Every check maps to a CIS / NIST / CSA control and ships with severity, blast radius, and a recommended FORGE auto-fix. No false-positive noise — severity is calibrated against CVSS and exploitability.
Azure Blob containers set to public read, Azure Storage containers with public-read ACLs or bucket policies, Azure Storage with allUsers / allAuthenticatedUsers grants. SCOUT enumerates every container and tests effective public exposure, not just the flag.
Users with Owner or *:* policies, role assignments granted at subscription scope when resource scope would suffice, MFA-disabled global admins, custom roles with wildcard actions, and service principals running as Contributor on production subscriptions.
Azure SQL servers with firewall rule 0.0.0.0/0, Azure SQL instances publicly accessible, MongoDB and Cosmos DB without VNET integration, Redis caches without auth.
VMs without Azure Disk Encryption, storage accounts without infrastructure encryption, SQL TDE disabled, Key Vault secrets stored without HSM backing, secret rotation policies missing, customer-managed keys not enablger values without KMS rotation.
Azure App Services with no Private Endpoint, Kubernetes API servers reachable from the internet, Cosmos DB / DynamoDB / Spanner with public network access enabled.
App Service environment variables containing connection strings, API keys, and JWT secrets. SCOUT scans every running app's environment for high-entropy strings and known credential prefixes (sk-, ghp_, xox).
Azure AD / IAM users with no sign-in for 90+ days, service accounts with no API call for 180+ days, access keys never rotated, guest users with elevated roles, deactivated users still listed in privileged groups.
Azure service principals and Azure RBAC roles with policies that grant more than they need. SCOUT analyzes 90 days of Activity Log / Audit Log usage to compute least-privilege recommendations for every non-human identity.
AKS clusters with public API endpoints, no authorized IP ranges, RBAC disabled or set to ABAC, dashboard exposed, anonymous-auth enabled, PSP / PSA at default permissive level, kubelet read-only port open.
Read-only, agentless, every cloud. Connect once and SCOUT runs continuously thereafter.
Create a read-only service principal (Azure). One command, signed off by your cloud admin in minutes.
SCOUT lists every resource in every subscription / account / project. Maps the topology, tags, ownership, and exposure. Typical mid-size estate (3,000 resources) maps in under 4 minutes.
Runs all 111 checks in parallel. Each finding is tagged with severity (CVSS-aligned), CIS / NIST / CSA control reference, blast radius (number of resources affected), and a recommended FORGE remediation playbook.
Findings flow downstream — SENTINEL watches for active exploit signals, COMPLY converts findings into auditor evidence, FORGE proposes the auto-fix. SCOUT itself never touches a thing.
In a real Azure scan of a regulated mid-market environment, SCOUT mapped 2,847 resources across 4 subscriptions and surfaced 47 misconfigurations in under 4 minutes — including 3 critical IAM overprivilege findings, 11 storage accounts allowing public list, and 2 SQL servers reachable from 0.0.0.0/0. Every finding was control-mapped to CIS, NIST 800-53, and CSA-CCM with no manual triage.
“ SCOUT found things our last vendor's scanner missed for two years. ”
SCOUT is included in every TITAN AI platform package. There is no SCOUT-only SKU — posture without remediation, SIEM, and compliance is half a product.