Cloud posture tools are good at listing resources that are open to the internet. They are much weaker at answering the question that matters: from where I stand now, what can I eventually become?
Escalation paths beat resource lists
A build role that can update its own policy is a full account administrator with extra steps. A dashboard reporting that role as compliant is technically correct and practically useless.
We enumerate reachable privilege transitions and rank findings by how close each one gets an attacker to a consequence you care about.
Trust relationships outlive the projects that created them
Cross-account roles created for a migration, a vendor proof of concept or a seasonal campaign usually survive long after the work ends. Nobody owns their removal because nobody remembers them.
- Inventory cross-account trust yearly and require a named owner
- Set expiry on vendor access by default
- Alert on policy changes to roles that can modify identity
Guardrails beat findings
A remediated finding fixes today. A service control policy or organisational policy prevents the entire class from returning next quarter, which is why every cloud review we deliver ships with infrastructure-as-code guardrails alongside the report.
Key takeaway
Map privilege escalation paths rather than resource states, put expiry on trust, and convert repeat findings into platform guardrails.