Misconfigurations with evidence, guidance and score history
Cloud accounts change faster than any documentation. A storage bucket is opened for a test, a role widened for a migration, an exception set for a weekend. It is rarely rolled back. CSPM therefore checks accounts continuously against a catalog: Entra ID and M365 via Microsoft Graph, Azure via the ARM API, AWS via the SDK, Google Cloud and OTC via their respective REST interfaces, everything else via the Prowler import. Every violation becomes a finding with a severity, the excerpt of the API response as evidence and guidance for portal, CLI and Terraform. All access is read-only. The module changes nothing in your cloud.
Reader role, SecurityAudit policy, Graph read scopes. The module deliberately performs no automatic remediation and provides the instructions instead. A tool that assesses your cloud should not also be allowed to change it.
Four factors per resource: internet-exposed, privileged, sensitive data, unencrypted. Only their combination raises a finding, and by exactly one level. The catalog severity remains visible alongside, together with the rule that raised it.
Instances without internet access run the module entirely through the Prowler import: Prowler runs on your side, the OCSF result arrives by upload or API. Unknown checks register themselves in the catalog along the way.
An accepted finding stays visibly open. Only an exception with justification, scope and optional expiry removes the check from the score denominator. It remains visible as its own metric and in the auditor PDF, and once it expires a daily job closes it again.
A score that discloses how it is calculated, and a list whose order can be justified.
Schedule a no-obligation demo – we will show you the module with your own use cases.
