Security Research

I've been through SOC 2 audits on both sides of the table — as the person preparing the evidence and as the one reviewing it.

If you've been working with AWS for more than a few months, you already know the fundamentals of VPC security.

Last month, I helped a mid-size SaaS company audit their AWS spend.

I spent a good chunk of last Tuesday afternoon staring at an IAM policy that a client swore was "locked down.

Look, I get it.

If you run infrastructure on AWS, you know the drill. You’ve got S3 buckets, IAM roles, EC2 instances, Lambda functions, RDS databases — spread across regions, accounts, and teams. Somewhere in there, a security group is too permissive. An IAM policy grants more than it should. A bucket is publicly accessible. And you won’t find out until the auditor asks, or worse. The existing tools help, but they tend to do one thing: scan and report. You get a list of findings — often hundreds or thousands — and then you’re on your own to triage, prioritize, map to compliance frameworks, and figure out what to fix first. Pavora takes a different approach. It’s a unified platform that handles the full cycle: scan, visualize, map to compliance, and remediate.