Where teams start with NxSCORE.
Six situations, in the words teams use for them. Each one is followed step by step, from the first assessment to the problem staying fixed, with an NxSCORE analyst on it throughout.
You will recognise this if
- The same findings come back, however many are closed.
- Nobody is sure a fix is safe until someone has tried it.
- An audit, a CNAPP change or a board question is coming, and the record lives in spreadsheets.
- You have a CNAPP, and the work after the alert still falls on your team.
Find your starting point.
Start with whichever sounds most like this week. They share one record, so the others follow from it.
| When this is true | Start with | What changes |
|---|---|---|
| Most weeks end with more findings than they started with | The alert backlog that never gets shorter | A short list of issues by cause, each with an owner, a date and a plan to stop it coming back. |
| Public access findings come back after every release | Closing what is open to the internet | Every way in found and ranked by what it reaches, closed with fix kits, and kept closed by the cloud itself. |
| A security fix caused an outage, and fixes now wait months | After a fix took production down | A verdict from your own account’s evidence before each change, and the undo written in the same file. |
| Your CNAPP has been renamed, merged or replaced | Changing your CNAPP without starting again | Decisions, exceptions and evidence kept on the account and the control, whichever CNAPP raises the finding. |
| An audit is coming and the evidence is screenshots in a folder | The audit is in six weeks | A status for every requirement, evidence collected once and counted everywhere, and a pack your assessor can read. |
| The board asks how far the programme has come | How far your CNAPP programme has come, measured | A level for each of ten dimensions, most measured every day, with the criteria that would move it. |
The alert backlog that never gets shorter.
Most of a cloud security backlog is the same few mistakes coming back. How NxSCORE sorts findings by cause, clears them safely and stops the queue refilling.
For cloud security teams with a CNAPP queue that keeps refilling
You will recognise it
- A finding your team closed in March is back on the list.
- Nobody can say who owns half the resources in the queue.
| Issue | Open | Came back | Prevention |
|---|---|---|---|
| S3 buckets that allow public access | 214 | 61 | Agreed |
| EC2 instances that still allow IMDSv1 | 181 | 44 | None yet |
| Access keys not used for 90 days or more | 133 | 0 | None yet |
| Security groups open to the internet on port 22 | 96 | 27 | Applied |
What changes
A short list of issues by cause, each with an owner, a date and a plan to stop it coming back.
Parts of the loop it covers
- See
- Fix
- Prevent
Closing what is open to the internet.
Public buckets, open ports, shared snapshots, unused keys. How NxSCORE finds what is reachable, closes it with your team and keeps it closed with a guardrail.
For cloud security and platform teams closing public access
You will recognise it
- You know which buckets are public, but not which are meant to be.
- Snapshots and images were shared publicly years ago, and nobody has looked since.
- pay-batch-3, prod-paymentsReachable
Public address, a route to the internet, and port 22 open to anyone. All three at once.
- reporting-db, data-lakeNot reachable
Marked public, but in a subnet with no route out. Still a finding, ranked lower.
- snap-0f2e77, core-bankingShared outside
Shared with an account that is not one of yours.
What changes
Every way in found and ranked by what it reaches, closed with fix kits, and kept closed by the cloud itself.
Parts of the loop it covers
- See
- Fix
- Prevent
- Enforce
After a fix took production down.
After a security fix breaks production, nobody wants to fix anything. How NxSCORE checks usage first, writes kits with a rollback, and proves each fix held.
For platform and operations engineers who run the change
You will recognise it
- Engineers ask what uses a resource, and nobody can answer it quickly.
- Nobody is sure how a change would be undone if it went wrong.
- sg-0a41c9 admin-ssh, prod-paymentsCheck first
Attached to 2 instances: pay-api-1, pay-api-2. Make sure admins reach these through Session Manager or a VPN first.
- sg-07be12 old-jumpbox, prod-paymentsSafe to fix
Not attached to any network interface.
- Access key for svc-export, data-lakeIn use
Last used 3 days ago. Move the caller to a role first.
- Load balancer listener, core-bankingNot checked
No automatic usage check for this kind of resource. Your analyst is asking the owner.
What changes
A verdict from your own account’s evidence before each change, and the undo written in the same file.
Parts of the loop it covers
- Fix
- Prevent
Six ways in. One record under all of them.
Changing your CNAPP without starting again.
Exceptions, owners, fix-by dates and evidence usually live in your CNAPP. How NxSCORE keeps every decision, and full coverage, through a CNAPP move.
For security leaders whose CNAPP is changing, by choice or not
You will recognise it
- Two years of exceptions live in the old tool, and nobody is sure which still apply.
- The new CNAPP’s first scan opened thousands of findings your team had already dealt with.
- S3 buckets block public accessYour CNAPP
Policy on, and an alert rule sends it for every account.
- EC2 instances require IMDSv2NxSCORE
The policy is off in your CNAPP, so NxSCORE checks it.
- CloudTrail is on in every regionYour CNAPP and NxSCORE
The alert rule covers two regions only, so NxSCORE checks the rest.
- Access reviews done each quarterEvidence
No tool can check it. Your team uploads the review and an analyst accepts it.
What changes
Decisions, exceptions and evidence kept on the account and the control, whichever CNAPP raises the finding.
Parts of the loop it covers
- See
- Watch
The audit is in six weeks.
Most of a cloud audit is evidence, not scan results. How NxSCORE tracks each requirement, checks every upload, reuses it across frameworks and signs packs.
For compliance, GRC and security teams facing an assessor
You will recognise it
- Your CNAPP’s compliance score looks fine, and the auditor’s list is mostly things it cannot check.
- The same access review is collected three times, for three frameworks.
| Requirement | Status |
|---|---|
| 1.3.1 Inbound traffic to the cardholder data environment is restricted | Failing |
| 8.2.6 Inactive user accounts are removed or disabled within 90 days | Evidence needed |
| 10.2.1 Audit logs are enabled and active | In review |
| 12.1.1 An information security policy is established and published | Met |
What changes
A status for every requirement, evidence collected once and counted everywhere, and a pack your assessor can read.
Parts of the loop it covers
- Prove
How far your CNAPP programme has come, measured.
The NxSCORE CNAPP Maturity Model: ten dimensions, five levels, 40 criteria, most measured daily from your own data, with the weakest dimension named.
For CISOs and boards asking where the programme stands
You will recognise it
- The CNAPP has modules and policies nobody switched on, and nobody is sure which.
- Last year’s maturity assessment was a workshop and a slide.
- Visibility and coverageL3 Governed
- Posture managementL3 Governed
- Identity and entitlementsL2 Visible
- Workload protectionL3 Governed
- Data securityL1 Ad hoc
- Code and infrastructure as codeL2 Visible
And four more dimensions, with the weakest one named.
What changes
A level for each of ten dimensions, most measured every day, with the criteria that would move it.
Parts of the loop it covers
- Watch
- Prove
Questions teams ask before they start.
Which use case should we start with?
The one costing you most this quarter. All six start the same way: one cloud account connected read-only, your CNAPP if you have one, and a first assessment your analyst takes you through.
Can we work on more than one at once?
Yes. They share one record of findings, decisions and evidence, so work on one counts for the others: a fix that shortens the backlog also closes exposure, and evidence collected for an audit feeds the maturity level.
Do we need a CNAPP?
No. NxSCORE scans your accounts read-only on its own. With a CNAPP connected, it also reads the CNAPP’s findings and shows what its policies leave out.
Start with one account.
Connect one cloud account, read-only. After the first assessment, your analyst shows you which of these six is costing you most, and where to begin.