The four AWS evidence categories ISO 27001 auditors actually ask for, from someone who’s prepared environments for a real audit. Custom evidence collection, common gaps, and where teams get caught off guard.
Security Hub’s new MCP app brings exposure findings into Claude Desktop. Setup, available tools, and practical use cases for compliance triage and remediation prioritization.
GuardDuty and Security Hub show up in almost every AWS security architecture, but they solve fundamentally different problems. GuardDuty watches what’s happening right now — threat detection. Security Hub checks whether your environment is configured correctly — posture management. They overlap in one specific area (findings), which is where the confusion starts. This post breaks down what each service actually does, where they complement each other, and how to set them up together without redundant noise or wasted spend. ...
How to actually use CloudTrail logs day-to-day — tracing non-compliant resources to their source, querying with Athena, and setting up alerts before things go wrong.
Five AWS misconfigurations I find in every security audit — with Console and Terraform fixes for public S3 buckets, over-permissive IAM, open security groups, and missing monitoring.
How to map, audit, and automate CIS Benchmark compliance for EC2 instances using AWS Config, Security Hub, SSM, and open-source scanners.