Criticalprod-payments / ap-south-1
S3 bucket public with customer records
Detected 00:42 ago
from finding to never again.
NxSCORE helps you find and fix what is open in your cloud, then enforces it so it never comes back.
- Assurance
- Operations
- Enforcement
1,108Open findings
464Exposed assets
34Accounts
Criticalcore-banking / Azure
Admin role granted outside change window
Detected 01:15 ago
Highdata-lake / Google Cloud
Service key unused for 214 days, still active
Detected 03:08 ago
You fix it on Monday. It is back by Friday.
Findings arrive faster than anyone can own them. The ones you fix return with the next release, and the access that made them possible never goes away.
prod-payments-customer-records / S3Reopened
Back in three days
- FoundBucket readable by anyone
- FixedPublic access blocked by hand
- Release 4.18Ships the old bucket policy
- Back againReadable by anyone, 4th time
- Open findings1,1960 with an owner
Found, not owned.
Thousands of findings, and no one with the time to decide on them.
- prod-payments-customer-records4 timesreopened this quarter
Fixed, not prevented.
The same misconfiguration, back with the next release.
- data-lake service key, Google Cloud214 dayssince last used, still active
Granted, never removed.
Access that outlives the project that needed it.
One finding, from first sight to never again.
Seen, and matched to its owner.
Your CNAPP flags the bucket. NxSCORE matches it to the payments team, finds the policy behind it and sees this is the fourth time.
Safe to fix, so it is fixed today.
No public reads in 30 days, so the verdict is safe to fix. Your analyst writes the fix kit; your engineer runs it in the change window. NxSCORE never changes your cloud.
The cause, removed.
Every release re-applied the old policy through deploy-bot. NxSCORE writes the template fix and takes away the permissions deploy-bot never used.
Then ruled out, in every cloud.
One sentence of intent becomes each cloud’s own guardrail. NxSCORE tests it on 30 days of activity first, then checks every day that it holds.
Proof, already collected.
The fix, the approval and the guardrail are evidence for every framework that asks about public storage, from ISO 27001 to your regulator.
And someone keeps watching.
When release 4.18 tried the old policy, the guardrail denied it and your analyst told the team why. The finding stays closed.
NxSCORE/ Findings / FND-20871prod-payments-customer-recordsBucket readable by anyoneOpen
Resourceprod-payments-customer-records
AWSprod-payments, ap-south-1Ownerpayments-platform team
Reported by Prisma CloudMon 10:12
Found by NxSCOREBucket policy allows s3:GetObject to *History4th time this quarter
Seen, and matched to its owner.
Your CNAPP flags the bucket. NxSCORE matches it to the payments team, finds the policy behind it and sees this is the fourth time.
Verdict and fix kitSafe to fix
CheckedNo public reads in 30 days
$ aws s3api put-public-access-block \
--bucket prod-payments-customer-records \
--public-access-block-configuration BlockPublicPolicy=truePrepared byNxSCORE analyst
Run byYour engineer, Mon 16:40
Safe to fix, so it is fixed today.
No public reads in 30 days, so the verdict is safe to fix. Your analyst writes the fix kit; your engineer runs it in the change window. NxSCORE never changes your cloud.
Why it kept coming backRecurring
Causerelease-template v4 sets the old bucket policy
Throughdeploy-bot, s3:PutBucketPolicy
deploy-bot uses6 of 48 permissions
ChangeTemplate fixed, 42 unused permissions removed
SimulatedNo denied calls in 90 days
The cause, removed.
Every release re-applied the old policy through deploy-bot. NxSCORE writes the template fix and takes away the permissions deploy-bot never used.
GuardrailIn force since Tue 14:00
No storage in prod-payments can be made public.
AWSOrganisation policy
AzureAzure Policy
Google CloudPublic access preventionSimulated30 days, nothing legitimate blocked
Wed 11:05Release 4.18 denied: old bucket policy
Then ruled out, in every cloud.
One sentence of intent becomes each cloud’s own guardrail. NxSCORE tests it on 30 days of activity first, then checks every day that it holds.
Control: public storage blockedMet
- ISO 27001
- SOC 2
- PCI DSS
- NIST CSF
- DORA
- RBI
FixRun Mon 16:40, approved by your checker
GuardrailIn force since Tue 14:00, checked daily
Evidence6 items, each with who and when
Proof, already collected.
The fix, the approval and the guardrail are evidence for every framework that asks about public storage, from ISO 27001 to your regulator.
Analyst note, Wed 11:20Closed
Release 4.18 tried to re-apply the old bucket policy at 11:05 and the guardrail denied it. Nothing else changed. I have asked payments-platform to merge the template fix so the next release is clean.
MakerNxSCORE analyst
Seen bypayments-platform, 11:24
StatusClosed, no change since Monday
And someone keeps watching.
When release 4.18 tried the old policy, the guardrail denied it and your analyst told the team why. The finding stays closed.
We write it. Your team runs it.
Fixes, access changes and guardrails all reach your cloud the same way: through your pipeline, in your change window, run by your engineers. NxSCORE's role reads configuration and is denied your data.
- Read-only, in writing.
- A role policy you can read before you sign.
- Simulated first.
- You see what a change would block before it blocks anything.
- Closed when the next assessment agrees.
- Not when someone says it is done.
Fix kit FND-20871
Written by NxSCORE
resource "aws_s3_bucket_public_access_block" "customer_records" {
bucket = "prod-payments-customer-records"
block_public_acls = true
block_public_policy = true
ignore_public_acls = true
restrict_public_buckets = true
}Your cloud. NxSCORE stays read-only and never runs this.
Run by your team
- ApprovedYour checker reviews the fix kit and the reason for it
- RunYour engineer applies it in your change window, with your tools
- VerifiedNxSCORE confirms it on the next assessment, then keeps checking
Keep your CNAPP. NxSCORE finishes the job.
Your CNAPP or cloud scanner finds a great deal. NxSCORE takes what it finds, adds what it misses, and carries each finding to a fix and a guardrail, so its next scan finds less.
Works with
- Prisma Cloud
Cortex Cloud- Wiz
Orca Security
Tenable Cloud Security
- Found1,032 from your CNAPP, 164 added by NxSCORE1,196Your CNAPP stops here
- JudgedEvery finding has a verdict and an owner1,196
- Fixed by your teamFix kits run in your change windows; 48 risks accepted by you1,148
- Ruled out by guardrails37 guardrails in force, checked every day1,148
- Came backFindings that returned after a fix0
- S3 bucket public with customer records, prod-paymentsFixed, guardrail in force
- Admin role outside change window, core-bankingRemoved, approved by a checker
- Service key unused for 214 days, data-lakeRemoved, unused keys blocked
Run your cloud on maker-checker.
Software finds and drafts. People decide. Your NxSCORE analyst prepares every verdict and every change, and your team approves it. That holds when the scanner runs inside your own account too.
NxSCORE/ Exception EX-0318Risk accepted until 31 Jan 2027prod-cards / card-switch load balancerTLS 1.0 still enabled for a legacy acquirerKey 1Maker NxSCORE analyst
Accept the risk until 31 Jan 2027, when the acquirer migrates. Until then only the acquirer’s IP range may connect, and any other client raises an alert.
Proposed Mon 11:30Key 2Checker Your security team
Accepted until 31 Jan 2027. Owner: card-switch team. Report the compensating control in the monthly risk review.
Accepted Mon 13:05Compensating controlAcquirer IP allow-list, checked every day
Expires31 Jan 2027, the finding reopens on its own
No verdict changes on one person’s word.
One person prepares, another approves. Every time.
Only your security team accepts a risk.
Your analyst can propose it. Only your team can decide it.
Every decision is kept.
Who proposed, who approved and when, filed with the finding as evidence.
The same cloud. Nothing coming back.
The same finding, the same week, the same release. This time a guardrail is in force.
prod-payments-customer-records / S3Prevented
Guardrail in force
- FoundBucket readable by anyone
- Fixed by your teamFix kit run in the change window
- Guardrail onSimulated on 30 days of activity first
- Release 4.18 deniedOld bucket policy blocked at deploy
- Still closedVerified on every assessment
- Open findings1,1960 without a verdict
Found, and owned.
Every finding has a verdict, an owner and a date, the day it arrives.
- prod-payments-customer-records0 timesreopened since Tuesday
Fixed, and prevented.
The release that brought it back is now the release that is stopped.
- data-lake service key, Google CloudRemovedunused keys now blocked
Granted, and taken back.
The unused key is removed, and a guardrail blocks keys that sit idle again.
Compliance, wherever you are regulated.
Every control is mapped once and evidenced for each framework that asks for it, from ISO 27001 to the regulator in your market.
NxSCORE/ Controls / Public access to storage is blockedMet everywhere| Framework | What it asks for | Status |
|---|---|---|
| ISO 27001 | Access to information is restricted | Met, 6 items |
| SOC 2 | Logical access is limited to authorised users | Met, 6 items |
| PCI DSS | Cardholder data is never publicly reachable | Met, 6 items |
| CIS Benchmarks | Block Public Access is on for every bucket | Met, 6 items |
| CSA CCM | Data is protected from unauthorised access | Met, 6 items |
Evidence, collected once
- Fix approved by your checker
- Fix kit run by your engineer
- Guardrail in force, simulated first
- Guardrail checked, still in force
- Release 4.18 denied by the guardrail
- Analyst note, seen by the team
The same six items answer every framework in every region. Nobody rebuilds them for an audit.
Read the role before you sign.
Everything NxSCORE can do in your cloud is written in the role you deploy. Keep it in your own change control. Remove it and our access ends, in every cloud.
ManagedPolicyArns:
- arn:aws:iam::aws:policy/SecurityAudit
- arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
Policies:
- Sid: DenyDataPlaneReads
Effect: Deny
Action:
- s3:GetObject
- s3:GetObjectVersion
- secretsmanager:GetSecretValue
# ...parameters, table items, logs, function code
AssumeRole:
Condition:
StringEquals: { sts:ExternalId: <issued to you> }No access keys. Delete the stack and access ends.
Read-only role
The NxSCORE role reads configuration. It cannot create, change or delete anything, and it holds no keys or secrets in any cloud.
Your data stays unread
Reading S3 objects, secrets, parameters, table items, logs and function code is explicitly denied.
Maker-checker
Every change to a verdict is prepared by one person and approved by another. Only your security team can accept a risk.
Your data, in your region
Findings, evidence and account data stay in the region you choose, India included.
Scanner in your account
Run the NxSCORE scanner inside your own cloud account. An NxSCORE analyst still works from the results.
Retention you set
You decide how long findings and evidence are kept, and you can export them at any time.
Questions, answered.
What teams ask us first, in a sentence or two each.
What is NxSCORE?
A cloud security platform and managed service from eSec Forte. It works with your CNAPP: it brings in its findings, scans what it misses, gives every finding a verdict and an owner, writes the fix your engineers run, and turns repeat findings into guardrails your cloud enforces. An NxSCORE analyst works on every account.
Does NxSCORE replace my CNAPP?
No. It works with the CNAPP you already have, such as Prisma Cloud, Cortex Cloud, Wiz, Orca or Tenable, and takes its findings further. If you ever change CNAPP, your decisions and history stay with you.
Does NxSCORE change anything in my cloud?
No. Its access is read-only in every cloud. NxSCORE writes the commands, scripts, policies and Terraform, and your engineers run them through your own change process.
What is cloud security intent enforcement?
Turning one sentence of intent, such as "no storage in production can be made public", into each cloud’s own guardrails. NxSCORE tests each guardrail against your recent activity first, rolls it out safely, and checks every day that it is still in force.
Which compliance frameworks does it map to?
ISO 27001, SOC 2, PCI DSS, NIST CSF, DORA, NIS2, MAS TRM, APRA CPS 234 and India’s RBI, IRDAI and SEBI CSCRF, among others. Each control is checked where a scanner can, and evidenced where it cannot.
Who decides what changes and which risks are accepted?
Your people. Anything that changes a verdict is prepared by one person and approved by another, and only your security team can accept a risk, with an owner and an expiry.
How do I start?
Ask for a free cloud assessment. You connect one account with the read-only role, and your NxSCORE analyst shows you what is open, what keeps coming back, and the guardrail that would stop it.
Who is behind NxSCORE?
eSec Forte Technologies, a CERT-In empanelled cybersecurity company founded in 2011 and headquartered in Gurugram, India, with offices in India, Sri Lanka, Singapore and the United States.
Start with one account.
Connect one cloud account with a read-only role. Your NxSCORE analyst shows you what is open, what keeps coming back, and the guardrail that would stop it.
What happens next
- We replyThe NxSCORE team emails you to agree the account and a time.
- You connect one accountWith the read-only role you read above. You can remove it at any time.
- Your analyst walks you through itWhat is open, what keeps coming back, and the guardrail that would stop it.
What you get
- Your CNAPP’s findings and ours in one list, with a verdict on each
- The recurring issues, and the access nobody has used
- Fix kits for what to fix first
- Two guardrails, simulated against your own activity