AWS	-	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-dev-0920200156	AWS	dev	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	agent_shield	Direct prompt injection patterns in LLM request stream	titan-proof-prod-0920200156	AWS	prod	OWASP LLM01 Prompt Injection; NIST AI RMF GV-1.4
CRITICAL	ai_guard	Model artifact (.pkl / .pt / .gguf / .safetensors) in publicly-readable storage	titan-proof-cui-0920200156	AWS	unclassified	OWASP ML01:2023; NIST AI RMF GV-2.1
CRITICAL	ai_guard	Model API endpoint exposed without authentication	sttitanphi0920200156	AZURE	prod	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	sttitanprod0920200156	AZURE	prod	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	nsg-dev-open	AZURE	dev	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	nsg-prod-web	AZURE	prod	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	kv-titan-prod-0920200156	AZURE	prod	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	kv-titan-dev-0920200156	AZURE	dev	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	acrtitan0920200156	AZURE	unclassified	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	titan-proof-cui-0920200156	AWS	unclassified	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	titan-proof-dev-0920200156	AWS	dev	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	titan-proof-prod-0920200156	AWS	prod	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	titan-proof-open-0920200156	AWS	unclassified	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	titan-proof-dev-0920200156	GCP	dev	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	titan-proof-prod-0920200156	GCP	prod	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	default-allow-icmp	GCP	unclassified	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	default-allow-rdp	GCP	unclassified	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	default-allow-ssh	GCP	unclassified	OWASP API1:2023; OWASP ML06:2023
CRITICAL	ai_guard	Model API endpoint exposed without authentication	titan-proof-open-0920200156	GCP	unclassified	OWASP API1:2023; OWASP ML06:2023
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-cui-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-dev-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	cloudtrail	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-dev-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
HIGH	audit	Audit log retention shorter than required minimum	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX -
HIGH	audit	Audit log retention shorter than required minimum	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX -
HIGH	audit	Audit logs stored in mutable storage (deletable / editable)	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9
HIGH	audit	Audit logs stored in mutable storage (deletable / editable)	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-cui-0920200156	AWS	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-dev-0920200156	AWS	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-prod-0920200156	AWS	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	cloudtrail	AWS	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-dev-0920200156	GCP	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-prod-0920200156	GCP	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
HIGH	audit	Audit silent for 5+ minutes on production system (gap in continuous coverage)	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.6; HIPAA 164.312(b)
HIGH	audit	Audit silent for 5+ minutes on production system (gap in continuous coverage)	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.6; HIPAA 164.312(b)
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-cui-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-dev-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	cloudtrail	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-dev-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
HIGH	audit	Audit log read access not restricted to security team	nsg-prod-web	AZURE	prod	HIPAA 164.308(a)(3); NIST 800-53 AU-9; PCI-DSS 10.5.
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-cui-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-dev-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	cloudtrail	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-dev-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
HIGH	audit	Configuration / GPO / IAM change not captured in audit log	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.2.7; SOC 2 CC8.1; NIST 800-53 AU-2
HIGH	audit	Configuration / GPO / IAM change not captured in audit log	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.2.7; SOC 2 CC8.1; NIST 800-53 AU-2
HIGH	audit	Authentication failure events not logged (only success captured)	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.2.4; NIST 800-53 AU-2; HIPAA 164.312(b)
HIGH	audit	Authentication failure events not logged (only success captured)	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.2.4; NIST 800-53 AU-2; HIPAA 164.312(b)
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	nsg-dev-open	AZURE	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	nsg-prod-web	AZURE	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	titan-proof-open-0920200156	AWS	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	default-allow-icmp	GCP	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	default-allow-rdp	GCP	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	default-allow-ssh	GCP	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	titan-proof-open-0920200156	GCP	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	pip-orphan-02	AZURE	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	pip-orphan-01	AZURE	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	vm-titan-idle	AZURE	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	vol-0170633447792dca2	AWS	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	34.233.216.82	AWS	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	titan-proof-orphan-0920200156	GCP	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	titan-proof-ip-0920200156	GCP	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	Privileged AD / IAM group has member outside approved baseline	acrtitan0920200156	AZURE	prod	NIST 800-53 AC-6; CIS AD 1.1; HIPAA 164.308(a)(4)
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	nsg-dev-open	AZURE	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	nsg-prod-web	AZURE	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	titan-proof-open-0920200156	AWS	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	default-allow-icmp	GCP	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	default-allow-rdp	GCP	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	default-allow-ssh	GCP	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	titan-proof-open-0920200156	GCP	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	cmmc_readiness	AC.L2-3.1.2 — Limit system access to the transactions and functions authorized users are permitted to execute	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.1.2; DoD Assessment Methodol
CRITICAL	cmmc_readiness	AU.L2-3.3.1 — Create and retain system audit logs and records to enable monitoring, analysis, investigation an	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.3.1; DoD Assessment Methodol
CRITICAL	cmmc_readiness	CM.L2-3.4.1 — Establish and maintain baseline configurations and inventories of organizational systems	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.4.1; DoD Assessment Methodol
CRITICAL	cmmc_readiness	CM.L2-3.4.2 — Establish and enforce security configuration settings for information technology products	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.4.2; DoD Assessment Methodol
CRITICAL	cmmc_readiness	CM.L2-3.4.5 — Define, document, approve and enforce physical and logical access restrictions associated with c	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.4.5; DoD Assessment Methodol
CRITICAL	cmmc_readiness	CM.L2-3.4.6 — Employ the principle of least functionality by configuring systems to provide only essential cap	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.4.6; DoD Assessment Methodol
CRITICAL	cmmc_readiness	CM.L2-3.4.7 — Restrict, disable or prevent the use of nonessential programs, functions, ports, protocols and s	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.4.7; DoD Assessment Methodol
CRITICAL	cmmc_readiness	CM.L2-3.4.8 — Apply deny-by-exception (blacklisting) or deny-all, permit-by-exception (whitelisting) policy fo	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.4.8; DoD Assessment Methodol
CRITICAL	cmmc_readiness	IA.L2-3.5.3 — Use multifactor authentication for local and network access to privileged accounts and for netwo	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.5.3; DoD Assessment Methodol
CRITICAL	cmmc_readiness	IR.L2-3.6.1 — Establish an operational incident-handling capability (preparation, detection, analysis, contain	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.6.1; DoD Assessment Methodol
CRITICAL	cmmc_readiness	IR.L2-3.6.2 — Track, document and report incidents to designated officials and/or authorities both internal an	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.6.2; DoD Assessment Methodol
CRITICAL	cmmc_readiness	MA.L2-3.7.2 — Provide controls on the tools, techniques, mechanisms and personnel used to conduct system maint	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.7.2; DoD Assessment Methodol
CRITICAL	cmmc_readiness	MA.L2-3.7.5 — Require multifactor authentication to establish nonlocal maintenance sessions and terminate such	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.7.5; DoD Assessment Methodol
CRITICAL	cmmc_readiness	MP.L2-3.8.3 — Sanitize or destroy system media containing CUI before disposal or release for reuse	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.8.3; DoD Assessment Methodol
CRITICAL	cmmc_readiness	MP.L2-3.8.7 — Control the use of removable media on system components	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.8.7; DoD Assessment Methodol
CRITICAL	cmmc_readiness	PE.L2-3.10.1 — Limit physical access to organizational systems, equipment and operating environments to author	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.10.1; DoD Assessment Methodo
CRITICAL	cmmc_readiness	PE.L2-3.10.2 — Protect and monitor the physical facility and support infrastructure for organizational systems	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.10.2; DoD Assessment Methodo
CRITICAL	cmmc_readiness	RA.L2-3.11.2 — Scan for vulnerabilities in organizational systems and applications periodically and when new v	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.11.2; DoD Assessment Methodo
CRITICAL	cmmc_readiness	CA.L2-3.12.1 — Periodically assess the security controls in organizational systems to determine if the control	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.12.1; DoD Assessment Methodo
CRITICAL	cmmc_readiness	CA.L2-3.12.3 — Monitor security controls on an ongoing basis to ensure the continued effectiveness of the cont	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.12.3; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SC.L2-3.13.1 — Monitor, control and protect communications at the external boundaries and key internal boundar	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.13.1; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SC.L2-3.13.2 — Employ architectural designs, software development techniques and systems engineering principle	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.13.2; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SC.L2-3.13.5 — Implement subnetworks for publicly accessible system components that are physically or logicall	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.13.5; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SC.L2-3.13.6 — Deny network communications traffic by default and allow by exception	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.13.6; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SC.L2-3.13.11 — Employ FIPS-validated cryptography when used to protect the confidentiality of CUI	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.13.11; DoD Assessment Method
CRITICAL	cmmc_readiness	SC.L2-3.13.15 — Protect the authenticity of communications sessions	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.13.15; DoD Assessment Method
CRITICAL	cmmc_readiness	SI.L2-3.14.1 — Identify, report and correct system flaws in a timely manner	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.14.1; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SI.L2-3.14.2 — Provide protection from malicious code at designated locations within organizational systems	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.14.2; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SI.L2-3.14.3 — Monitor system security alerts and advisories and take action in response	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.14.3; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SI.L2-3.14.4 — Update malicious code protection mechanisms when new releases are available	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.14.4; DoD Assessment Methodo
CRITICAL	cmmc_readiness	SI.L2-3.14.6 — Monitor organizational systems, including inbound and outbound communications traffic, to detec	Microsoft 365 GCC High	AZURE	gov	NIST SP 800-171 Rev 2 3.14.6; DoD Assessment Methodo
CRITICAL	cmmc_readiness	DFARS 252.204-7021 requires a C3PAO certification. TITAN delivers readiness and a defensible self-assessment;	Microsoft 365 GCC High	AZURE	gov	DFARS 252.204-7012
CRITICAL	comply	PHI / cardholder data stored without encryption at rest	vol-0170633447792dca2	AWS	prod	HIPAA 164.312(a)(2)(iv); PCI-DSS 3.4; SOC 2 CC6.1
CRITICAL	comply	PHI / cardholder data transmitted without TLS 1.2 or higher	vol-0170633447792dca2	AWS	prod	HIPAA 164.312(e)(1); PCI-DSS 4.1; SOC 2 CC6.7
CRITICAL	comply	MFA not enforced for privileged users (admin / DBA / break-glass)	acrtitan0920200156	AZURE	prod	HIPAA 164.312(d); PCI-DSS 8.3; SOC 2 CC6.1; NIST 800
HIGH	engage	Patient access request received but not logged in tracking system	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.524
HIGH	engage	Patient access request received but not logged in tracking system	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.524
CRITICAL	fedramp_cmmc	Phishing-resistant MFA missing for privileged users	acrtitan0920200156	AZURE	prod	FedRAMP IA-2(1); CMMC IA.L2-3.5.3; NIST 800-171 3.5.
CRITICAL	forensics	A security control was switched OFF by a change	titan-proof-cui-0920200156	AWS	unclassified	NIST 800-53 CM-5, SI-4
CRITICAL	forensics	No control-plane audit trail is available for this account — azure Pay-As-You-Go	Pay-As-You-Go	AZURE	-	NIST 800-53 AU-2; PCI-DSS 10.2; HIPAA 164.312(b)
CRITICAL	forensics	No control-plane audit trail is available for this account — azure Pay-As-You-Go	Pay-As-You-Go	AZURE	-	NIST 800-53 AU-2; PCI-DSS 10.2; HIPAA 164.312(b)
CRITICAL	forensics	No control-plane audit trail is available for this account — azure Pay-As-You-Go	Pay-As-You-Go	AZURE	-	NIST 800-53 AU-2; PCI-DSS 10.2; HIPAA 164.312(b)
CRITICAL	forensics	No control-plane audit trail is available for this account — gcp My First Project	My First Project	GCP	-	NIST 800-53 AU-2; PCI-DSS 10.2; HIPAA 164.312(b)
CRITICAL	forge	Auto-revoke unexpected privileged group member	acrtitan0920200156	AZURE	prod	Maps BAS-005
CRITICAL	forge	Auto-disable vendor default account (admin/admin / sa/blank etc)	acrtitan0920200156	AZURE	prod	Maps CMP-014
CRITICAL	hipaa	PHI stored in database without encryption at rest	vol-0170633447792dca2	AWS	unclassified	HIPAA 164.312(a)(2)(iv); HIPAA Security Rule
CRITICAL	hipaa	Mobile device with PHI access not encrypted (FDE)	vol-0170633447792dca2	AWS	unclassified	HIPAA 164.312(a)(2)(iv); HHS Mobile Device Guidance
CRITICAL	hipaa	USB drive with PHI not encrypted	vol-0170633447792dca2	AWS	unclassified	HIPAA 164.312(a)(2)(iv); HIPAA Breach Notification R
CRITICAL	scout	Storage bucket / container is publicly readable	sttitanphi0920200156	AZURE	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	sttitanprod0920200156	AZURE	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	nsg-dev-open	AZURE	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	nsg-prod-web	AZURE	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	kv-titan-prod-0920200156	AZURE	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	kv-titan-dev-0920200156	AZURE	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	acrtitan0920200156	AZURE	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	titan-proof-cui-0920200156	AWS	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	titan-proof-dev-0920200156	AWS	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	titan-proof-prod-0920200156	AWS	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	titan-proof-open-0920200156	AWS	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	titan-proof-dev-0920200156	GCP	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	titan-proof-prod-0920200156	GCP	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	default-allow-icmp	GCP	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	default-allow-rdp	GCP	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	default-allow-ssh	GCP	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Storage bucket / container is publicly readable	titan-proof-open-0920200156	GCP	prod	CIS Azure 3.1; CIS AWS 2.1.5; CIS GCP 5.1; HIPAA 164
CRITICAL	scout	Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)	nsg-dev-open	AZURE	prod	CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2
CRITICAL	scout	Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)	nsg-prod-web	AZURE	prod	CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2
CRITICAL	scout	Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)	titan-proof-open-0920200156	AWS	prod	CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2
CRITICAL	scout	Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)	default-allow-icmp	GCP	prod	CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2
CRITICAL	scout	Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)	default-allow-rdp	GCP	prod	CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2
CRITICAL	scout	Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)	default-allow-ssh	GCP	prod	CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2
CRITICAL	scout	Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017)	titan-proof-open-0920200156	GCP	prod	CIS Azure 6.2; CIS AWS 5.2; CIS GCP 3.6; PCI-DSS 1.2
CRITICAL	scout	Storage account allows anonymous (public) blob access	sttitanphi0920200156	AZURE	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	sttitanprod0920200156	AZURE	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	nsg-dev-open	AZURE	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	nsg-prod-web	AZURE	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	kv-titan-prod-0920200156	AZURE	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	kv-titan-dev-0920200156	AZURE	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	acrtitan0920200156	AZURE	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	titan-proof-cui-0920200156	AWS	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	titan-proof-dev-0920200156	AWS	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	titan-proof-open-0920200156	AWS	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	titan-proof-dev-0920200156	GCP	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	default-allow-icmp	GCP	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	default-allow-rdp	GCP	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	default-allow-ssh	GCP	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	scout	Storage account allows anonymous (public) blob access	titan-proof-open-0920200156	GCP	prod	HIPAA 164.312(a)(1); PCI-DSS 7.1; CIS Azure 3.6
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	nsg-dev-open	AZURE	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	nsg-prod-web	AZURE	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	titan-proof-open-0920200156	AWS	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	default-allow-icmp	GCP	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	default-allow-rdp	GCP	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	default-allow-ssh	GCP	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986)	titan-proof-open-0920200156	GCP	prod	CIS Azure 6.1; CIS AWS 5.2; NIST 800-53 SC-7; HIPAA
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	pip-orphan-02	AZURE	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	pip-orphan-01	AZURE	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	vm-titan-idle	AZURE	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	vol-0170633447792dca2	AWS	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	34.233.216.82	AWS	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	titan-proof-orphan-0920200156	GCP	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	DNS record points to deallocated cloud resource (subdomain takeover risk)	titan-proof-ip-0920200156	GCP	prod	OWASP Subdomain Takeover; NIST 800-81r2
CRITICAL	bastion	Privileged AD / IAM group has member outside approved baseline	acrtitan0920200156	AZURE	prod	NIST 800-53 AC-6; CIS AD 1.1; HIPAA 164.308(a)(4)
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	nsg-dev-open	AZURE	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	nsg-prod-web	AZURE	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	titan-proof-open-0920200156	AWS	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	default-allow-icmp	GCP	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	default-allow-rdp	GCP	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	default-allow-ssh	GCP	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	bastion	RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet	titan-proof-open-0920200156	GCP	prod	CISA Alert TA18-106A; PCI-DSS 1.3; HIPAA 164.312(e)(
CRITICAL	forge	Auto-revoke unexpected privileged group member	acrtitan0920200156	AZURE	prod	Maps BAS-005
CRITICAL	forge	Auto-disable vendor default account (admin/admin / sa/blank etc)	acrtitan0920200156	AZURE	prod	Maps CMP-014
HIGH	pulse	Log forwarding to SIEM broken for >1 hour	titan-proof-prod-0920200156	AWS	prod	NIST 800-53 AU-4; PCI-DSS 10.5
HIGH	pulse	Log forwarding to SIEM broken for >1 hour	titan-proof-prod-0920200156	GCP	prod	NIST 800-53 AU-4; PCI-DSS 10.5
CRITICAL	pulse	SIEM not receiving logs from critical application in last 24h	titan-proof-cui-0920200156	AWS	unclassified	PCI-DSS 10.5; HIPAA 164.312(b)
CRITICAL	pulse	SIEM not receiving logs from critical application in last 24h	titan-proof-dev-0920200156	AWS	dev	PCI-DSS 10.5; HIPAA 164.312(b)
CRITICAL	pulse	SIEM not receiving logs from critical application in last 24h	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.5; HIPAA 164.312(b)
CRITICAL	pulse	SIEM not receiving logs from critical application in last 24h	cloudtrail	AWS	-	PCI-DSS 10.5; HIPAA 164.312(b)
CRITICAL	pulse	SIEM not receiving logs from critical application in last 24h	titan-proof-dev-0920200156	GCP	dev	PCI-DSS 10.5; HIPAA 164.312(b)
CRITICAL	pulse	SIEM not receiving logs from critical application in last 24h	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.5; HIPAA 164.312(b)
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-cui-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-dev-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	cloudtrail	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-dev-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
CRITICAL	audit	Audit logging not enabled at platform level	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.1; SOC 2 CC4.1; NIST 80
HIGH	audit	Audit log retention shorter than required minimum	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX -
HIGH	audit	Audit log retention shorter than required minimum	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.316(b)(2) - 6yr; PCI-DSS 10.7 - 1yr; SOX -
HIGH	audit	Audit logs stored in mutable storage (deletable / editable)	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9
HIGH	audit	Audit logs stored in mutable storage (deletable / editable)	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.5; HIPAA 164.312(c)(1); NIST 800-53 AU-9
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-cui-0920200156	AWS	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-dev-0920200156	AWS	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-prod-0920200156	AWS	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	cloudtrail	AWS	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-dev-0920200156	GCP	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
CRITICAL	audit	Audit log hash chain integrity check failed (potential tampering)	titan-proof-prod-0920200156	GCP	prod	NIST 800-53 AU-9; PCI-DSS 10.5.2; HIPAA 164.312(c)(2
HIGH	audit	Audit silent for 5+ minutes on production system (gap in continuous coverage)	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.6; HIPAA 164.312(b)
HIGH	audit	Audit silent for 5+ minutes on production system (gap in continuous coverage)	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.6; HIPAA 164.312(b)
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-cui-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-dev-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	cloudtrail	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-dev-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
CRITICAL	audit	Privileged user action not captured in audit log (sudo / RunAs / break-glass)	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.2.2; NIST 800-53 AU-12
HIGH	audit	Audit log read access not restricted to security team	nsg-prod-web	AZURE	prod	HIPAA 164.308(a)(3); NIST 800-53 AU-9; PCI-DSS 10.5.
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-cui-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-dev-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-prod-0920200156	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	cloudtrail	AWS	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-dev-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
CRITICAL	audit	PHI / cardholder data access not captured in application or DB audit log	titan-proof-prod-0920200156	GCP	prod	HIPAA 164.312(b); PCI-DSS 10.2.1
HIGH	audit	Configuration / GPO / IAM change not captured in audit log	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.2.7; SOC 2 CC8.1; NIST 800-53 AU-2
HIGH	audit	Configuration / GPO / IAM change not captured in audit log	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.2.7; SOC 2 CC8.1; NIST 800-53 AU-2
HIGH	audit	Authentication failure events not logged (only success captured)	titan-proof-prod-0920200156	AWS	prod	PCI-DSS 10.2.4; NIST 800-53 AU-2; HIPAA 164.312(b)
HIGH	audit	Authentication failure events not logged (only success captured)	titan-proof-prod-0920200156	GCP	prod	PCI-DSS 10.2.4; NIST 800-53 AU-2; HIPAA 164.312(b)
CRITICAL	comply	PHI / cardholder data stored without encryption at rest	vol-0170633447792dca2	AWS	prod	HIPAA 164.312(a)(2)(iv); PCI-DSS 3.4; SOC 2 CC6.1
CRITICAL	comply	PHI / cardholder data transmitted without TLS 1.2 or higher	vol-0170633447792dca2	AWS	prod	HIPAA 164.312(e)(1); PCI-DSS 4.1; SOC 2 CC6.7
CRITICAL	comply	MFA not enforced for privileged users (admin / DBA / break-glass)	acrtitan0920200156	AZURE	prod	HIPAA 164.312(d); PCI-DSS 8.3; SOC 2 CC6.1; NIST 800
CRITICAL	hipaa	PHI stored in database without encryption at rest	vol-0170633447792dca2	AWS	unclassified	HIPAA 164.312(a)(2)(iv); HIPAA Security Rule
CRITICAL	hipaa	Mobile device with PHI access not encrypted (FDE)	vol-0170633447792dca2	AWS	unclassified	HIPAA 164.312(a)(2)(iv); HHS Mobile Device Guidance