Skip to content
Auditor index

55 auditors. Every layer.

Real SDK-backed checks across AWS, Azure, GCP and on-prem — Active Directory, SNMP network devices, your IdP, EDR/MDM, Kubernetes, container registries, VCS and SaaS — plus Prowler and the Checkov / Semgrep / Bandit IaC-and-SAST scanners. Every finding maps to 678 controls across 9 frameworks.

View sourceBrowse the catalog

Coverage in the box

55

Auditors

9

Frameworks

678

Controls

3

Clouds + on-prem

Catalog

Search every auditor.

Filter by cloud, narrow by resource category, or search a keyword like “encryption”, “RLS” or “Kubernetes”. Every card’s tags are clickable.

Cloud

Category

Showing 55 of 55

AWS IAM Auditor

Audits IAM users, roles and policies via AWS SDK v3 (real resource enumeration).

AWS S3 Auditor

Checks S3 buckets for public access, encryption and bucket-policy exposure.

AWS EC2 & VPC Auditor

Audits EC2 instances plus VPC security groups and networking exposure.

AWS CloudTrail Auditor

Verifies CloudTrail trail coverage and logging configuration.

AWS KMS Auditor

Checks KMS key rotation and key-policy configuration.

AWS RDS Auditor

Enumerates RDS DB instances via DescribeDBInstances; flags encryption/public-access issues.

AWS Lambda Auditor

Audits Lambda function configuration via ListFunctions/GetFunctionConfiguration.

AWS ECS Task Definition Auditor

Audits ECS task definitions for insecure settings via @aws-sdk/client-ecs.

AWS ECR Repository Auditor

Checks ECR repositories for image-scan, tag-immutability and public access.

AWS EKS Cluster Auditor

Audits EKS clusters for insecure configuration via @aws-sdk/client-eks.

AWS SQS/SNS Auditor

Audits SQS queues and SNS topics for policy and encryption issues (messaging).

AWS Secrets Manager Auditor

Checks Secrets Manager secrets for rotation and resource-policy exposure.

AWS GuardDuty Auditor

Verifies GuardDuty is enabled across all account regions.

AWS WAF Auditor

Audits WAFv2 web ACLs across regional and CloudFront scopes.

AWS Config Auditor

Enumerates AWS Config recorders and rules across regions.

Azure IAM/RBAC Auditor

Runs Azure IAM/RBAC role-assignment security checks.

Azure Storage Auditor

Runs Azure Storage account security checks (public access, encryption).

Azure Compute Auditor

Audits Azure compute (VM) configuration.

Azure Network Auditor

Audits Azure NSGs/network rules for over-permissive 'any' origins.

Azure Key Vault Auditor

Runs Azure Key Vault security checks.

Azure SQL Auditor

Enumerates logical SQL servers via @azure/arm-sql; derives sub-resource findings.

Azure App Service Auditor

Checks Web Apps for HTTPS-only enforcement and minimum TLS 1.2.

Azure AKS Auditor

Audits managed AKS clusters via ContainerServiceClient.

Azure Defender for Cloud Auditor

Checks Defender pricing plans, auto-provisioning and security contacts.

Azure Monitor Auditor

Checks subscription diagnostic settings, activity-log export and alerts.

Azure Policy Auditor

Checks Azure Policy assignment compliance and per-resource non-compliance (governance).

GCP IAM Auditor

Runs GCP IAM security checks.

GCP Storage (GCS) Auditor

Runs GCP Cloud Storage (GCS) bucket security checks.

GCP Compute Auditor

Runs GCP Compute Engine security checks.

GCP Network/Logging Auditor

Runs GCP VPC network and logging security checks.

GCP KMS Auditor

Runs GCP Cloud KMS key security checks.

GCP BigQuery Auditor

Checks BigQuery datasets/tables for missing default CMEK and access issues.

GCP Cloud SQL Auditor

Enumerates Cloud SQL instances via Cloud SQL Admin API; audits instance settings.

GCP GKE Auditor

Audits GKE clusters across all zonal/regional locations via ClusterManagerClient.

GCP Security Command Center Auditor

Surfaces active, un-muted SCC findings across all enabled sources.

GCP Organization Policy Auditor

Checks effective org-policy constraints for unenforced governance controls.

Active Directory User Account Auditor

On-prem AD (LDAP): stale/disabled accounts, non-expiring/old passwords.

Active Directory Privilege Auditor

On-prem AD: Domain Admin count, nested escalation paths, DCSync rights, admin service accounts.

Active Directory Group Membership Auditor

On-prem AD: empty groups, oversized groups, cross-domain foreign-principal nesting.

Active Directory Group Policy Auditor

On-prem AD: password/lockout policy, advanced audit policy, AppLocker/SRP status.

SNMP ACL Auditor

Network devices: permissive ACLs, missing egress filtering, unrestricted SNMP access.

SNMP Config Compliance Auditor

Network devices: default community strings, SNMP v1/v2c, MD5/DES, unencrypted mgmt protocols.

SNMP Device Discovery Auditor

SNMP GET discovery of device type/vendor/firmware; flags end-of-life firmware.

Identity Auditor

IdP audit (Okta/Entra ID/Google Workspace): MFA enrollment, admin sprawl, stale accounts.

Endpoint Auditor

EDR/MDM audit (Jamf/Intune/CrowdStrike): device compliance, disk encryption, patching.

Network Scanner

Scans target hosts/domains for open ports, SSL/TLS config, DNS security, HTTP headers.

Kubernetes CIS Benchmark Auditor

CIS checks on a live cluster: cluster-admin RBAC bindings, pod security, missing NetworkPolicies.

Container Registry Auditor

Registry (ECR/ACR/GAR) scan: image vulnerability findings, tag immutability, public access.

Code Repository Security Auditor

VCS (GitHub/GitLab): default-branch protection, required PR reviews, repo settings.

SaaS Security Auditor

Org-level SaaS security-policy snapshot from provider admin APIs (Google Workspace/Okta/Entra).

OT/SCADA Passive Collector

Passive-only analysis of mirrored/captured OT/SCADA traffic (safety-critical, never active).

Prowler Deep Scanner

Container Lambda running Prowler CLI for deep AWS scanning (900+ checks, framework compliance).

Checkov IaC Scanner

Checkov 3.2.0 in a container Lambda: Terraform/CloudFormation/K8s IaC misconfiguration scanning.

Semgrep IaC/SAST Scanner

Semgrep 1.90.0 in a container Lambda: static code/pattern security analysis (SARIF output).

Bandit SAST Scanner

Bandit 1.7.10 in a container Lambda: Python security static analysis (SARIF output).

Under the hood

Two execution paths, one findings pipeline.

Lightweight SDK auditors run in-process inside the scan worker. Heavy OSS tools — Prowler and the Checkov / Semgrep / Bandit IaC and SAST scanners — run as container-image Lambdas. Both normalize through a single ingest path (ADR-0003).

Scanning uses a read-only, least-privilege cross-account IAM role — no write keys. Scanners collect the minimum posture data needed and never touch PII, customer records or business content.

16 scanner families

  • SDK auditors (TypeScript, cloud SDK-backed agents in packages/api/src/agents)
  • AWS/Azure/GCP granular sub-auditors (auditXxx functions, 43 total)
  • Active Directory (LDAP) auditors
  • SNMP / network-device auditors
  • Identity (Okta/Entra/Google Workspace) auditor
  • Endpoint EDR/MDM (Jamf/Intune/CrowdStrike) auditor
  • Network scanner (ports/TLS/DNS/headers)
  • Kubernetes CIS auditor
  • Container Registry auditor
  • Code Repository (GitHub/GitLab) auditor
  • SaaS security auditor
  • OT/SCADA passive collector
  • Prowler deep scan (container Lambda, 900+ AWS checks)
  • Checkov (IaC, container Lambda)
  • Semgrep (SAST, container Lambda)
  • Bandit (Python SAST, container Lambda)
Get started

Read the source. Run it yourself.

Every auditor above is real code in the open-source repo. Clone the full stack locally — no cloud account or API keys required.

Star on GitHubSee it hosted