The client's live topology, drawn from the same collection that produced the findings below, so the picture cannot drift from the evidence. Node borders show the worst finding severity on that resource; the badge is its finding count.
No topology captured in this run.
Each tier licenses a different agent set, so the same estate yields different coverage per tier. Select a tab to see that tier's own result.
8 of 8 licensed agents were driven against the live estate, producing 27 findings.
Agents in this tier: agent_shield, comply, conductor, conduit, phoenix, scout, sentinel, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
15 of 15 licensed agents were driven against the live estate, producing 43 findings.
Agents in this tier: agent_shield, audit, bastion, comply, conductor, conduit, forge, phoenix, predict, pulse, scout, secure_code, sentinel, shadow, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
19 of 19 licensed agents were driven against the live estate, producing 43 findings.
Agents in this tier: agent_shield, audit, baa, bastion, comply, conductor, conduit, engage, forge, hipaa, phi, phoenix, predict, pulse, scout, secure_code, sentinel, shadow, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
16 of 16 licensed agents were driven against the live estate, producing 43 findings.
Agents in this tier: agent_shield, audit, bastion, comply, conductor, conduit, forge, phoenix, predict, pulse, scout, secure_code, sentinel, shadow, telco, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
19 of 19 licensed agents were driven against the live estate, producing 43 findings.
Agents in this tier: agent_shield, aml, audit, bastion, comply, conductor, conduit, forge, fraud, kyc, phoenix, predict, pulse, scout, secure_code, sentinel, shadow, voice, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
16 of 16 licensed agents were driven against the live estate, producing 43 findings.
Agents in this tier: agent_shield, audit, bastion, comply, conductor, conduit, fedramp_cmmc, forge, phoenix, predict, pulse, scout, secure_code, sentinel, shadow, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
30 of 30 licensed agents were driven against the live estate, producing 43 findings.
Agents in this tier: agent_shield, ai_guard, aml, audit, baa, bastion, comply, conductor, conduit, databricks_lattice, datafactory_flux, engage, fedramp_cmmc, forge, fraud, hipaa, kyc, oracle_portal_pack, phi, phoenix, predict, pulse, scout, secure_code, sentinel, shadow, snowflake_lattice, telco, voice, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | TITAN agent can fix (approval-gated) |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | TITAN agent can fix (approval-gated) |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | TITAN agent can fix (approval-gated) |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | TITAN agent can fix (approval-gated) |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN must approve - raised as change request |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN must approve - raised as change request |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
22 of 22 licensed agents were driven against the live estate, producing 43 findings.
Agents in this tier: agent_shield, audit, bastion, comply, conductor, conduit, crm_shield, ehr_guard, erp_guard, fin_guard, forge, hcm_shield, hipaa, phi, phoenix, predict, pulse, scout, secure_code, sentinel, shadow, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
15 of 15 licensed agents were driven against the live estate, producing 43 findings.
Agents in this tier: agent_shield, audit, bastion, comply, conductor, conduit, forge, phoenix, predict, pulse, scout, secure_code, sentinel, shadow, watch
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
The remediation engine has a validated, reversible command for this. It still runs dry-run first and requires an explicit apply.
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/sterpfinancezkfulp | allowBlobPublicAccess=true on sterpfinancezkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | TITAN agent can fix (approval-gated) |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/sterpfinancezkfulp | anonymous blob access permitted on sterpfinancezkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | TITAN agent can fix (approval-gated) |
| CRITICAL | SCT-001 | Storage bucket / container is publicly readable agent: scout | storage/stphipatientzkfulp | allowBlobPublicAccess=true on stphipatientzkfulp | Remove public ACLs and require authenticated access. Enable bucket-level public access blocks at the account level. AWS: aws s3api put-public-access-block; Azure: az storage container set --public-access off; GCP: gsutil iam ch -d allUsers gs://<bucket> | TITAN agent can fix (approval-gated) |
| CRITICAL | SCT-010 | Storage account allows anonymous (public) blob access agent: scout | storage/stphipatientzkfulp | anonymous blob access permitted on stphipatientzkfulp | Disable anonymous access at the account level. Even if individual containers are private, account-level anonymous access is a misconfiguration risk. Azure: az storage account update --allow-blob-public-access false; AWS: account-level Block Public Access; GCP: bucket-level uniform access | TITAN agent can fix (approval-gated) |
Touches firewall, ports, identity, connectivity or deletes data. TITAN opens a change request in the customer's own ITSM with an implementation and backout plan. TITAN never approves or closes it.
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN must approve - raised as change request |
| CRITICAL | SCT-002 | Security group permits 0.0.0.0/0 on sensitive port (22, 3389, 1433, 3306, 5432, 6379, 27017) agent: scout | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Scope inbound CIDRs to specific corporate or VPN ranges. Use a bastion host or session manager for admin access. Restrict source CIDR on rule. AWS: aws ec2 revoke-security-group-ingress + add narrower rule; Azure: az network nsg rule update --source-address-prefixes <cidr> | HUMAN must approve - raised as change request |
No safe automated fix is known for this condition. Tracked for human triage.
| Severity | Detector | Finding | Resource | Observed evidence | Recommendation & fix | Who fixes it |
|---|---|---|---|---|---|---|
| CRITICAL | AUD-001 | Audit logging not enabled at platform level agent: audit | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | platform activity log not exported to retained storage | Enable audit logging on the platform. Without it, no detection or forensics is possible. AWS: enable CloudTrail multi-region; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-ent-zkfulp | nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-001 | Firewall rule allows 0.0.0.0/0 inbound on management port (22, 3389, 5985, 5986) agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Restrict management access to corporate / VPN CIDR ranges. Use bastion host or session manager for admin access. Restrict source IP. AWS: aws ec2 revoke-security-group-ingress + add CIDR-restricted rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | BAS-009 | RDP (3389) / SSH (22) / WinRM (5985-5986) directly reachable from internet agent: bastion | nsg/nsg-hc-zkfulp | nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Move admin access behind VPN, bastion host, or cloud-native session manager. Direct internet exposure of admin protocols is the #1 ransomware initial vector. AWS: SSM Session Manager; Azure: Bastion host or Just-In-Time access; GCP: IAP for TCP forwarding. Block 22/3389/5985 at edge firewall. | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/sterpfinancezkfulp | enableHttpsTrafficOnly=false on sterpfinancezkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | CMP-002 | PHI / cardholder data transmitted without TLS 1.2 or higher agent: comply | storage/stphipatientzkfulp | enableHttpsTrafficOnly=false on stphipatientzkfulp (cleartext HTTP allowed) | Enforce TLS 1.2 minimum on all endpoints handling PHI / CHD. Disable TLS 1.0 and 1.1. Reject SSL. Set minimum TLS version on load balancers, app gateways, and database connections. AWS ELB: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure: Min TLS 1.2 on App Service | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-ent-zkfulp | auto-revocable: nsg-ent-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| CRITICAL | FRG-001 | Auto-revoke 0.0.0.0/0 inbound rule on management port agent: forge | nsg/nsg-hc-zkfulp | auto-revocable: nsg-hc-zkfulp/AllowRDPAny allows * -> port(s) ['3389'] | Replace 0.0.0.0/0 source with documented corp/VPN CIDR list. Revoke offending rule. AWS: aws ec2 revoke-security-group-ingress + add scoped rule; Azure NSG: az network nsg rule update --source-address-prefixes <corp-cidr> | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | BAS-006 | Service account password configured to never expire agent: bastion | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp permits SSH password authentication (key-only not enforced) | Migrate to managed service account (gMSA) with auto-rotation, OR enforce 1-year max password age with documented rotation. AD: Convert to gMSA via New-ADServiceAccount; Azure: managed identity; AWS: IAM role for service workload | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/sterpfinancezkfulp | minimum TLS not enforced on sterpfinancezkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-010 | Auto-set minimum TLS version to 1.2 on endpoint agent: forge | storage/stphipatientzkfulp | minimum TLS not enforced on stphipatientzkfulp | Bump min TLS to 1.2. May break ancient clients (TLS 1.0/1.1) - acceptable risk per HIPAA / PCI. AWS: ELBSecurityPolicy-TLS13-1-2-2021-06; Azure App Service: minTlsVersion=1.2; verify post-change | HUMAN investigation - no safe automated fix |
| HIGH | FRG-009 | Auto-enable cloud audit logging across all regions agent: forge | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | auto-enablable: activity log export across regions | Enable provider-native audit logging with multi-region delivery to immutable bucket. AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic; GCP: enable Cloud Audit Logs | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-hc-zkfulp | purge protection disabled on kv-hc-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | PHX-001 | Last DR test was more than 12 months ago agent: phoenix | keyvault/kv-ent-zkfulp | purge protection disabled on kv-ent-zkfulp (vault contents unrecoverable after delete) | Test DR plan annually at minimum. Tier-1 systems should test more frequently (6 months). Annual DR test calendar; failover for tier-1 quarterly; document outcomes; remediate gaps. | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-ent-zkfulp | vm-lnx-ent-zkfulp has public IP 20.242.87.167 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-ent-zkfulp | vm-win-ent-zkfulp has public IP 20.230.94.2 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-lnx-hc-zkfulp | vm-lnx-hc-zkfulp has public IP 40.70.241.193 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | vm/vm-win-hc-zkfulp | vm-win-hc-zkfulp has public IP 20.22.203.132 reachable from internet | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-hc-zkfulp | kv-hc-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-006 | Compute instance has public IP and is reachable from the internet agent: scout | keyvault/kv-ent-zkfulp | kv-ent-zkfulp reachable from public network | Move sensitive workloads to private subnets. Use load balancer / API gateway as the only public ingress. Detach public IP; route ingress through ALB/Application Gateway with WAF in front | HUMAN investigation - no safe automated fix |
| HIGH | SCT-007 | Cloud audit logging not enabled (CloudTrail / Activity Log / Cloud Audit Logs) agent: scout | subscription/4f29d094-1079-44c9-acb0-4d73a7a2dd34 | no subscription activity-log diagnostic setting -> control-plane audit not exported | Enable audit logging across all regions. Ship logs to immutable storage (S3 with object-lock / Azure Storage immutable / GCS retention). AWS: aws cloudtrail create-trail --is-multi-region-trail; Azure: enable Activity Log diagnostic setting; GCP: enable Cloud Audit Logs at org level | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-hc-zkfulp | 3 secret(s) with NO expiry on kv-hc-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | CMP-013 | Encryption keys not rotated within policy period agent: comply | keyvault/kv-ent-zkfulp | 3 secret(s) with NO expiry on kv-ent-zkfulp: api-integration-key, db-admin-password, storage-connection-string | Rotate KMS keys annually for cardholder data, every 2 years for general PHI. Document rotation events. Enable automatic key rotation in cloud KMS (AWS KMS auto-rotate, Azure Key Vault key rotation policy, GCP KMS scheduled rotation) | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-hc-zkfulp | auto-rotatable: secrets without expiry on kv-hc-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | FRG-008 | Auto-rotate KMS key approaching policy expiry agent: forge | keyvault/kv-ent-zkfulp | auto-rotatable: secrets without expiry on kv-ent-zkfulp | Trigger KMS auto-rotation; verify new key version used by applications. AWS KMS: aws kms enable-key-rotation; Azure Key Vault: az keyvault key rotate; GCP KMS: scheduled rotation | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-ent-zkfulp | vnet-ent-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| MEDIUM | SCT-008 | Default VPC / VNet used for production workloads (no network segmentation) agent: scout | vnet/vnet-hc-zkfulp | vnet-hc-zkfulp subnet(s) with NO NSG bound: snet-app, snet-data | Build dedicated VPCs / VNets per environment (prod, dev, qa). Use subnets and security groups to enforce trust boundaries. Migrate workloads to a purpose-built VPC; tag default VPC for deletion | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/sterpfinancezkfulp | auto-taggable: sterpfinancezkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | FRG-005 | Auto-tag production resource missing required tags agent: forge | storage/stphipatientzkfulp | auto-taggable: stphipatientzkfulp has no tags | Apply default tags from account-level tag policy. Owner/env/cost-center inferred from naming convention or account metadata. AWS: aws resourcegroupstaggingapi tag-resources; Azure: Azure Policy modify effect | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/sterpfinancezkfulp | no tags on sterpfinancezkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | storage/stphipatientzkfulp | no tags on stphipatientzkfulp (env/owner/data-class missing) | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-ent-zkfulp | no tags on vm-lnx-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-ent-zkfulp | no tags on vm-win-ent-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-lnx-hc-zkfulp | no tags on vm-lnx-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
| LOW | SCT-009 | Production resource missing required tags (env, owner, cost-center, data-class) agent: scout | vm/vm-win-hc-zkfulp | no tags on vm-win-hc-zkfulp | Enforce tagging policy. Untagged resources cannot be inventoried for incident response or cost attribution. Apply tags via cloud-native policy: AWS Config rule + auto-remediation; Azure Policy with deny effect; GCP Org Policy | HUMAN investigation - no safe automated fix |
The host-level questions an assessor asks on a live screen-share, and the read-only command TITAN's host agent runs to answer each one with verbatim console output captured as evidence.
| # | Auditor question | Evidence command (read-only) |
|---|---|---|
| Q1 | What host am I looking at, and is its identity pinned? | hostname |
| Q2 | What is the system date, time and timezone? | date/time/tzutil |
| Q3 | Is time synchronised to an authorised NTP source? | w32tm /query /configuration and /status |
| Q4 | What is the network path off this host? | tracert |
| Q5 | Are Terminal Services / RDP policies enforced? | HKLM Terminal Services policy keys |
| Q6 | Is FIPS-compliant cryptography enabled? | Lsa\FIPSAlgorithmPolicy |
| Q7 | Are weak TLS versions (1.1) disabled and 1.2 enabled? | SCHANNEL Protocols TLS 1.1/1.2 |
| Q8 | How many cached logons are retained? | Winlogon CachedLogonsCount |
| Q9 | Is anonymous / null-session access restricted? | RestrictAnonymous, RestrictNullSessAccess |
| Q10 | Is Data Execution Prevention enabled? | NoDataExecutionPrevention |
| Q11 | Is DNSSEC validation required, and what services run? | DnsSecValidationRequired, Get-Service |
| # | Auditor question & command | Verdict | Verbatim output |
|---|---|---|---|
| Q1 | What host am I looking at, and is its identity pinned? hostname | INFO | DESKTOP-D42AL2B |
| Q2 | What is the system date, time and timezone? echo %date% %time% & tzutil /g | INFO | 2026-07-28 22:40:49 TZ=Central Standard Time |
| Q3 | Is time synchronised to an authorised NTP source? w32tm /query /configuration ; w32tm /query /status | PASS | The following error occurred: Access is denied. (0x80070005) --- STATUS --- Leap Indicator: 0(no warning) Stratum: 5 (secondary reference - syncd by (S)NTP) Precision: -23 (119.209ns per tick) Root Delay: 0.0145329s Root Dispersion: 3.8909730s ReferenceId: 0x287706E4 (source IP: 40.119.6.228) Last Successful Sync Time: 7/28/2026 8:41:08 PM Source: time.windows.com,0x9 Poll Interval: 10 (1024s) |
| Q4 | What is the network path off this host? tracert -h 5 -w 200 8.8.8.8 | INFO | Tracing route to dns.google [8.8.8.8] over a maximum of 5 hops: 1 3 ms 2 ms 6 ms dsldevice.attlocal.net [192.168.1.254] 2 78 ms 4 ms 4 ms 70.228.108.1 3 9 ms 9 ms 9 ms 71.155.13.244 4 95 ms * 379 ms 12.242.112.29 5 9 ms 8 ms 7 ms 12.255.10.100 Trace complete. |
| Q5 | Are Terminal Services / RDP policies enforced? Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows NT\Terminal Services" | FAIL | NOT CONFIGURED - no Terminal Services policy key present |
| Q6 | Is FIPS-compliant cryptography enabled? (Get-ItemProperty "HKLM:\SYSTEM\CurrentControlSet\Control\Lsa\FIPSAlgorithmPolicy").Enabled | FAIL | FIPSAlgorithmPolicy.Enabled = 0 |
| Q7 | Are weak TLS versions disabled and TLS 1.2 enabled? SCHANNEL Protocols TLS 1.1 / TLS 1.2 Server Enabled | FAIL | TLS 1.1 Server Enabled = <not set> TLS 1.2 Server Enabled = <not set> |
| Q8 | How many cached logons are retained? (Get-ItemProperty "HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon").CachedLogonsCount | FAIL | CachedLogonsCount = 10 |
| Q9 | Is anonymous / null-session access restricted? RestrictAnonymous ; RestrictNullSessAccess | FAIL | RestrictAnonymous = 0 RestrictNullSessAccess = 1 |
| Q10 | Is Data Execution Prevention enabled? (Get-ItemProperty "HKLM:\SOFTWARE\Policies\Microsoft\Windows\Explorer").NoDataExecutionPrevention | PASS | NoDataExecutionPrevention = <not set> (DEP active - no policy disabling it) |
| Q11 | Is DNSSEC validation required, and what services are running? (Get-DnsClientNrptPolicy).DnsSecValidationRequired ; Get-Service | FAIL | DnsSecValidationRequired = <no NRPT policy> --- RUNNING SERVICES (first 25) --- Name DisplayName ---- ----------- AMD Crash Defender Service AMD Crash Defender Service AMD External Events Utility AMD External Events Utility Appinfo Application Information AppXSvc AppX Deployment Service (AppXSVC) AudioEndpointBuilder Windows Audio Endpoint Builder Audiosrv Windows Audio BFE Base Filtering Engine BITS Background Intelligent Transfer Service BluetoothUserService_55cde BluetoothUserService_55cde BrokerInfrastructure Background Tasks Infrastructure Service BTAGService Bluetooth Audio Gateway Service BthAvctpSvc AVCTP service bthserv Bluetooth Support Service camsvc Capability Access Manager Service cbdhsvc_55cde cbdhsvc_55cde CDPSvc Connected Devices Platform Service CDPUserSvc_55cde CDPUserSvc_55cde ClickToRunSvc Microsoft Office Click-to-Run Service CoreMessagingRegistrar CoreMessaging CoworkVMService Claude CryptSvc Cryptographic Services DcomLaunch DCOM Server Process Launcher DeviceAssociationService Device Association Service DevQueryBroker DevQuery Background Discovery Broker Dhcp DHCP Client |
| # | Auditor question & command | Verdict | Verbatim output |
|---|---|---|---|
| Q1 | What host am I looking at, and is its identity pinned? hostname; uname -a | INFO | DESKTOP-D42AL2B MINGW64_NT-10.0-26200 DESKTOP-D42AL2B 3.6.7-fb42d713.x86_64 2026-03-29 11:44 UTC x86_64 Msys |
| Q2 | What is the system date, time and timezone? date; timedatectl | INFO | Tue Jul 28 22:41:22 CDT 2026 |
| Q3 | Is time synchronised to an authorised NTP source? timedatectl; chronyc sources | FAIL | |
| Q4 | What is the network path off this host? traceroute -m 5 8.8.8.8 | INFO | demo/linux-audit-remote.sh: line 67: traceroute: command not found demo/linux-audit-remote.sh: line 67: tracepath: command not found traceroute/tracepath not installed |
| Q5 | Is remote administrative access (SSH) hardened? sshd -T | grep permitrootlogin/passwordauthentication | FAIL | |
| Q6 | Is FIPS-compliant cryptography enabled? cat /proc/sys/crypto/fips_enabled | FAIL | fips_enabled: <not present - FIPS mode off> |
| Q7 | Are weak TLS versions disabled and TLS 1.2+ enabled? openssl version; grep MinProtocol /etc/ssl/openssl.cnf | FAIL | OpenSSL 3.5.6 7 Apr 2026 (Library: OpenSSL 3.5.6 7 Apr 2026) MinProtocol: <not set> |
| Q8 | What password ageing / length policy is enforced? grep PASS_MAX_DAYS /etc/login.defs | FAIL | <login.defs not readable> |
| Q9 | Are there empty passwords or extra UID-0 accounts? awk -F: on /etc/shadow and /etc/passwd | PASS | |
| Q10 | Is memory-protection (ASLR) enabled? sysctl kernel.randomize_va_space | FAIL | |
| Q11 | What services are running? systemctl list-units --state=running | INFO |
The assessor's equivalent of a screenshot. Each block is the verbatim Azure configuration TITAN read for that resource, sealed with a SHA-256 hash so the bytes in this report can be proved identical to what was collected. Control-plane configuration only — no blob, table or row contents are ever read.
{
"allowBlobPublicAccess": true,
"enableHttpsTrafficOnly": false,
"encryption": {
"encryptionIdentity": null,
"keySource": "Microsoft.Storage",
"keyVaultProperties": null,
"requireInfrastructureEncryption": null,
"services": {
"blob": {
"enabled": true,
"keyType": "Account",
"lastEnabledTime": "2026-07-29T00:56:52.171691+00:00"
},
"file": {
"enabled": true,
"keyType": "Account",
"lastEnabledTime": "2026-07-29T00:56:52.171691+00:00"
},
"queue": null,
"table": null
}
},
"location": "eastus2",
"minimumTlsVersion": "TLS1_0",
"name": "sterpfinancezkfulp",
"tags": {}
}{
"allowBlobPublicAccess": true,
"enableHttpsTrafficOnly": false,
"encryption": {
"encryptionIdentity": null,
"keySource": "Microsoft.Storage",
"keyVaultProperties": null,
"requireInfrastructureEncryption": null,
"services": {
"blob": {
"enabled": true,
"keyType": "Account",
"lastEnabledTime": "2026-07-29T00:52:54.734096+00:00"
},
"file": {
"enabled": true,
"keyType": "Account",
"lastEnabledTime": "2026-07-29T00:52:54.734096+00:00"
},
"queue": null,
"table": null
}
},
"location": "eastus2",
"minimumTlsVersion": "TLS1_0",
"name": "stphipatientzkfulp",
"tags": {}
}{
"location": "eastus2",
"name": "vm-lnx-ent-zkfulp",
"osProfile": {
"adminUsername": "titanadmin",
"allowExtensionOperations": true,
"computerName": "vm-lnx-ent-zkfulp",
"linuxConfiguration": {
"disablePasswordAuthentication": false,
"patchSettings": {
"assessmentMode": "ImageDefault",
"patchMode": "ImageDefault"
},
"provisionVMAgent": true
},
"requireGuestProvisionSignal": true,
"secrets": []
},
"powerState": "VM running",
"publicIps": "20.242.87.167",
"storageProfile": {
"dataDisks": [],
"diskControllerType": "SCSI",
"imageReference": {
"exactVersion": "22.04.202607140",
"offer": "0001-com-ubuntu-server-jammy",
"publisher": "Canonical",
"sku": "22_04-lts-gen2",
"version": "latest"
},
"osDisk": {
"caching": "ReadWrite",
"createOption": "FromImage",
"deleteOption": "Detach",
"diskSizeGB": 30,
"managedDisk": {
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-ent/providers/Microsoft.Compute/disks/vm-lnx-ent-zkfulp_OsDisk_1_4b31b3279a8247ae868c9cde1b1e7db3",
"resourceGroup": "rg-titandemo-ent",
"storageAccountType": "Premium_LRS"
},
"name": "vm-lnx-ent-zkfulp_OsDisk_1_4b31b3279a8247ae868c9cde1b1e7db3",
"osType": "Linux"
}
},
"tags": {}
}{
"location": "eastus2",
"name": "vm-win-ent-zkfulp",
"osProfile": {
"adminUsername": "titanadmin",
"allowExtensionOperations": true,
"computerName": "winentzkfulp",
"requireGuestProvisionSignal": true,
"secrets": [],
"windowsConfiguration": {
"enableAutomaticUpdates": true,
"enableVMAgentPlatformUpdates": true,
"patchSettings": {
"assessmentMode": "ImageDefault",
"patchMode": "AutomaticByOS"
},
"provisionVMAgent": true
}
},
"powerState": "VM running",
"publicIps": "20.230.94.2",
"storageProfile": {
"dataDisks": [],
"diskControllerType": "SCSI",
"imageReference": {
"exactVersion": "20348.5386.260711",
"offer": "WindowsServer",
"publisher": "MicrosoftWindowsServer",
"sku": "2022-datacenter-g2",
"version": "latest"
},
"osDisk": {
"caching": "ReadWrite",
"createOption": "FromImage",
"deleteOption": "Detach",
"diskSizeGB": 127,
"managedDisk": {
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-ent/providers/Microsoft.Compute/disks/vm-win-ent-zkfulp_OsDisk_1_bf6f61d358c34219bf95cc8e1fbf5569",
"resourceGroup": "rg-titandemo-ent",
"storageAccountType": "Premium_LRS"
},
"name": "vm-win-ent-zkfulp_OsDisk_1_bf6f61d358c34219bf95cc8e1fbf5569",
"osType": "Windows"
}
},
"tags": {}
}{
"location": "eastus2",
"name": "vm-lnx-hc-zkfulp",
"osProfile": {
"adminUsername": "titanadmin",
"allowExtensionOperations": true,
"computerName": "vm-lnx-hc-zkfulp",
"linuxConfiguration": {
"disablePasswordAuthentication": false,
"patchSettings": {
"assessmentMode": "ImageDefault",
"patchMode": "ImageDefault"
},
"provisionVMAgent": true
},
"requireGuestProvisionSignal": true,
"secrets": []
},
"powerState": "VM running",
"publicIps": "40.70.241.193",
"storageProfile": {
"dataDisks": [],
"diskControllerType": "SCSI",
"imageReference": {
"exactVersion": "22.04.202607140",
"offer": "0001-com-ubuntu-server-jammy",
"publisher": "Canonical",
"sku": "22_04-lts-gen2",
"version": "latest"
},
"osDisk": {
"caching": "ReadWrite",
"createOption": "FromImage",
"deleteOption": "Detach",
"diskSizeGB": 30,
"managedDisk": {
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-hc/providers/Microsoft.Compute/disks/vm-lnx-hc-zkfulp_OsDisk_1_057148093c4842c68485ddae2d3f2098",
"resourceGroup": "rg-titandemo-hc",
"storageAccountType": "Premium_LRS"
},
"name": "vm-lnx-hc-zkfulp_OsDisk_1_057148093c4842c68485ddae2d3f2098",
"osType": "Linux"
}
},
"tags": {}
}{
"location": "eastus2",
"name": "vm-win-hc-zkfulp",
"osProfile": {
"adminUsername": "titanadmin",
"allowExtensionOperations": true,
"computerName": "winhczkfulp",
"requireGuestProvisionSignal": true,
"secrets": [],
"windowsConfiguration": {
"enableAutomaticUpdates": true,
"enableVMAgentPlatformUpdates": true,
"patchSettings": {
"assessmentMode": "ImageDefault",
"patchMode": "AutomaticByOS"
},
"provisionVMAgent": true
}
},
"powerState": "VM running",
"publicIps": "20.22.203.132",
"storageProfile": {
"dataDisks": [],
"diskControllerType": "SCSI",
"imageReference": {
"exactVersion": "20348.5386.260711",
"offer": "WindowsServer",
"publisher": "MicrosoftWindowsServer",
"sku": "2022-datacenter-g2",
"version": "latest"
},
"osDisk": {
"caching": "ReadWrite",
"createOption": "FromImage",
"deleteOption": "Detach",
"diskSizeGB": 127,
"managedDisk": {
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-hc/providers/Microsoft.Compute/disks/vm-win-hc-zkfulp_OsDisk_1_afbd4478cf6e4f4698fd56b97f7e4c07",
"resourceGroup": "rg-titandemo-hc",
"storageAccountType": "Premium_LRS"
},
"name": "vm-win-hc-zkfulp_OsDisk_1_afbd4478cf6e4f4698fd56b97f7e4c07",
"osType": "Windows"
}
},
"tags": {}
}{
"location": "eastus2",
"name": "nsg-ent-zkfulp",
"securityRules": [
{
"access": "Allow",
"destinationAddressPrefix": "*",
"destinationAddressPrefixes": [],
"destinationPortRange": "3389",
"destinationPortRanges": [],
"direction": "Inbound",
"etag": "W/\"1f8b5abf-e4d0-4d60-b3c6-db133e251269\"",
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-ent/providers/Microsoft.Network/networkSecurityGroups/nsg-ent-zkfulp/securityRules/AllowRDPAny",
"name": "AllowRDPAny",
"priority": 100,
"protocol": "Tcp",
"provisioningState": "Succeeded",
"resourceGroup": "rg-titandemo-ent",
"sourceAddressPrefix": "*",
"sourceAddressPrefixes": [],
"sourcePortRange": "*",
"sourcePortRanges": [],
"type": "Microsoft.Network/networkSecurityGroups/securityRules"
},
{
"access": "Allow",
"destinationAddressPrefix": "*",
"destinationAddressPrefixes": [],
"destinationPortRange": "22",
"destinationPortRanges": [],
"direction": "Inbound",
"etag": "W/\"1f8b5abf-e4d0-4d60-b3c6-db133e251269\"",
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-ent/providers/Microsoft.Network/networkSecurityGroups/nsg-ent-zkfulp/securityRules/AllowSSHAny",
"name": "AllowSSHAny",
"priority": 110,
"protocol": "Tcp",
"provisioningState": "Succeeded",
"resourceGroup": "rg-titandemo-ent",
"sourceAddressPrefix": "*",
"sourceAddressPrefixes": [],
"sourcePortRange": "*",
"sourcePortRanges": [],
"type": "Microsoft.Network/networkSecurityGroups/securityRules"
}
]
}{
"location": "eastus2",
"name": "nsg-hc-zkfulp",
"securityRules": [
{
"access": "Allow",
"destinationAddressPrefix": "*",
"destinationAddressPrefixes": [],
"destinationPortRange": "3389",
"destinationPortRanges": [],
"direction": "Inbound",
"etag": "W/\"9725c1e8-011c-4bd5-893b-e7d6a3a0be42\"",
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-hc/providers/Microsoft.Network/networkSecurityGroups/nsg-hc-zkfulp/securityRules/AllowRDPAny",
"name": "AllowRDPAny",
"priority": 100,
"protocol": "Tcp",
"provisioningState": "Succeeded",
"resourceGroup": "rg-titandemo-hc",
"sourceAddressPrefix": "*",
"sourceAddressPrefixes": [],
"sourcePortRange": "*",
"sourcePortRanges": [],
"type": "Microsoft.Network/networkSecurityGroups/securityRules"
},
{
"access": "Allow",
"destinationAddressPrefix": "*",
"destinationAddressPrefixes": [],
"destinationPortRange": "22",
"destinationPortRanges": [],
"direction": "Inbound",
"etag": "W/\"9725c1e8-011c-4bd5-893b-e7d6a3a0be42\"",
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-hc/providers/Microsoft.Network/networkSecurityGroups/nsg-hc-zkfulp/securityRules/AllowSSHAny",
"name": "AllowSSHAny",
"priority": 110,
"protocol": "Tcp",
"provisioningState": "Succeeded",
"resourceGroup": "rg-titandemo-hc",
"sourceAddressPrefix": "*",
"sourceAddressPrefixes": [],
"sourcePortRange": "*",
"sourcePortRanges": [],
"type": "Microsoft.Network/networkSecurityGroups/securityRules"
}
]
}{
"addressSpace": {
"addressPrefixes": [
"10.20.0.0/16"
]
},
"location": "eastus2",
"name": "vnet-ent-zkfulp",
"subnets": [
{
"addressPrefix": "10.20.1.0/24",
"delegations": [],
"etag": "W/\"6a20cb6a-3efb-4a91-b983-f58c4997df0e\"",
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-ent/providers/Microsoft.Network/virtualNetworks/vnet-ent-zkfulp/subnets/snet-app",
"ipConfigurations": [
{
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/RG-TITANDEMO-ENT/providers/Microsoft.Network/networkInterfaces/VM-LNX-ENT-ZKFULPVMNIC/ipConfigurations/IPCONFIGVM-LNX-ENT-ZKFULP",
"resourceGroup": "RG-TITANDEMO-ENT"
},
{
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/RG-TITANDEMO-ENT/providers/Microsoft.Network/networkInterfaces/VM-WIN-ENT-ZKFULPVMNIC/ipConfigurations/IPCONFIGVM-WIN-ENT-ZKFULP",
"resourceGroup": "RG-TITANDEMO-ENT"
}
],
"name": "snet-app",
"privateEndpointNetworkPolicies": "Disabled",
"privateLinkServiceNetworkPolicies": "Enabled",
"provisioningState": "Succeeded",
"resourceGroup": "rg-titandemo-ent",
"type": "Microsoft.Network/virtualNetworks/subnets"
},
{
"addressPrefix": "10.20.2.0/24",
"delegations": [],
"etag": "W/\"6a20cb6a-3efb-4a91-b983-f58c4997df0e\"",
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-ent/providers/Microsoft.Network/virtualNetworks/vnet-ent-zkfulp/subnets/snet-data",
"name": "snet-data",
"privateEndpointNetworkPolicies": "Disabled",
"privateLinkServiceNetworkPolicies": "Enabled",
"provisioningState": "Succeeded",
"resourceGroup": "rg-titandemo-ent",
"type": "Microsoft.Network/virtualNetworks/subnets"
}
]
}{
"addressSpace": {
"addressPrefixes": [
"10.10.0.0/16"
]
},
"location": "eastus2",
"name": "vnet-hc-zkfulp",
"subnets": [
{
"addressPrefix": "10.10.1.0/24",
"delegations": [],
"etag": "W/\"4029938c-ec47-43c9-80a6-0a6ffeabe093\"",
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-hc/providers/Microsoft.Network/virtualNetworks/vnet-hc-zkfulp/subnets/snet-app",
"ipConfigurations": [
{
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/RG-TITANDEMO-HC/providers/Microsoft.Network/networkInterfaces/VM-LNX-HC-ZKFULPVMNIC/ipConfigurations/IPCONFIGVM-LNX-HC-ZKFULP",
"resourceGroup": "RG-TITANDEMO-HC"
},
{
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/RG-TITANDEMO-HC/providers/Microsoft.Network/networkInterfaces/VM-WIN-HC-ZKFULPVMNIC/ipConfigurations/IPCONFIGVM-WIN-HC-ZKFULP",
"resourceGroup": "RG-TITANDEMO-HC"
}
],
"name": "snet-app",
"privateEndpointNetworkPolicies": "Disabled",
"privateLinkServiceNetworkPolicies": "Enabled",
"provisioningState": "Succeeded",
"resourceGroup": "rg-titandemo-hc",
"type": "Microsoft.Network/virtualNetworks/subnets"
},
{
"addressPrefix": "10.10.2.0/24",
"delegations": [],
"etag": "W/\"4029938c-ec47-43c9-80a6-0a6ffeabe093\"",
"id": "/subscriptions/4f29d094-1079-44c9-acb0-4d73a7a2dd34/resourceGroups/rg-titandemo-hc/providers/Microsoft.Network/virtualNetworks/vnet-hc-zkfulp/subnets/snet-data",
"name": "snet-data",
"privateEndpointNetworkPolicies": "Disabled",
"privateLinkServiceNetworkPolicies": "Enabled",
"provisioningState": "Succeeded",
"resourceGroup": "rg-titandemo-hc",
"type": "Microsoft.Network/virtualNetworks/subnets"
}
]
}{
"name": "kv-hc-zkfulp",
"public": true,
"purge_protection": false,
"rbac": false,
"secrets": [
{
"expires": null,
"name": "api-integration-key"
},
{
"expires": null,
"name": "db-admin-password"
},
{
"expires": null,
"name": "storage-connection-string"
}
],
"soft_delete": true
}{
"name": "kv-ent-zkfulp",
"public": true,
"purge_protection": false,
"rbac": false,
"secrets": [
{
"expires": null,
"name": "api-integration-key"
},
{
"expires": null,
"name": "db-admin-password"
},
{
"expires": null,
"name": "storage-connection-string"
}
],
"soft_delete": true
}{
"loadBalancingRules": [],
"location": "eastus2",
"name": "lb-ent-zkfulp"
}{
"loadBalancingRules": [],
"location": "eastus2",
"name": "lb-hc-zkfulp"
}{
"location": "eastus2",
"minimumTlsVersion": "1.2",
"name": "sb-hc-zkfulp",
"sku": {
"name": "Basic",
"tier": "Basic"
}
}{
"location": "eastus2",
"minimumTlsVersion": "1.2",
"name": "sb-ent-zkfulp",
"sku": {
"name": "Basic",
"tier": "Basic"
}
}{
"ipAddress": "40.70.31.35",
"location": "eastus2",
"name": "pip-lb-ent-zkfulp",
"publicIPAllocationMethod": "Static",
"sku": {
"name": "Standard",
"tier": "Regional"
}
}{
"ipAddress": "20.242.87.167",
"location": "eastus2",
"name": "vm-lnx-ent-zkfulpPublicIP",
"publicIPAllocationMethod": "Dynamic",
"sku": {
"name": "Basic",
"tier": "Regional"
}
}{
"ipAddress": "20.230.94.2",
"location": "eastus2",
"name": "vm-win-ent-zkfulpPublicIP",
"publicIPAllocationMethod": "Dynamic",
"sku": {
"name": "Basic",
"tier": "Regional"
}
}{
"ipAddress": "20.119.170.204",
"location": "eastus2",
"name": "pip-lb-hc-zkfulp",
"publicIPAllocationMethod": "Static",
"sku": {
"name": "Standard",
"tier": "Regional"
}
}{
"ipAddress": "40.70.241.193",
"location": "eastus2",
"name": "vm-lnx-hc-zkfulpPublicIP",
"publicIPAllocationMethod": "Dynamic",
"sku": {
"name": "Basic",
"tier": "Regional"
}
}{
"ipAddress": "20.22.203.132",
"location": "eastus2",
"name": "vm-win-hc-zkfulpPublicIP",
"publicIPAllocationMethod": "Dynamic",
"sku": {
"name": "Basic",
"tier": "Regional"
}
}Read this before relying on the result. The following areas were not evaluated in this run. They are reported as not assessed, never as passed. Absence of a finding in these areas is not evidence of compliance.