Sample case study · AWS security, compliance & governance
Six weeks with Tidepost, Inc., a fictional social-video news app that built everything in one AWS account and needed it fixed in the right order before its SOC 2 Type 2 observation window opened. The Audit verified 47 findings, ten of them critical and four of those open to anyone on the internet with no credential. The re-scan verified nine of the ten closed, every change made by Tidepost’s own engineers, and Dev Raman signed for the last one until its database cutover. The same scan went from 24.0% to 90.0%.This is the case for a startup on a single account, where the work is closing what anyone on the internet can reach, in the right order, before an auditor starts watching. It shows the method, not a typical result.
Tidepost, Inc. is a fictional company: every account, finding, and person on this page is simulated. The AWS services, controls, and prices are real, as documented on October 13, 2026.
Tidepost, Inc. does not exist. We built it to show what this engagement produces for a startup that built fast on one AWS account: production, staging, development, data science, and CI in one place, 52 instances and 23 buckets, simulated resource by resource with real AWS controls and real ways to fail them, and ten Tidepost people who make the decisions real owners make. Then we ran the six-week Hardening against it, week by week, and wrote the reports.
Tidepost is fictional. Its people, products, users, accounts, investors, and figures are invented for this sample, and any resemblance to a real company, person, product, or publication is coincidental. We never cite a client’s security findings, with or without the client’s name. So the reports here are the real deliverables, written the way we write them for a client, about a client nobody can be hurt by. The engagement is dated January 5 to February 13, 2026, and the AWS prices are the list prices retrieved October 13, 2026.
In December 2025 Tidepost signed a Series A term sheet, and the lead investor required a SOC 2 Type 2 report. Tidepost’s CPA firm set the observation window, April 1, 2026 to September 30, 2026, about twelve weeks after the Audit began, and the map of controls that window needs is set out further down. Everything ran in the one account the founders had opened, with public buckets, a public database, root keys, and a path from the web tier to an administrator role. None of it could wait for an account structure.
Dev Raman signed the six-week Hardening: the two-week Audit first, then four weeks closing findings as code with the engineers who own each item, and the same scan run again at week six. Kofi Brandvold led it day to day, and Sasha Ilyin owned compliance. The Audit’s governance review also served as the discovery for a second engagement, the Multi-Account Foundation, which ran in weeks three to six as its own add-on and closed the three criticals that only an organization can.
Each week ended with a report, and every report is below. The dates are the engagement’s own, and the sponsor decided at the end of week two which findings the gate would be measured on.
The read-only role went in and the scan ran on Monday, January 5, the first day, against the one account Tidepost had, in two Regions: 50 controls from the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices. The account passed 12 of 50, 24.0%, and the other 38 failed on 207 resources. A scan cannot see exposure, so the critical results that depended on one were proved from outside the account, the way an attacker would, with one request each and nothing kept but a count.
Vantalect did not wait for the register. On Tuesday, January 6 it told Tidepost about the critical results, and the owners acted the same day. The exports bucket holding 104,318 user records was closed within the hour, the forgotten GPU server with an open notebook was snapshotted for the record and terminated, both root access keys were deleted, and the two departed administrators’ users were removed. The account kept no trail and no flow logs, so nobody could say whether the export had been read or the server used. Counsel was told; whether to notify anyone is Tidepost’s decision.
Closing the originals bucket had a price. App versions older than 4.2, 7% of daily sessions, read the bucket on its own address and got errors instead of images and video from that day. Bea Okafor turned on the required-update prompt for those versions the same afternoon, and by January 13 fewer than one session in a hundred was on an old version. Nobody reopened the bucket to keep them working.
The calendar. Kickoff and scan on Monday, January 5; the call to Tidepost on Tuesday, January 6; the week-one report on Friday, January 9.
The Audit read every critical and high result by hand and verified 47 findings: 10 critical, 14 high, 15 medium, and 8 low. Each critical was rated by who can reach it. Four needed no credential at all, four needed one stolen credential or one application bug, one needed a foothold inside, and one was not a way in: the account had no CloudTrail trail, so a compromise through any of the others would have left no record past the 90 days AWS keeps.
The governance review that week doubled as the Foundation’s discovery. No organization existed, because the founders’ account was its own payer, so the choice was a new management account with the founders’ account joining it as production, or a retrofit. Kofi Brandvold created the management account on January 12 ahead of the readout.
At the readout on Friday, January 16, Dev Raman agreed the register and its ten critical findings as the gate, took the greenfield path, and signed the written acceptance for the production database. It stayed publicly reachable, restricted to one vendor’s published address ranges with TLS required, until an encrypted private instance replaced it at the cutover on March 22. An acceptance meets the gate only with a named signer, a reason, and a closing date, and this one had all three. He also deferred the unencrypted database storage to the same cutover, while Sasha Ilyin deferred the deletion pipeline for removed posts’ media until counsel’s retention schedule exists, and declined Amazon Macie across the media buckets.
The decisions. The register as the gate, the greenfield path, the acceptance with its end date, two deferrals, and a declined service. The findings register went to the sponsor on January 15, and the sponsor readout was on Friday, January 16.
By the end of the week six of the ten criticals were closed, and 23 findings of every severity since kickoff, every change made by Tidepost’s own engineers. The search domain that answered anyone on the internet was replaced by a new one inside the VPC with fine-grained access control, restored from a snapshot, by January 21. The link-preview service, which fetched any URL a user typed and ran on an administrator role, got an allowlisted egress proxy, IMDSv2, and a role cut down to the actions it uses by January 8, and the database password and the third-party API key left the repository for Secrets Manager by January 9.
The production database was the one critical that could not simply be made private: a vendor’s dashboards reached it over the internet until a private path existed. Its security group was narrowed to the vendor’s published ranges on January 7, and the sponsor’s acceptance held it there. The same week put nine workload guardrails in place so that what closed stays closed: Block Public Access on the whole account, originals reachable only through CloudFront, secret scanning with push protection, open SSH closed automatically, alarms on the root user and on any change to the database’s security group, encryption by default, and IMDSv2 by default.
Three criticals could not close in one account. Root credentials can be removed from a member account only under an organization, the permission sets and the policy that denies new IAM users live in the organization, and the organization trail writes to a log archive that only an organization provides. Those were the Foundation’s to finish, and each had its first step done by the end of the week.
The calendar. The Foundation’s first change windows were January 21 for the landing zone and January 23 for IAM Identity Center and the identity provider.
Everyone moved to IAM Identity Center. The 5 administrators who remained and the 9 other people with console access, 14 in all, were provisioned on January 26 and have signed in through it since January 28, the day the account joined the organization, each onto the smallest of 6 permission sets that does the job, with a second factor required at every sign-in. GitHub Actions has deployed through OIDC federation, with no key stored anywhere, since January 20, and the two CI keys, 391 and 412 days old, are gone.
The join closed what one account could not. The organization trail closed the missing record on January 28, and the root user lost its credentials under centralized root access on January 29. The IAM users went from 18 on the first day to 1, deleted on February 10 after each person’s first Identity Center sign-in showed in the trail. The one that stays belongs to a video analytics vendor whose system cannot assume a role: Sasha Ilyin signed a written exception on February 11, and its key rotates every 90 days. A break-glass user, held by Sasha Ilyin and Noor Castellanos, exists for the day identity itself breaks, and every sign-in with it posts to the platform channel and opens a ticket.
The calendar. Identity Center connected on January 23; the break-glass user created on January 22; the first quarterly access review is on March 31.
Detection now runs from one account, the audit account, which the Foundation designated administrator on January 29. On the first day none of the five services was on in either Region. By February 6 AWS Config, Amazon GuardDuty, AWS Security Hub CSPM, Amazon Inspector, and IAM Access Analyzer covered 8 of the 9 accounts, and the last account enrolls itself the day it is created. A compromised workload account cannot turn off what watches it, and the organization trail keeps its logs 400 days.
Findings now reach people. A rule for each source sends what matters to the security channel and mailbox and, for the top severity, to the phones of two named people: Sasha Ilyin first, Kofi Brandvold second, until the Well-Architected Review sets an on-call rotation. Each of the five routes was proved by raising a sample or scratch finding and timing the arrival, from 74 seconds for the fastest to 11 minutes for the slowest, and the first five response runbooks are written.
Detection costs money, and the sponsor had the number from the readout: $2,584 a month at list prices, 1.6% of the $157,565 monthly bill.
Asked of the sponsor. To confirm the two people whose phones receive a page, before the handover on Thursday, February 12.
The week-one scan ran again on Thursday, February 12, the same way, now across 9 accounts: 24.0% became 90.0%, 12 of 50 checks passing became 45, and failed resources fell from 207 to 45. The five checks that still fail each fail by a written decision, not by neglect. Of the 47 findings, 42 closed, 3 were accepted in writing, and 2 were deferred in writing with a date. The re-scan raised no new failing check.
The gate was decided that day. On Thursday, February 12 the handover workshop walked the runbooks, the evidence index, and the list of what remains; it was recorded, and Kofi Brandvold, Sasha Ilyin, and Dev Raman attended. On Friday, February 13 the audit role was deleted from the accounts and the second invoice went out.
The calendar. Re-scan, gate decision, and handover workshop on Thursday, February 12; the closing readout and the second invoice on Friday, February 13.
Half the fee rode on one rule: every critical finding in the register agreed at the readout is closed, verified by the week-six re-scan, or accepted in writing by a named Tidepost signer with a closing date. The re-scan is the same scan as week one, run the same way.
Passing checks went from 12 to 45 of 50. The five that still fail each fail by a written decision.
Verified by the re-scan. The last, the production database, is accepted in writing by Dev Raman until March 22, and stays on the register as open until then.
IAM users went from 18 to 1. The two administrators who had left lost their access on January 6, the day after the scan.
The re-scan decided the gate on Thursday, February 12: nine critical findings closed and verified, one accepted in writing by Dev Raman until March 22, none left outside the gate. The gate passed, and the second invoice, $14,875, went out on Friday, February 13. Beyond the gate no result is promised: the Hardening reduces risk.
Still on the register: five findings, each with an owner and a date. The production database and its unencrypted storage wait for the cutover on March 22, the deletion pipeline for removed posts’ media for May 20, and two lower findings are reviewed on June 30. Keeping the score costs $2,584 a month in detection, and about an hour a month for the security review Sasha Ilyin owns, which starts March 10.
Want this gate on your own organization?
Book a call about the HardeningThe audit report issued the first technical map and the handover updated it: 35 controls on AWS, each tied to a criterion the CPA firm will test (CC6, CC7, CC8, A1, and C1, under Security, Availability, and Confidentiality), with the date it began operating and where the evidence is.
Vantalect is not the auditor and does not issue, predict, or influence a SOC 2 report. SOC 2 reports are issued by licensed CPA firms. This map lists controls that are in place on AWS, the date each began operating, and where the evidence is; the auditor tests them.
On the day the Hardening ended, 22 of the 35 controls were in place and 13 were planned. Together 33 were in place or planned to be before the observation window opened on April 1, the latest starting on March 27, and two after it: the retention schedule and the deletion pipeline for removed posts’ media, which wait on counsel and the app team and begin on May 20. The map says so plainly, and the auditor decides what it means for the report.
Everything outside AWS stays Tidepost’s: the control environment and board oversight, the risk assessment program, the written policies, vendor management, and the system description, each with a named owner. Amazon Web Services is a carved-out subservice organization: its own SOC 2 report covers the data centers, the hardware, and the virtualization, and the controls in the map are what Tidepost runs on AWS so that AWS’s controls are enough. Tidepost’s CPA firm ran its own readiness assessment from February 17 to March 6; it is the firm’s, not Vantalect’s.
On AWS, each with a criterion, an owner, a start date, and an evidence location.
Operating on February 12, with 13 more planned.
In place, or planned to be in place, before April 1.
The retention schedule and the deletion pipeline, from May 20.
A gate that counted only what was easy to close would be easy to meet, so the reports show every finding that did not simply close, with the person who decided and the reason. Five findings were accepted or deferred in writing, and three decisions were declined.
Each has a named Tidepost signer, a reason, and a date: an end date, or a review date for the two that carry no deadline. They stay on the register until they close.
Dev Raman signed it on January 16, as accepted in writing. PubliclyAccessible stays true until the new encrypted private instance replaces this one at the March 22 cutover; until then the security group admits only the BI vendor’s four published ranges and TLS is required.
Ends. March 22, closed through the Well-Architected Review.
Dev Raman signed it on January 16, as deferred with written acceptance. The production database cannot be encrypted in place; the new encrypted PostgreSQL 16 instance replaces it at the March 22 cutover.
Ends. March 22, closed through the Well-Architected Review.
Sasha Ilyin signed it on January 16, as deferred with written acceptance. The app team cannot ship the deletion pipeline before the retention schedule exists, and the schedule waits on counsel. The risk that remains until then: a removed post’s renditions still load through the distribution for anyone who kept their address, and its original for anyone holding a signed URL issued before the removal, until that URL expires.
Ends. May 20, closed through Tidepost.
Sasha Ilyin signed it on January 21, as accepted in writing. Object-level CloudTrail data events cover the two buckets that hold user data, and the other five hold public news media; access logs on the media buckets would be among the largest log volumes in the account.
Reviewed. June 30.
Sasha Ilyin signed it on January 21, as accepted in writing. S3 bucket names cannot be changed in place, and the names disclose nothing that is not already in public contracts.
Reviewed. June 30.
Considered and answered no, in writing, with the reason beside it. Each can be reopened.
Both secrets were rotated, so the exposed values no longer work; rewriting history would break every clone and open pull request for no added protection.
On the scan. No scan check covers it.
Considered, not priced: nearly all of the media is public news by design and the two buckets that hold user data are small. Macie runs on no bucket in this sample.
On the scan. Macie.1 still fails by this decision.
It would block the public load balancers unless every one is listed as an exclusion; deferred to the Foundation’s operations runbooks.
On the scan. EC2.172 still fails by this decision.
Only one of the five is a critical finding: the production database, which has a signer, a reason, and a date, and does not extend itself. None of them was a way to meet the gate cheaply.
Vantalect runs each engagement in a Pavilion workspace, created from the engagement’s template with every week, session, deliverable, and obligation already in place, on the client’s calendar and in its time zone. The sponsor, the leads, and the workload owners join it, and so does Charles.
After each session the transcript comes into the workspace, and an agent drafts the summary, the decisions taken, the action items, and a digest for the people who were not in the room, each claim citing the part of the transcript it came from. Charles reviews every draft before the client sees it. Every report is published there as an immutable, hashed version that the sponsor accepts against that version.
Tidepost’s demonstration workspace has not been built, so this page describes the workspace in words and counts nothing in it.
When the critical results were confirmed on January 6, Vantalect told Tidepost the same day and did not wait for the register. A workspace is built to keep that thread: who was told, what the owners did that day, and the line that counsel was told and that the decision to notify belongs to Tidepost.
Dev Raman signed the acceptance for the public database on January 16, with the reason, the controls around it, and the day it ends. The record is built so that an acceptance cannot extend itself: on March 22 it ends, or the gate no longer holds on it.
Sasha Ilyin declined a history rewrite of the repository that held the secrets on January 9: both had been rotated, so the exposed values no longer worked, and a rewrite would have broken every clone and open pull request. The reason sits beside the decision, so a later reader sees why.
Pages go to Sasha Ilyin first and Kofi Brandvold second, until the Well-Architected Review sets an on-call rotation. A decision like that belongs beside the runbooks it protects.
The audit role was deleted on February 13. From then on Vantalect had no access to any Tidepost account, and the record says when that started.
Ten PDFs and 202 pages. Start with the readout; the reading guide shows how the rest fit together. Then read the weeks in order, and the re-scan last for the proof. Each one is tagged for screen readers, and each says on its cover that Tidepost is fictional.
Written for the sponsor, and the one to read if you read nothing else: the score, what an attacker could reach, the decisions the sponsor needs to make, the cost of detection, and the four weeks of hardening that follow.
tidepost-security-3-readout.pdf
The ten criticals agreed, the one accepted in writing until the March 22 cutover, the Foundation plan, and the next four weeks.
View Audit Sponsor Readout in the PDF viewerDownload PDF of Audit Sponsor Readout
The full audit report, with the prescriptive fix for each finding, and the appendix behind it: the evidence for each finding, what was read, how, and what it showed.
tidepost-security-2-audit.pdf
Forty-seven verified findings ranked, the governance review that is the Foundation’s discovery, the target organization, and the first SOC 2 technical map.
View Findings Register, Governance Review, Target Organization, and the SOC 2 Technical Map in the PDF viewerDownload PDF of Findings Register, Governance Review, Target Organization, and the SOC 2 Technical Map
tidepost-security-2-appendix.pdf
The evidence behind each finding: what was read, how, and what it showed.
View Audit Appendix: Evidence by Finding in the PDF viewerDownload PDF of Audit Appendix: Evidence by Finding
The reading guide first, then what each week delivered, in order.
tidepost-0-guide.pdf
Who Tidepost is, why a Series A and a SOC 2 Type 2 brought four engagements, what each of the 33 reports delivers, and what is real and what is simulated.
View Sample Engagement Reports in the PDF viewerDownload PDF of Sample Engagement Reports
tidepost-security-1-scan.pdf
The read-only scan of the founders’ account as found, with MAF-01 to MAF-13 run beside it, and the inventory that replaces the Foundation’s own.
View Week-One Scan, Including the Foundation Checks in the PDF viewerDownload PDF of Week-One Scan, Including the Foundation Checks
tidepost-security-4-criticals-guardrails.pdf
Every critical closed or accepted, change by change, and the workload guardrails that keep them closed.
View Criticals Closed and Workload Guardrails in the PDF viewerDownload PDF of Criticals Closed and Workload Guardrails
tidepost-security-5-identity.pdf
Administrators off long-lived keys, people on IAM Identity Center, CI on OIDC federation, and workloads on roles.
View Identity: People in Identity Center, Workloads on Roles in the PDF viewerDownload PDF of Identity: People in Identity Center, Workloads on Roles
tidepost-security-6-detection-response.pdf
GuardDuty, Security Hub, and Inspector delegated to tp-audit, the alert routing, and the first response runbooks.
View Detection and Response from the Audit Account in the PDF viewerDownload PDF of Detection and Response from the Audit Account
tidepost-security-7-rescan.pdf
The same scan run the same way, check by check, and the gate.
View Week-Six Re-Scan in the PDF viewerDownload PDF of Week-Six Re-Scan
tidepost-security-8-runbooks-handover.pdf
The runbooks, the evidence index for the auditor, the SOC 2 technical map as of the handover, and what remains.
View Runbooks, the Evidence Index, and Handover in the PDF viewerDownload PDF of Runbooks, the Evidence Index, and Handover
The same six weeks and the same gate, in your own accounts.
The Audit and the Hardening: the verified findings register and the roadmap in two weeks, then every critical closed or signed for with a date, and half the fee riding on the re-scan.
Read the engagement
A fictional startup that built fast on one AWS account: $1,054,404 a year identified at list prices, $725,391 measured on its own Cost and Usage Report across 31 changes, and five approved changes kept out of the gate until their conditions are met.
Read the case study
A fictional social-video news app and its one production workload, scored against all six pillars of the AWS Well-Architected Framework: 25 high-risk issues agreed, 20 closed by change, 5 accepted in writing, none unresolved at week six, verified in its own Well-Architected Tool.
Read the case study
One AWS account became 9 in four weeks, as the add-on after a Security Audit: production joined without moving a workload, 11 policies landed with no policy-caused denial, and the scan went from 1 of 12 checks passing to 11, plus 1 waived in writing.
Read the case studyTell us how many accounts you have, which audit window is coming, and what prompted the question. You will hear back from Charles within one business day, and the first call is fifteen minutes.
AWS, Amazon Web Services, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. SOC 2 is a registered trademark of the American Institute of Certified Public Accountants. CIS Benchmarks is a trademark of the Center for Internet Security, Inc. GitHub is a trademark of GitHub, Inc. Jupyter is a trademark of LF Charities. PostgreSQL is a registered trademark of the PostgreSQL Community Association of Canada. OpenSearch is a registered trademark of Amazon.com, Inc. Vantalect is not affiliated with or endorsed by any of them. Tidepost, Inc. and every person named on this page are fictional.
