I look at IAM, network boundaries, and the logs, then close the paths that are wider than the job.
I look at IAM, the network, and the logs, then tell you which path is wider than the job.
I look at the permission, the network rule, and who gets paged.
I use the scanner and the logs you can already run. A new tool has to earn it.
The list is what to close first, not every finding the scanner printed.
These show up when they fit the job.
Nessus
Qualys
Metasploit
Wireshark
Burp Suite
OWASP ZAP
Snort
Splunk
Kali Linux
AWS Security Hub
Azure Security CenterNessusQualysMetasploitWiresharkBurp SuiteOWASP ZAPSnortSplunkKali LinuxAWS Security HubAzure Security CenterWriting
Posts that sit next to this work.
How to scope Bedrock IAM policies per Lambda function, build permission boundaries that block privilege escalation, catch misconfigurations with CloudTrail, and automate guardrails in CI so AI agents can't widen your blast radius.
How to set up AWS WAF in front of CloudFront for a solo-built application, with rate limiting, bot control, and IP block rules, all managed with Terraform.
Terraform state can contain passwords, access keys, and a map of your infrastructure. Here is how I keep it out of Git, lock it in S3, and limit who can read it.
