Sample case study · AWS security, compliance & governance
Six weeks with StrataForge Robotics, a fictional robot maker with 48 AWS accounts and 212,000 robots in the field. The Audit verified 54 findings, ten of them critical and two that reached robots at customer sites. The Hardening closed them as code through StrataForge’s own pull requests, and the same scan went from 32.4% to 91.1%.
StrataForge Robotics is a fictional company: every account, finding, and person on this page is simulated. The AWS services, controls, and prices are real, as documented on October 13, 2026.
StrataForge Robotics, Inc. does not exist. We built it to show what this engagement produces for an organization big enough to need all of it: 48 AWS accounts in 17 Regions, simulated resource by resource with real AWS controls and real ways to fail them, and twelve StrataForge people who make the decisions real owners make. Then we ran the six-week Hardening against it, week by week, in a real Pavilion workspace.
We never cite a client’s security findings, with or without the client’s name. So the reports here are the real deliverables, written the way we write them for a client, about a client nobody can be hurt by.
Marcus Oyelaran, StrataForge’s CISO, gave three reasons at the kickoff. A SOC 2 Type 2 audit was coming, and he did not know what the auditor would find on the AWS side. Customers were sending security questionnaires faster than his team could answer them honestly. And StrataForge had bought Kestrel Vision in November and brought five of its accounts into the organization without looking inside them.
He signed the six-week Hardening: the two-week Audit first, then three weeks closing findings as code with the engineers who own each account, and the same scan run again at week six. Elena Vasquez, who runs the cloud platform, led it day to day.
Each week ended with a report, and every report is below. The sessions, decisions, and tasks are counted from the engagement’s Pavilion workspace.
The read-only role went in through StrataForge’s change board on Tuesday and answered in all 48 accounts by early afternoon. The scan ran through Thursday: 71 controls from the CIS AWS Foundations Benchmark v5.0.0 and AWS Foundational Security Best Practices, 49,156 evaluations across 816 account-Regions.
StrataForge scored 32.3%. The five Kestrel accounts averaged 18.8% against 33.6% for the rest, and the five detection services were on in between 1% and 32% of the account-Regions. At the kickoff Marcus had set the rule that mattered a week later: any public, unauthenticated exposure gets a phone call the same day. “I’d rather know on a Tuesday than read it on a Friday.”
In the room. Five sessions: the kickoff, the architecture walkthrough, the identity interview, and two office hours.
The heaviest week. Seven owners walked through their findings one at a time, and 54 survived verification: 10 critical, 20 high, 15 medium, and 9 low, plus six scanner results kept in the register as false positives, each with its reason. Six of the ten criticals needed no credentials at all, and two reached robots in the field.
On Monday the Kestrel accounts turned out to hold four public dataset buckets with 361 TB in them, public snapshots, and an internet-facing Jenkins server holding 31 AWS keys, one of them a root key. Charles called Marcus that afternoon and put the notice in writing. Marcus briefed Legal first and held the fixes to the following Monday, a decision recorded with his name on it.
On Wednesday, with Sam Okafor’s written approval and his fleet team in the room, a bench test proved the worst robot finding: one robot’s certificate could publish to another robot’s command topic. At Friday’s readout Marcus agreed the register and its ten criticals as the gate, and Priya Raman, the CTO, committed six owners to review fixes within two business days.
In the room. Thirteen sessions: seven owner verifications, the bench session, a connection-log match, the findings review, two office hours, and the sponsor readout.
Nine of the ten criticals closed on Monday and Tuesday, as code, among 27 pull requests that week in four repositories, each reviewed by the engineer who owns the account. Service control policies, a resource control policy, and EC2 declarative policies went in at the top of the organization, so what closed stays closed, including in six organizational units whose policies had been detached since March 2023.
The tenth could not close in a week. 3,412 ForgeArm gen-2 robots run firmware 3.x and cannot take the new per-robot IoT policy until firmware 4.2 reaches each customer’s maintenance window. Every other robot moved to the new policy, the old one was cut down to telemetry, and Marcus took a written risk acceptance to Priya.
In the room. Seven sessions: two change reviews, two pairing sessions on the IoT rollout waves and the policy rollout order, two office hours, and the weekly check-in.
Everyone moved to IAM Identity Center: coverage went from 70.1% to 100.0% of 1,420 people, IAM users from 1,394 to 403 with no human or CI user left, console users without MFA from 108 to none, and access keys older than 90 days from 1,009 to 57. Root credentials came out of 47 of the 48 accounts, and every root and break-glass sign-in now pages security.
Matching the HR roster against the IAM users found 48 people who had left StrataForge and could still reach AWS. Their users were deleted, and the monthly match became standing practice. The 57 keys left belong to factory gateways, kept on purpose until their maintenance windows.
In the room. Seven sessions: two change reviews, pairing sessions on the HR roster match and on root access, two office hours, and the weekly check-in.
GuardDuty, Security Hub CSPM, AWS Config, IAM Access Analyzer, and Amazon Inspector went on in all 816 account-Regions and route to on-call through PagerDuty. A new organization trail writes to a log archive locked in compliance mode for 400 days, and ten runbooks cover what will page someone.
Detection costs money, so the number went to Marcus the night before the check-in: $60,745 a month more, from $58,900 to $119,645. He confirmed the budget on Friday and kept every service.
In the room. Seven sessions: two change reviews, pairing sessions on PagerDuty routing and on Kubernetes logging, two office hours, and the weekly check-in.
The week-one scan ran again, the same way: 32.4% became 91.1% on the same 71 controls, and failed controls fell from 1,603 to 211. The report prints 86.3% beside it, the score without the three suppressions the work earned, because both numbers are true.
Of the 54 findings, 34 closed, 2 were accepted in writing, 8 were partly done, and 10 were still open, none of them critical. On Wednesday Marcus and Priya signed the acceptance for the firmware 3.x robots, expiring December 15, 2026. On Thursday the handover workshop walked the runbooks, and Elena deleted the audit role from every account: from that afternoon Vantalect had no access to StrataForge. On Friday Marcus read the gate out loud, the way the contract words it, and ordered the second invoice.
In the room. Seven sessions: the re-scan review, a dry run of the monthly security review, the signing, the two-hour handover workshop, two office hours, and the closing readout.
Half the fee rode on every critical finding in the agreed register being closed, verified by the week-six re-scan, with a critical accepted in writing counting as closed. The re-scan is the same scan as week one, run the same way.
86.3% without the three suppressions the work earned. Failed controls fell from 1,603 to 211.
Nine closed as code on July 27 and 28. One accepted in writing by the CISO and the CTO, until December 15, 2026.
Console users without MFA went from 108 to none, and 48 former employees lost access they should not have had.
Marcus Oyelaran read the gate out on August 21: nine critical findings closed and verified by the re-scan, one accepted in writing, none open. The gate passed, and the second invoice, $17,500, went out that day.
Still to do: 18 findings and about 717 hours of work, each with an owner and a date, the first due September 4 and the last January 29, 2027. The worst of them is high, not critical: five high findings waiting on a firmware window, a customer site, or an upgrade. Keeping the score costs $60,745 a month more in detection, and an hour a month for the security review Nadia Petrova chairs, which started September 1.
Want this gate on your own organization?
Book a call about the HardeningThe Hardening ran in a Pavilion workspace, created from the engagement’s template a week before kickoff with every week, session, deliverable, and obligation already in place, on StrataForge’s calendar in Mountain time. Thirteen people had a place in it: the CISO as sponsor, the CTO and finance as observers, nine owners and engineers, and Charles.
After each session the transcript came into the workspace, and an agent drafted the summary, the decisions, the action items, and a digest for the people who were not in the room, every claim citing the part of the transcript it came from. Charles reviewed every draft before StrataForge saw it. Four pairing sessions went unrecorded, so they got consultant notes instead.
The findings register lived there too: each of the 54 findings was a task with an owner, and each of the 48 pull-request reviews was a task that finished on the day it was due. Every report was published as an immutable, hashed version and accepted by Marcus against that version, the deliverables were checked off against that evidence, and the workspace’s audit log keeps all 582 events in an unbroken hash chain.
When the Kestrel exposures were confirmed on July 20, Charles called Marcus and posted the notice to the workspace that afternoon. The thread holds what Marcus decided and why: brief Legal first, tell only security operations, hold the fixes to Monday. Anyone who read the register later could see why public buckets stayed public for a week.
Before the bench test, Sam Okafor’s approval went into a thread with his conditions: two bench units, never a customer’s robot, actuator power cut, the emergency stop engaged, his team in the room. Charles accepted every condition in writing, and Marcus added one line: nothing touches a robot at a customer site.
The firmware 3.x acceptance took three weeks: the draft on July 31, Marcus’s questions answered that evening, Priya asking for a weekly count of the affected robots, and both signatures on August 19, attached to the finding with an expiry date and a task for Marcus to decide on renewal that day.
Charles sent Marcus the detection budget the night before the check-in, so Friday’s number would not be a surprise at nine. Marcus asked two questions in the thread, got two answers, and confirmed $176,409 a month for detection and logging the next morning.
On August 20 Elena Vasquez deleted the audit role from every account, the management account included, and posted both checks to the thread. From then on, Vantalect had no access to any StrataForge account, and the workspace says when that started.
Ten PDFs and 454 pages. Start with the readout; the reading guide shows how the rest fit together. Then read the next three for what changed and the re-scan for the proof. Each one is tagged for screen readers, and each says on its cover that StrataForge is fictional.
Written for the sponsor, and the one to read if you read nothing else: what an attacker could reach today, the critical findings, the decisions the sponsor needs to make, and the four weeks of hardening that follow.
strataforge-security-3-readout.pdf
What an attacker could reach today, the critical findings, the decisions the sponsor needs to make, and the four weeks of hardening that follow.
View Audit Sponsor Readout in the PDF viewerDownload PDF of Audit Sponsor Readout
The full audit report, with the prescriptive fix for each finding, and the appendix behind it: the code, the commands, how to verify each change, and how to roll it back.
strataforge-security-2-audit.pdf
The verified findings register, identity and access review, SOC 2 compliance map, governance review, and remediation roadmap, with the prescriptive fix for each finding.
View Audit Report in the PDF viewerDownload PDF of Audit Report
strataforge-security-2-appendix.pdf
The complete prescriptive remediation for every finding in the audit report: the code, the commands, how to verify it, and how to roll it back.
View Audit Report Appendix: Remediation Code in the PDF viewerDownload PDF of Audit Report Appendix: Remediation Code
The reading guide first, then what each week delivered, in order.
strataforge-0-guide.pdf
Who StrataForge Robotics is, what each of the sixteen sample reports (and the audit’s code appendix) delivers, what the two engagements found and fixed, and what is real and what is simulated.
View Sample Engagement Reports in the PDF viewerDownload PDF of Sample Engagement Reports
strataforge-security-1-scan.pdf
Every account and enabled Region scored against CIS AWS Foundations Benchmark v5.0.0 and AWS Foundational Security Best Practices.
View Organization Scan in the PDF viewerDownload PDF of Organization Scan
strataforge-security-4-criticals-guardrails.pdf
Every critical finding closed as code, and the service control policies, resource control policies, and account defaults that keep it closed.
View Criticals Closed and Guardrails at the Top in the PDF viewerDownload PDF of Criticals Closed and Guardrails at the Top
strataforge-security-5-identity.pdf
People on single sign-on, long-lived keys retired, workload roles cut to least privilege, and root and break-glass access locked down.
View Identity Rebuilt in the PDF viewerDownload PDF of Identity Rebuilt
strataforge-security-6-detection-response.pdf
GuardDuty, Security Hub CSPM, IAM Access Analyzer, and AWS Config in every account and Region, the organization trail, and the runbooks.
View Detection and Response Everywhere in the PDF viewerDownload PDF of Detection and Response Everywhere
strataforge-security-7-rescan.pdf
The same scan as week one, run the same way: before and after, every critical’s closure evidence, and the guarantee’s gate.
View Week-Six Re-Scan in the PDF viewerDownload PDF of Week-Six Re-Scan
strataforge-security-8-runbooks-handover.pdf
The runbooks for the alerts most likely to page StrataForge, the remaining roadmap, and how to keep the score where it is.
View Incident Runbooks and Handover in the PDF viewerDownload PDF of Incident Runbooks and Handover
The same six weeks and the same gate, in your own accounts.
The Audit and the Hardening: the verified findings register and the roadmap in two weeks, then every critical closed as code, with half the fee riding on the re-scan.
Read the engagement
The same client, August 24 to October 2: $23.5 million a year identified, $11.1 million put in place, and $9.4 million measured on its own Cost and Usage Report.
Read the case studyTell us how many accounts, which framework your auditors use, and what prompted the question. You will hear back from Charles within one business day, and the first call is fifteen minutes.
AWS, Amazon Web Services, and the AWS service names are trademarks of Amazon.com, Inc. or its affiliates. SOC 2 is a registered trademark of the American Institute of Certified Public Accountants. CIS Benchmarks is a trademark of the Center for Internet Security, Inc. PagerDuty is a trademark of PagerDuty, Inc. Jenkins is a registered trademark of LF Charities Inc. Vantalect is not affiliated with or endorsed by any of them. StrataForge Robotics, ForgeArm, Kestrel Vision, and every person named on this page are fictional.