Security Auditor

Full security audit with Critical/High/Medium/Low findings and remediation roadmap.

Conducts comprehensive security audits, compliance assessments, and risk evaluations across systems, infrastructure, and processes. Reads your actual codebase and policy docs via file-system tools.

Tools:readgrepglob

Frameworks:SOC 2ISO 27001CMMCHIPAANIST CSFCIS Controls

Use case 1

You inherit a security program with no documentation and need to know what is broken before the next board meeting

→ Quantified risk score, ranked finding list, and remediation roadmap in under 10 minutes

Use case 2

Pre-audit dry run before a SOC 2, ISO 27001, or FedRAMP assessment

→ See exactly what an external assessor will flag, with citation to specific control IDs, and fix it before they see it

Use case 3

Board asks 'how secure are we really?' and you need a defensible answer

→ Risk score + dollar exposure estimate + framework-mapped findings you can present without hand-waving

Try a sample prompt:

security-auditor · live demo · gemini-flash

◇ Curated sample output (real format)

Executive Summary

Risk Score: 52 / 100 · Posture: High Risk

The assessed environment presents critical identity and data protection gaps that expose the organization to regulatory penalties and breach risk. Immediate remediation of MFA enforcement and S3 access controls is required before any compliance certification pursuit.

Finding summary: 1 Critical · 2 High · 3 Medium · 4 Low · 2 Observations

Critical Findings

MFA Not Enforced on 12 IAM Admin Accounts

Classification: Critical · Domain: Access Control · Framework: CC6.1 · AC-2 · IA-2

Evidence gap: No MFA configured for AWS root account or 3 IAM admin users with billing access. Programmatic credentials have no rotation policy.

Business impact: Full AWS account takeover possible in a single credential compromise. Estimated blast radius: $2.4M+ in data exfiltration risk plus regulatory exposure (HIPAA §164.312(d), SOC 2 CC6.1).

Remediation (48 hours):

1. Enable MFA on root via console

2. Apply IAM policy denying console access without MFA: aws iam put-account-password-policy

3. Rotate all programmatic credentials issued >90 days ago

4. Add SCP at organization level enforcing MFA across all member accounts

High Findings

4 S3 Buckets with Customer PII Publicly Accessible

Classification: High · Domain: Data Security · Framework: CC6.7 · SC-7

Evidence gap: Buckets customer-uploads-prod, exports-archive, legacy-reports, vendor-shared have ACLs permitting AnyPrincipal. Default encryption disabled on 2 of 4.

Business impact: HIPAA breach exposure (~$1.9M/yr fine cap) and GDPR Article 33 notification trigger (up to 4% annual revenue).

Remediation (4 hours):

aws s3api put-public-access-block --account-id  --public-access-block-configuration BlockPublicAcls=true,IgnorePublicAcls=true,BlockPublicPolicy=true,RestrictPublicBuckets=true

2. Enable SSE-KMS on all 4 buckets

3. Add bucket policy denying s3:PutObject without x-amz-server-side-encryption header

No CloudTrail Multi-Region Logging

Classification: High · Domain: Audit & Accountability · Framework: CC7.2 · AU-2

Evidence gap: CloudTrail only configured in us-east-1. Three other active regions have no audit trail. Log file validation disabled.

Business impact: Inability to reconstruct incident timeline; SOC 2 CC7.2 will fail audit.

Remediation (2 hours): Enable multi-region trail with S3 delivery, CloudWatch Logs integration, log file validation, and KMS encryption.

Remediation Roadmap

Priority	Action	Timeline	Owner
P0	MFA enforcement across all IAM	48 hr	Cloud Security
P0	S3 public access block	4 hr	Cloud Security
P1	Multi-region CloudTrail	2 hr	Cloud Security
P1	KMS rotation policy on customer-data keys	1 wk	Cloud Security
P2	Implement AWS Config Conformance Pack (NIST 800-53)	2 wk	Compliance
P2	Add 8 missing controls to SSP for SOC 2 readiness	2 wk	Compliance

Next Steps

1. Approve P0 remediation tickets in change management before EOD

2. Schedule pre-audit dry run with assessor in 4 weeks

3. Re-run this audit weekly until risk score >= 80

Cmd+Enter to send

← Back to agent registry