Audit Sponsor Readout
strataforge-security-3-readout.pdf
What an attacker could reach today, the critical findings, the decisions the sponsor needs to make, and the four weeks of hardening that follow.
Download PDF of Audit Sponsor ReadoutSample case study · AWS security, compliance & governance
Ten critical findings.
None left open.
Six weeks with StrataForge Robotics, a fictional robot maker with 48 AWS accounts and 212,000 robots in the field. The Audit verified 54 findings, ten of them critical and two that reached robots at customer sites. The Hardening closed them as code through StrataForge’s own pull requests, and the same scan went from 32.4% to 91.1%.
StrataForge Robotics is a fictional company: every account, finding, and person on this page is simulated. The AWS services, controls, and prices are real, as documented on October 13, 2026.
816
Account-Regions scanned
54
Findings verified by hand
48
Pull requests, owner-reviewed
91.1%
Week-six score, from 32.4%
A sample engagement
StrataForge is fictional.
The work is not.
StrataForge Robotics, Inc. does not exist. We built it to show what this engagement produces for an organization big enough to need all of it: 48 AWS accounts in 17 Regions, simulated resource by resource with real AWS controls and real ways to fail them, and twelve StrataForge people who make the decisions real owners make. Then we ran the six-week Hardening against it, week by week, in a real Pavilion workspace.
We never cite a client’s security findings, with or without the client’s name. So the reports here are the real deliverables, written the way we write them for a client, about a client nobody can be hurt by.
The client
StrataForge Robotics, Inc.
- Business
- Industrial arms, warehouse robots, and legged inspection robots, and the cloud service its customers run them on
- People
- 31,400 employees, 6,800 of them engineers
- Fleet
- 212,000 connected robots at 4,100 customer sites in 38 countries
- AWS
- 48 accounts in 10 organizational units, 17 enabled Regions
- Access
- 1,468 people who could reach AWS, 70.1% of them through single sign-on
- Sponsor
- Marcus Oyelaran, Chief Information Security Officer
- Lead
- Elena Vasquez, Vice President, Cloud Platform
A SOC 2 audit coming.
Five accounts nobody had opened.
Marcus Oyelaran, StrataForge’s CISO, gave three reasons at the kickoff. A SOC 2 Type 2 audit was coming, and he did not know what the auditor would find on the AWS side. Customers were sending security questionnaires faster than his team could answer them honestly. And StrataForge had bought Kestrel Vision in November and brought five of its accounts into the organization without looking inside them.
He signed the six-week Hardening: the two-week Audit first, then three weeks closing findings as code with the engineers who own each account, and the same scan run again at week six. Elena Vasquez, who runs the cloud platform, led it day to day.
- The engagement
- The Hardening: six weeks, July 13 to August 21, 2026, at the fixed $35,000 fee, mapped to SOC 2 beside the CIS and AWS benchmarks.
- The gate
- Half the fee only when every critical finding in the agreed register is closed, verified by the week-six re-scan. A critical accepted in writing counts as closed.
- The access
- A read-only role with AWS’s SecurityAudit and ViewOnlyAccess policies, in all 48 accounts from July 14, and deleted by StrataForge on August 20.
- The rule for changes
- Vantalect drafted every fix as a pull request. The engineer who owns the account reviewed and merged it, and StrataForge’s pipeline applied it.
How it went
Six weeks, as the sponsor saw them.
Each week ended with a report, and every report is below. The sessions, decisions, and tasks are counted from the engagement’s Pavilion workspace.
- Week 1July 13 to 17The Audit
Access and scan.
The read-only role went in through StrataForge’s change board on Tuesday and answered in all 48 accounts by early afternoon. The scan ran through Thursday: 71 controls from the CIS AWS Foundations Benchmark v5.0.0 and AWS Foundational Security Best Practices, 49,156 evaluations across 816 account-Regions.
StrataForge scored 32.3%. The five Kestrel accounts averaged 18.8% against 33.6% for the rest, and the five detection services were on in between 1% and 32% of the account-Regions. At the kickoff Marcus had set the rule that mattered a week later: any public, unauthenticated exposure gets a phone call the same day. “I’d rather know on a Tuesday than read it on a Friday.”
In the room. Five sessions: the kickoff, the architecture walkthrough, the identity interview, and two office hours.
- Week 2July 20 to 24The Audit
Verify and plan.
The heaviest week. Seven owners walked through their findings one at a time, and 54 survived verification: 10 critical, 20 high, 15 medium, and 9 low, plus six scanner results kept in the register as false positives, each with its reason. Six of the ten criticals needed no credentials at all, and two reached robots in the field.
On Monday the Kestrel accounts turned out to hold four public dataset buckets with 361 TB in them, public snapshots, and an internet-facing Jenkins server holding 31 AWS keys, one of them a root key. Charles called Marcus that afternoon and put the notice in writing. Marcus briefed Legal first and held the fixes to the following Monday, a decision recorded with his name on it.
On Wednesday, with Sam Okafor’s written approval and his fleet team in the room, a bench test proved the worst robot finding: one robot’s certificate could publish to another robot’s command topic. At Friday’s readout Marcus agreed the register and its ten criticals as the gate, and Priya Raman, the CTO, committed six owners to review fixes within two business days.
In the room. Thirteen sessions: seven owner verifications, the bench session, a connection-log match, the findings review, two office hours, and the sponsor readout.
- Week 3July 27 to 31The Hardening
Criticals and guardrails.
Nine of the ten criticals closed on Monday and Tuesday, as code, among 27 pull requests that week in four repositories, each reviewed by the engineer who owns the account. Service control policies, a resource control policy, and EC2 declarative policies went in at the top of the organization, so what closed stays closed, including in six organizational units whose policies had been detached since March 2023.
The tenth could not close in a week. 3,412 ForgeArm gen-2 robots run firmware 3.x and cannot take the new per-robot IoT policy until firmware 4.2 reaches each customer’s maintenance window. Every other robot moved to the new policy, the old one was cut down to telemetry, and Marcus took a written risk acceptance to Priya.
In the room. Seven sessions: two change reviews, two pairing sessions on the IoT rollout waves and the policy rollout order, two office hours, and the weekly check-in.
- Week 4August 3 to 7The Hardening
Identity.
Everyone moved to IAM Identity Center: coverage went from 70.1% to 100.0% of 1,420 people, IAM users from 1,394 to 403 with no human or CI user left, console users without MFA from 108 to none, and access keys older than 90 days from 1,009 to 57. Root credentials came out of 47 of the 48 accounts, and every root and break-glass sign-in now pages security.
Matching the HR roster against the IAM users found 48 people who had left StrataForge and could still reach AWS. Their users were deleted, and the monthly match became standing practice. The 57 keys left belong to factory gateways, kept on purpose until their maintenance windows.
In the room. Seven sessions: two change reviews, pairing sessions on the HR roster match and on root access, two office hours, and the weekly check-in.
- Week 5August 10 to 14The Hardening
Detection and response.
GuardDuty, Security Hub CSPM, AWS Config, IAM Access Analyzer, and Amazon Inspector went on in all 816 account-Regions and route to on-call through PagerDuty. A new organization trail writes to a log archive locked in compliance mode for 400 days, and ten runbooks cover what will page someone.
Detection costs money, so the number went to Marcus the night before the check-in: $60,745 a month more, from $58,900 to $119,645. He confirmed the budget on Friday and kept every service.
In the room. Seven sessions: two change reviews, pairing sessions on PagerDuty routing and on Kubernetes logging, two office hours, and the weekly check-in.
- Week 6August 17 to 21The Hardening
Re-scan and hand over.
The week-one scan ran again, the same way: 32.4% became 91.1% on the same 71 controls, and failed controls fell from 1,603 to 211. The report prints 86.3% beside it, the score without the three suppressions the work earned, because both numbers are true.
Of the 54 findings, 34 closed, 2 were accepted in writing, 8 were partly done, and 10 were still open, none of them critical. On Wednesday Marcus and Priya signed the acceptance for the firmware 3.x robots, expiring December 15, 2026. On Thursday the handover workshop walked the runbooks, and Elena deleted the audit role from every account: from that afternoon Vantalect had no access to StrataForge. On Friday Marcus read the gate out loud, the way the contract words it, and ordered the second invoice.
In the room. Seven sessions: the re-scan review, a dry run of the monthly security review, the signing, the two-hour handover workshop, two office hours, and the closing readout.
The gate
Ten criticals were the gate.
None was left open.
Half the fee rode on every critical finding in the agreed register being closed, verified by the week-six re-scan, with a critical accepted in writing counting as closed. The re-scan is the same scan as week one, run the same way.
Scan score, same 71 controls
32.4%to91.1%
86.3% without the three suppressions the work earned. Failed controls fell from 1,603 to 211.
Critical findings open
10to0
Nine closed as code on July 27 and 28. One accepted in writing by the CISO and the CTO, until December 15, 2026.
People on single sign-on
70.1%to100.0%
Console users without MFA went from 108 to none, and 48 former employees lost access they should not have had.
The Hardening’s guarantee
Marcus Oyelaran read the gate out on August 21: nine critical findings closed and verified by the re-scan, one accepted in writing, none open. The gate passed, and the second invoice, $17,500, went out that day.
Still to do: 18 findings and about 717 hours of work, each with an owner and a date, the first due September 4 and the last January 29, 2027. The worst of them is high, not critical: five high findings waiting on a firmware window, a customer site, or an upgrade. Keeping the score costs $60,745 a month more in detection, and an hour a month for the security review Nadia Petrova chairs, which started September 1.
Want this gate on your own organization?
Book a call about the HardeningThe workspace
Every decision
has a name on it.
The Hardening ran in a Pavilion workspace, created from the engagement’s template a week before kickoff with every week, session, deliverable, and obligation already in place, on StrataForge’s calendar in Mountain time. Thirteen people had a place in it: the CISO as sponsor, the CTO and finance as observers, nine owners and engineers, and Charles.
After each session the transcript came into the workspace, and an agent drafted the summary, the decisions, the action items, and a digest for the people who were not in the room, every claim citing the part of the transcript it came from. Charles reviewed every draft before StrataForge saw it. Four pairing sessions went unrecorded, so they got consultant notes instead.
The findings register lived there too: each of the 54 findings was a task with an owner, and each of the 48 pull-request reviews was a task that finished on the day it was due. Every report was published as an immutable, hashed version and accepted by Marcus against that version, the deliverables were checked off against that evidence, and the workspace’s audit log keeps all 582 events in an unbroken hash chain.
What the workspace held at the close
- 46sessions, 42 of them transcribed
- 10reports published, every required one accepted
- 74decisions, each with who made it
- 233tasks, from findings to pull requests
- 15deliverables accepted against evidence
- 16obligations on both sides, none missed
A phone call, then the record.
When the Kestrel exposures were confirmed on July 20, Charles called Marcus and posted the notice to the workspace that afternoon. The thread holds what Marcus decided and why: brief Legal first, tell only security operations, hold the fixes to Monday. Anyone who read the register later could see why public buckets stayed public for a week.
Written approval before touching a robot.
Before the bench test, Sam Okafor’s approval went into a thread with his conditions: two bench units, never a customer’s robot, actuator power cut, the emergency stop engaged, his team in the room. Charles accepted every condition in writing, and Marcus added one line: nothing touches a robot at a customer site.
An acceptance with a paper trail.
The firmware 3.x acceptance took three weeks: the draft on July 31, Marcus’s questions answered that evening, Priya asking for a weekly count of the affected robots, and both signatures on August 19, attached to the finding with an expiry date and a task for Marcus to decide on renewal that day.
A number before the meeting.
Charles sent Marcus the detection budget the night before the check-in, so Friday’s number would not be a surprise at nine. Marcus asked two questions in the thread, got two answers, and confirmed $176,409 a month for detection and logging the next morning.
The last access, removed.
On August 20 Elena Vasquez deleted the audit role from every account, the management account included, and posted both checks to the thread. From then on, Vantalect had no access to any StrataForge account, and the workspace says when that started.
The deliverables
Every report, as delivered.
Ten PDFs and 454 pages. Start with the readout; the reading guide shows how the rest fit together. Then read the next three for what changed and the re-scan for the proof. Each one is tagged for screen readers, and each says on its cover that StrataForge is fictional.
Start with the readout (10 pages)
Written for the sponsor, and the one to read if you read nothing else: what an attacker could reach today, the critical findings, the decisions the sponsor needs to make, and the four weeks of hardening that follow.
- Week 2 of 6: Sponsor readoutJuly 24, 2026
For the engineer you forward it to
The full audit report, with the prescriptive fix for each finding, and the appendix behind it: the code, the commands, how to verify each change, and how to roll it back.
- Week 2 of 6: Verify and planJuly 24, 2026
Audit Report
strataforge-security-2-audit.pdfThe verified findings register, identity and access review, SOC 2 compliance map, governance review, and remediation roadmap, with the prescriptive fix for each finding.
Download PDF of Audit Report - Week 2 of 6: Verify and plan (appendix)July 24, 2026
Audit Report Appendix: Remediation Code
strataforge-security-2-appendix.pdfThe complete prescriptive remediation for every finding in the audit report: the code, the commands, how to verify it, and how to roll it back.
Download PDF of Audit Report Appendix: Remediation Code
The rest, week by week
The reading guide first, then what each week delivered, in order.
- Reading guide to the sixteen reportsOctober 13, 2026
Sample Engagement Reports
strataforge-0-guide.pdfWho StrataForge Robotics is, what each of the sixteen sample reports (and the audit’s code appendix) delivers, what the two engagements found and fixed, and what is real and what is simulated.
Download PDF of Sample Engagement Reports - Week 1 of 6: Access and scanJuly 17, 2026
Organization Scan
strataforge-security-1-scan.pdfEvery account and enabled Region scored against CIS AWS Foundations Benchmark v5.0.0 and AWS Foundational Security Best Practices.
Download PDF of Organization Scan - Week 3 of 6: Criticals and guardrailsJuly 31, 2026
Criticals Closed and Guardrails at the Top
strataforge-security-4-criticals-guardrails.pdfEvery critical finding closed as code, and the service control policies, resource control policies, and account defaults that keep it closed.
Download PDF of Criticals Closed and Guardrails at the Top - Week 4 of 6: IdentityAugust 7, 2026
Identity Rebuilt
strataforge-security-5-identity.pdfPeople on single sign-on, long-lived keys retired, workload roles cut to least privilege, and root and break-glass access locked down.
Download PDF of Identity Rebuilt - Week 5 of 6: Detection and responseAugust 14, 2026
Detection and Response Everywhere
strataforge-security-6-detection-response.pdfGuardDuty, Security Hub CSPM, IAM Access Analyzer, and AWS Config in every account and Region, the organization trail, and the runbooks.
Download PDF of Detection and Response Everywhere - Week 6 of 6: Re-scanAugust 21, 2026
Week-Six Re-Scan
strataforge-security-7-rescan.pdfThe same scan as week one, run the same way: before and after, every critical’s closure evidence, and the guarantee’s gate.
Download PDF of Week-Six Re-Scan - Week 6 of 6: Hand overAugust 21, 2026
Incident Runbooks and Handover
strataforge-security-8-runbooks-handover.pdfThe runbooks for the alerts most likely to page StrataForge, the remaining roadmap, and how to keep the score where it is.
Download PDF of Incident Runbooks and Handover
Your organization, scanned the same way.
The same six weeks and the same gate, in your own accounts.
The engagement · six weeks, $35,000
AWS Security, Compliance & Governance Audit
The Audit and the Hardening: the verified findings register and the roadmap in two weeks, then every critical closed as code, with half the fee riding on the re-scan.
Read the engagement
Sample case study · the six weeks after
StrataForge’s cost optimization
The same client, August 24 to October 2: $23.5 million a year identified, $11.1 million put in place, and $9.4 million measured on its own Cost and Usage Report.
Read the case studyLet's define the result.
Tell us how many accounts, which framework your auditors use, and what prompted the question. You will hear back from Charles within one business day, and the first call is fifteen minutes.
AWS, Amazon Web Services, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. SOC 2 is a registered trademark of the American Institute of Certified Public Accountants. CIS Benchmarks is a trademark of the Center for Internet Security, Inc. PagerDuty is a trademark of PagerDuty, Inc. Jenkins is a registered trademark of LF Charities Inc. Vantalect is not affiliated with or endorsed by any of them. StrataForge Robotics, ForgeArm, Kestrel Vision, and every person named on this page are fictional.