Determination Map: Security Decisioning Vectors
VirtuIntelligence | Entra, Microsoft 365, Copilot, Azure (seven subscriptions), Active Directory, AWS (six accounts) & Anthropic Claude. Security telemetry from Defender XDR, Sentinel, GuardDuty, CloudTrail and Defender for Cloud. Compare the assessed conditions, affected populations and decisions across the estate.
Demonstration dataset · Figures and dates randomized for marketing; this is not a live assessment of VirtuIntelligence.
Hover a marker for its numbers; select it for its findings.
Color:
Size:
LightDark
Segment:
Governance frame:
Longitudinal view:
Platforms:
All
Impact
Severe
attested urgent only (none on this map)
Major
catalog High, Important; AD Priority
Moderate
catalog Medium
Minor
catalog Low
Unknown
not read (1)
Indirect
something else must also hold
Configured
a direct path exists, no use observed
Confirmed
observed events (ring) or standing access
Exposure
act first ↗
DP-01
DP-02
DP-03
DP-04
DP-05
DP-06
DP-08
DP-09
DR-01
DR-02
DR-03
DR-04
DR-05
DR-06
DR-08
ES-01
ES-02
ES-03
GOV-01
GOV-02
GOV-03
GOV-04
GOV-05
ID-01
ID-02
ID-03
ID-05
ID-06
ID-07
ID-20
ID-21
ID-23
ID-24
ID-33
ID-34
PA-06
PA-08
PA-20
PA-21
PA-22
PA-23
PA-24
PA-25
PA-30
PA-31
RC-01
WE-01
WE-02
WE-03
WE-04
WE-05
WE-21
WE-22
WE-31
WE-32
WE-33
WE-34
WE-35
DP-11
AI-03
AI-06
DP-13
PA-09
GOV-06
AI-01
AI-04
AI-05
AI-08
Position within a band is relativeImpact and exposure are four-level ordinals; the inputs carry no finer precision. Within a band, further right means more of the action’s records sit at that exposure and the impact-setting record is more directly exploitable; further up means a larger measured share and more records at that severity. Within each band the actions are spread evenly by that weight so the band's full height is used, and markers are then pushed apart so none overlap. No marker crosses a band boundary. Band heights and column widths follow occupancy, not importance: an empty tail, or an Unknown column with almost nothing in it, is drawn as a labeled strip so the bands and columns that hold the decisions get the room. Raised to the top of their band by the assessor and stepped a little apart in the assessor's order, highest first, with the outer ring described under Marker style: DR-01, PA-06, WE-22, WE-34, AI-01
Size: share of the populationSize reflects the affected share of the declared population, between a minimum readable size (34 px, room for the id) and 72 px; between those, area is proportional. The hover gives the exact numbers.
Marker style: how the size was set, what Confirmed means, the one mark that is a judgment, and the trend shapes outer ring: raised to the top of its band by the assessor, a declared judgment, not a measurement (here, highest first: DR-01, PA-06, WE-22, WE-34, AI-01)inner ring: confirmed by observed events (sign-ins, alerts, incidents); no ring: standing access or a configuration in usedashed: population not read or not assessed; dotted inner ring: a tenant-wide condition with nothing to divide by. Both drawn mid-sizesized but dashed: assessment incomplete for most of the population (the share is a floor)★★★ the tool read it directly from the source; ★★ read, but with a competing reading or a declared compensating control that changes what it means; ★ inferred or declared, not measured pointing up: improved since the baseline in the selected longitudinal window; pointing down: regressed or newly failing. The shape follows the record that sets the action's impact; the drawer names any other record that moved
How an action is placedAn action groups the findings that one fix would address; each carries a NIST CSF 2.0 category (in the register and the drawer), and the rules behind it carry their NIST 800-53 controls in the tools' catalogs. Its impact is the highest severity any of its findings carries; its exposure is the most direct path any of them shows; its size is the share measured by the finding that set the impact, and if that finding has no measured share the marker is drawn unsized. The drawer names the finding behind each factor.
Platform: the plane that produced the evidenceEntra ID (11)Active Directory (10)Microsoft 365 (6)Azure (12)AWS (17)Endpoints (1)Security tooling (3)Anthropic Claude (4)Microsoft 365 Copilot (4)An action drawn from two platforms is a split disc: DP-02, DR-01, DR-08, ES-01, GOV-03, ID-01, ID-02, ID-03, ID-06, WE-01, WE-04, AI-03, AI-06. The color marks where the evidence came from, not who manages the thing: a device managed by another product still reads as Endpoints.
Identity: Entra & ADAssessedEntra: 38,752 user objects (4 guests), 34,519 enabled, 38,664 synchronized from AD (both tools agree). 24,434 of 34,516 MFA-evaluated members have no Entra MFA registration (24,996 on 1 September); the registration report does not see the third-party MFA provider, which carries MFA through Conditional Access except where excluded (design as read on 5 September: the Global Administrator role is excluded from every third-party MFA policy by role, and devices tagged in a directory extension attribute skip MFA by device filter). 82 privileged assignments active, 3 of them the assessment account's (79 without them, 82 on 1 September); 48 people hold a directory role, 20 only through a group; 5 Global Administrators, all cloud-only, one with no Entra MFA registration; 6 active privileged users have no MFA registered; none of the 48 has a phishing-resistant method; 8 privileged roles allow permanent active assignment. 113 users at Medium risk unremediated, none at High. AD: krbtgt unchanged for 6912 days; 48 of 52 privileged AD identities have an enabled synchronized Entra twin (one added since 1 September); a built-in operators group has 46 effective members; 23 non-DC objects carry unconstrained delegation and all 52 tier-0 accounts are unprotected against it; 49 Kerberoastable accounts; 3 unrecognized principals hold directory replication rights; 9,135 enabled accounts never expire their password (179 arrived with the flag since 1 September). AWS: people reach the account through 5 native IAM users, one of them the assessor's.
Collaboration: M365Assessed28,794 mailboxes; 7 forward to external addresses (102 on 1 September, an earlier and narrower read: the removals need confirming before they count as remediation) and 3 custom outbound policies permit forwarding; 775 user mailboxes sit on disabled accounts without a hold (704 on 1 September) and 600 disabled accounts are still licensed (533). 4 applications read content tenant-wide and 24 delegated content consents are open to every user; Microsoft Graph Command Line Tools holds a tenant-wide consent with 7 write scopes. Privilege outside Entra roles: 2 Exchange role-group members can search or export mailboxes and 4 Purview role-group members reach content tenant-wide. 2,311 Teams: 35 without an enabled owner, 932 with a single owner; 30 of 2,330 Microsoft 365 groups are public. Mail authentication on the verified domains: 3 publish no SPF record, 5 have no DKIM signing configured in Exchange Online (a mail gateway may sign; not read), 1 publishes DMARC that does not enforce.
AI: Copilot & ClaudeAssessedCopilot: 274 seats, 58 without Entra MFA registration, one on a disabled account and two on directory-role accounts. Claude Enterprise: 312 current members; 327 historical users active in 90 days. Activity includes 88,940 chat messages across 16,212 conversations, 5,318 Code sessions and 10,264 Cowork sessions. 72 connectors (41 MCP servers, 31 plugins), 27 granted through roles; 34 custom roles, 33 sharing one permission set. Tools default to always-allow. Four compliance keys, one content-capable; all three Console API keys are archived. Historical users and the current roster are different cohorts.
Resources & endpointsAssessedEndpoints: 31,298 active Entra devices. AD reads 23,193 of 27,650 active Windows clients past or within 180 days of end of support, 5,287 already past; 17,467 devices run Windows 11 23H2, whose servicing ends on 10 November 2026 (18,751 on 5 September), and 4,481 already run 25H2 (3,128). 29,693 devices are onboarded to Defender for Endpoint, 1,978 discovered and not onboarded, 636 active devices have no sensor report, and 77 report telemetry more than a week older than their last sign-in. Intune holds 3,094 records, 394 non-compliant; 27,152 active Windows and macOS devices have no Intune record, 26,493 of them claiming MDM enrollment in Entra: Configuration Manager is the leading reading, a management plane not assessed. AD: 1,522 of 2,890 enabled server objects are past or within 180 days of end of support (68 past; Windows Server 2016 ends 12 January 2027). Azure: 7 subscriptions, 2,571 resources; Owner at broad scope 2 (15 on 1 September), 33 orphaned assignments, 4 custom roles with wildcard actions; Key Vaults without purge protection 2 (3). AWS: 5 EC2 instances (4 running) and 86 S3 buckets with no AWS Backup recovery point; EBS default encryption off in all 18 regions and all 6 attached volumes unencrypted; 8 aged access keys; 121 roles flagged for unused access.
Detection & responseAssessedDefender for Cloud: 74 High alerts active with no recorded disposition (81 on 1 September; the 90-day window moves), 108 alerts active more than 7 days (138); 344 of 641 evaluated high-severity assessment types unhealthy, and 1,388 AWS high-severity findings through the connector. Defender XDR: 5 High incidents open more than 7 days (6), Sentinel 5 (7); 1 attack-disruption incident (a compromised device, 7 July) still in progress with no classification. Sentinel: 77 analytics rules enabled, 58 disabled, 41 tables receiving data. Defender for Identity: 8 sensors, 11 open health issues on 5 hosts; 1,041 enabled accounts active per AD were not seen authenticating by the sensors in 30 days, a coverage question rather than a finding. Identity Protection: 113 users at Medium risk and 249 at Low, unremediated, and 2,065 detections in 30 days. GuardDuty is enabled in 18 regions; its 2 unarchived High findings are the assessment's own activity of 7 August.
External surfaceAssessedAWS: none of the 14 internet-facing application load balancers and 10 of 14 CloudFront distributions has a web ACL, one production distribution among them since its ACL was removed between 1 and 5 September; 29 security-group rules admit 0.0.0.0/0 (3 on sensitive ports); 39 network interfaces hold a public IP; IMDSv2 is not enforced on the internet-facing jump box; 12 of 118 DNS records pointing at AWS hostnames match no resource in the account; account-level S3 Block Public Access is off and 15 bucket policies evaluate as public (14 held by bucket-level settings). Defender for Cloud models 58 High attack paths (61 on 1 September), all beginning at internet-exposed AWS EC2 instances: modeled, not validated. Azure: 3 public IPs, 2 public web endpoints without a WAF or edge control, 3 load balancer frontends forwarding management or database ports (backend filtering not evaluated), 6 NSG rules admitting internet-sourced traffic; 8 Arc machines report a public address. Domains: service.virtuintelligence.example's registration expires on 2 November 2026 (49 days), transfer lock on; 5 of 5 verified domains lack an effective CAA record.
Observed integrations and evidence contextHybrid identity: 38,664 of 38,752 users are synchronized from the forest by one Connect Sync server (last sync 0.7 hours before the AD tool's read; provisioning errors on 4 users); the AD tool's Entra plane and the tenant tool agree on the synchronized count, and a new cross-check reads every synchronized identity's cloud immutable id pointing at the AD object its SID names (0 mismatches). Password hash sync, the sync takeover protections and accidental-deletion prevention are not established: the synchronization features read was denied again.MFA design, from the assessor's Graph reads of 5 September (not re-read by hand on 14 September): a third-party MFA provider is delivered through an external authentication method on one group and through a legacy custom control on the baseline and workload policies, which Microsoft retires in early 2027. The administrator MFA policy requires MFA for the Global Administrator role with no authentication strength; the role is excluded from every other MFA policy by role. Every third-party MFA policy excludes devices whose extension attribute carries a bypass value. The registration counts on this map are Entra registration only.Detection integration: AWS CloudTrail and VPC flow logs reach Sentinel through the connector configured on 13 August, and GuardDuty findings through the same connector. Defender for Cloud holds the AWS account through its connector, and all 58 of its High attack paths begin at AWS instances, which the tenant workbook files under Azure. Detection sources retain their own observation windows and collection receipts.Device management: Intune holds 3,094 records. A Configuration Manager service principal is present and 26,493 active devices claim MDM enrollment with no Intune record, so Windows management runs on another plane; Defender for Endpoint (29,693 onboarded) is the protection measure on this map. Windows editions and ESU enrollment are not on the Entra device record.Cloud apps and Copilot reach: the Defender for Cloud Apps exports and the shared-mailbox permission walk were not part of the 14 September run, so the generative-AI usage and the Copilot reach through shared mailboxes stand at their 5 September readings and are not redrawn here.The assessment account holds its directory and security roles directly and through a role-assignable group, and in Azure a collection-scoped assignment conditioned (ABAC) against role-assignment writes; its 3 directory role assignments are excluded from the comparison on both dates. One of the five AWS console users is the assessor's own IAM user, and the two High GuardDuty findings name the assessor's user and audit role. The Global Administrators and role holders are counts of accounts; no VirtuIntelligence individual is named on this map.Claude: metadata-only Activity Feed covers the complete 90-day window with approximately 1.7 million events. No conversation or file content was opened. The Sentinel ingestion check is an earlier 30-day evidence window: 315,494 of 517,206 events were absent by the daily-count comparison; an event-id match is the validation step. Current membership, historical use and earlier connector joins are kept as distinct cohorts.
Decisions for leadership, selected by the assessor (the full map of 68 actions is above; each decision opens its records)
- : 5 Global Administrators are active, all cloud-only and none eligible: 4 have an Entra MFA method registered and 1 has none, with only a phone on file. None of the 48 people holding a directory role has a phishing-resistant method; 8 privileged roles still allow permanent active assignment, and Global Administrator activation requires MFA and a justification but no approval. 6 active privileged users have no MFA registered (5 on 1 September; the sixth through a role the read covers for the first time), and 1 privileged role holder still carries an unresolved risk state (2 on 1 September). From the Conditional Access design read on 5 September: the role is excluded by role from every third-party MFA policy and 2 of the 5 are excluded from the administrator MFA policy by user id. Decide: who validates the two excluded accounts and whether one is VirtuIntelligence's emergency-access account; the sign-in standard for administrators (a phishing-resistant authentication strength, eligible rather than standing roles, approval for Global Administrator activation); a recorded disposition for the remaining risk; who owns the MFA bypass attribute.
- : 48 of 52 privileged AD identities have a synchronized, enabled Entra counterpart; one account was added to a privileged AD group since 1 September and it too has an enabled synchronized counterpart. 14 synchronized accounts hold privileged Entra roles, unchanged, and 1 synchronized holder of a selected privileged role has no MFA registration. A built-in operators group grew from 45 to 46 effective members. Decide: whether this week's addition was planned; the tier-0 AD accounts out of sync scope (or filtered by attribute), separating AD and cloud administration.
- : A production CloudFront distribution lost its web ACL between 1 and 5 September and is still without one on 14 September, while its staging counterpart keeps a matching ACL; the load balancer behind it has none of its own. No other finding moved between 6 and 14 September: none of the 14 internet-facing application load balancers and 10 of 14 CloudFront distributions have a web ACL, 29 security-group rules admit 0.0.0.0/0 (3 on sensitive ports), IMDSv2 is not enforced on the internet-facing jump box, and account-level S3 Block Public Access is off. Decide: whether the removal was approved, and the association restored if not; then a WAF baseline for the load balancers and distributions.
- : Microsoft Graph Command Line Tools holds a delegated consent for every user in the tenant with 7 write scopes, so every administrative token issued to it carries write scopes it does not need; 4 applications read content tenant-wide and 24 delegated content consents are open to every user, unchanged. Newly measured this week: 6 applications and 23 people outside tier 0 can change the membership of groups named by enforced Conditional Access policies, and 3 applications can grant directory roles. Decide: the all-users grant reduced to read scopes with write scopes granted per administrator; the scope of third-party vendor applications. The Claude Microsoft 365 connector has a delegated consent including Mail.Read.Shared, meeting transcript, recording and AI-insight scopes. The earlier 30-day join recorded 171 users and 61,824 Graph calls. Review the specific data reach alongside the tenant-wide application grants.
- : Connector authorization in Claude Enterprise does not differentiate, and the organization's own tools sit behind it. 72 connectors are on record (41 MCP servers, 31 plugins); 29 of the MCP servers are the organization's own (finance, sales and operations tools among them), 14 of them connected in the last 30 days. 34 custom roles carry 2 permission sets (33 share one), 27 connectors are granted through the roles (about 18 of them the organization's own, 26 with always-allow), and connector tools default to always-allow, so a member can run them without a per-call approval. 4 of the 27 still carry names marking them retired (unchanged since 3 September), one connected on 10 September, and 2 more named test or prototype were connected in the last 30 days. Decide: remove the retired connectors after a dependency check, move test and prototype servers out of the production roles, name an owner per custom server, per-call approval on for content and write tools, and a tiered role catalog. Settings that are choices rather than defects (default retention, content redaction, IP allowlist, feedback collection, desktop extension allowlist) deserve a recorded decision each.
- : 10 Claude Enterprise members hold Entra directory roles on the same account (11 including the assessment identity); two Copilot seats are also assigned to directory-role accounts. In the earlier 30-day connector join, 66 of 171 Claude Microsoft 365 connector users held FullAccess on 122 shared mailboxes through 158 grants; 341 reads of another mailbox were attributed to six accounts. These joins establish granted reach and observed reads, not misuse. Decide: separate administration from assistant use, validate shared-mailbox grants with owners and monitor sensitive connector access.
- : One of four active Compliance Access Keys can read user content and is outside the review credentials. Activity shows steady automated use at approximately 118.6 calls a day over 90 days; the consumer and endpoint mix require confirmation. The Console has three archived API keys and no active key, usage or cost in the 30-day window. Decide: identify the compliance consumer, constrain it to the necessary metadata scopes, set a rotation or revocation date, and record the credential owner.
- : The Sentinel copy of the Claude Activity Feed is incomplete: on 3 September it held about 39 percent of the feed's events, because the scheduled collector fetches a single page of events per run with no cursor. The 14 September Activity read shows the key the workflow uses calling the platform's audit API on that fixed schedule across the 90-day window, and that key can also read user content. The workflow reports success, which is why the gap went unseen. Decide: a cursor walk that persists the last event id and deduplicates, an activities-only key swapped in and the content-capable one deleted, monitoring of lag and failures, and a backfill decision.
- : 17,467 active Windows devices remain on Windows 11 23H2, with Enterprise and Education servicing ending on 10 November 2026. The previous snapshot held 18,751; the aggregate decline is progress, but not a per-device completion trace. The AD inventory flags 23,193 of 27,650 active Windows clients past or within 180 days of support end. Decide: assign the rollout owner, accelerate upgrade waves, establish an exception plan and verify Windows 10 ESU enrollment. The sample pace is 143 upgrades a day over nine days; holding that pace leaves approximately 9,335 devices at the deadline.
- : 74 Defender for Cloud High alerts are active with no recorded disposition in the 90-day window (81 on 1 September; the window moves, so the fall is not demonstrated remediation) and 108 alerts have been active more than 7 days; 5 High incidents have been open more than 7 days in Defender XDR and 5 in Sentinel; the attack-disruption incident of 7 July is still in progress with no classification, last updated 8 July. The incident record holds four High incidents since 26 June determined to be compromised accounts, all resolved; their containment reviews belong beside the open one. Decide: one owner and a closing receipt per queue, the attack-disruption incident first.
- : service.virtuintelligence.example, a verified domain of the tenant, has a registration that expires on 2 November 2026 (49 days from this snapshot), with the registrar lock on; virtuintelligence.example runs to May 2029. Decide: automatic renewal confirmed or a renewal date, or its deliberate retirement from the tenant and from DNS.
Select a marker
The records that make the action appear here, with the source of each factor.
HumanSide Technologies • https://www.humansidetechnologies.com/ • info@humansidetechnologies.com • © 2026 // All rights reserved
Action register
| Action | Segment | Framework | Impact | Exposure | Extent | Owner (catalog) | Effort (catalog) | Records | Movement | Change risk | Commitment |
|---|---|---|---|---|---|---|---|---|---|---|---|
| DR-01 Close the open high-severity incident backlog | Detection and response | Major | Confirmed | 74 of 74 mdc-alerts-90d (100%) | Security | Hours | 7 | 1 unchanged, 6 other | Low | - | |
| ID-23 Separate and protect hybrid privileged identities | Identity | Major | Confirmed | 48 of 52 privileged-identities (92%) | Identity team | Days | 6 | 1 worsened, 3 unchanged, 2 other | Medium | - | |
| ID-01 Close MFA gaps and exceptions | Identity (+1) | Major | Confirmed | 24,434 of 34,516 mfa-evaluated-members (71%) | Security | Weeks | 5 | 1 improved, 1 unchanged, 2 other, 1 not compared | Medium | - | |
| PA-08 Right-size Azure Owner and User Access Administrator | Identity | Major | Confirmed | 4 of 7 azure-custom-roles (57%) | Security | Days | 3 | 1 improved, 2 unchanged | Medium | - | |
| PA-21 Remove non-default control rights on AdminSDHolder | Identity | Major | Confirmed | policy-level | AD team | Days | 1 | 1 unchanged | Medium | - | |
| PA-22 Remove replication (DCSync) rights from non-sync principals | Identity | Major | Confirmed | policy-level | Identity team | Hours | 1 | 1 unchanged | High | - | |
| AI-01 Govern AI platform settings and connector authorization (approval prompts, role tiers, retired connectors) | Collaboration and data | Major | Confirmed | policy-level | AI platform | Days | 5 | 5 not compared | Medium | - | |
| PA-06 Right-size privileged roles, eligible assignments and escalation paths | Identity | Major | Confirmed | 2 of 5 global-administrators (40%) | Identity | Hours | 10 | 1 improved, 7 unchanged, 1 other, 1 not compared | Medium | - | |
| AI-06 Limit privileged identities' reach through AI connectors (account separation, shared-mailbox grants, consent) | Identity (+1) | Major | Confirmed | 66 of 171 connector-using accounts (30 d) (39%) | Security | Days | 3 | 1 other, 2 not compared | Medium | - | |
| PA-09 Right-size workload-plane administrators (Exchange, Purview and Defender XDR role groups) | Identity | Major | Confirmed | 4 of 18 purview-role-members (22%) | Security | Days | 5 | 5 other | Medium | - | |
| DP-02 Rein in tenant-wide application access to content and directory | Collaboration and data | Major | Confirmed | 4 of 20 app-readers (20%) | Security | Days | 5 | 4 other, 1 not compared | Medium | - | |
| PA-30 Right-size standing AWS administrative access (native users and keys) | Identity | Major | Confirmed | 1 of 5 iam-console-users (20%) | Security | Days | 2 | 1 unchanged, 1 other | Medium | - | |
| DR-02 Work the open identity-risk backlog | Identity | Major | Confirmed | 1 of 19 entra-privileged-holders (5%) | Identity team | Hours | 4 | 1 improved, 3 other | Medium | - | |
| DR-06 Reconcile endpoint protection coverage (MDE gaps; other agents to confirm) | Detection and response | Major | Confirmed | 1,978 of 55,119 mde-devices (4%) | Security | Weeks | 3 | 3 other | Low | - | |
| DP-03 Close external sharing and forwarding paths | Collaboration and data | Major | Confirmed | 7 of 28,794 mailboxes (0.02%) | Security | Hours | 3 | 3 other | Medium | - | |
| PA-23 Constrain Kerberos delegation and protect tier-0 accounts | Identity | Major | Configured | 52 of 52 tier0-accounts (100%) | AD team | Days | 3 | 2 unchanged, 1 other | High | - | |
| WE-34 Put a web application firewall in front of every internet-facing application front | External surface | Major | Configured | 14 of 14 internet-facing application load balancers (100%) | Cloud platform | Hours | 2 | 2 unchanged | Medium | - | |
| AI-08 Reduce AI platform administrators (standing, dormant, assessor access at closure) | Identity | Major | Configured | 6 of 7 console-members (86%) | AI platform owner | Hours | 5 | 5 not compared | Low | - | |
| DR-03 Complete detection coverage: diagnostics, Defender plans and Inspector scanning, exports, contacts | Detection and response | Major | Configured | 17 of 24 diag-resources (71%) | Security | Days | 12 | 8 unchanged, 4 other | Low | - | |
| PA-31 Review AWS roles: broad policies, unused access, external trusts | Identity | Major | Configured | 121 of 188 roles (64%) | Security | Days | 4 | 1 unchanged, 3 other | Medium | - | |
| DP-06 Publish SPF for every verified domain | External surface | Major | Configured | 3 of 5 verified-domains (60%) | IT Ops | Hours | 1 | 1 other | Medium | - | |
| ID-03 Replace long-lived workload credentials | Identity | Major | Configured | 8 of 14 iam-access-keys (57%) | Security | Hours | 4 | 2 unchanged, 1 other, 1 not compared | Medium | - | |
| ES-02 Protect domain registrations and DNS | External surface | Major | Configured | 1 of 2 registrations (50%) | IT Ops | Hours | 3 | 3 unchanged | Low | - | |
| ID-06 Enforce Conditional Access | Identity | Major | Configured | 23 ca-group-controllers, population (ca-group-controllers) not read | Security | Days | 6 | 1 unchanged, 2 other, 3 not compared | Medium | - | |
| PA-25 Rotate the krbtgt key twice under change control | Identity | Major | Configured | policy-level | AD team | Days | 1 | 1 other | High | - | |
| ID-02 Retire stale and orphaned identities | Identity | Major | Configured | 1 of 4 guests (25%) | Security | Hours | 11 | 1 worsened, 2 unchanged, 4 other, 4 not compared | Medium | - | |
| WE-02 Restrict internet-sourced inbound rules | Resources and endpoints | Major | Configured | 29 of 124 security-group-rules (23%) | Infrastructure | Hours | 3 | 2 unchanged, 1 other | Medium | - | |
| WE-31 Enforce IMDSv2 on EC2 instances | Resources and endpoints | Major | Configured | 1 of 5 instances (20%) | Infrastructure | Hours | 1 | 1 unchanged | Medium | - | |
| DP-01 Remove anonymous and unencrypted access to storage | Resources and endpoints | Major | Configured | 15 of 86 buckets (17%) | Security | Hours | 6 | 3 unchanged, 3 other | High | - | |
| ID-20 Service and privileged account hygiene in AD | Identity | Major | Configured | 49 of 34,460 users-enabled (0.1%) | AD team | Days | 3 | 2 unchanged, 1 other | High | - | |
| WE-04 Reconcile device management coverage (Intune gaps; other MDM to confirm) | Resources and endpoints | Major | Indirect | 27,152 of 31,298 active-devices (87%) | IT Ops | Weeks | 7 | 1 worsened, 2 unchanged, 4 other | Medium | - | |
| RC-01 Protect key vaults from deletion | Resources and endpoints | Major | Indirect | 2 of 3 key-vaults (67%) | Security | Hours | 2 | 1 improved, 1 unchanged | Low | - | |
| AI-05 Bring AI platform telemetry into detection (complete feed, health rule, analytics rules) | Detection and response | Major | Indirect | 315,494 of 517,206 feed events absent from Sentinel in the 30 days to 3 September (61%) | Security operations | Days | 2 | 2 not compared | Low | - | |
| WE-22 Migrate or enroll Windows clients past end of support | Resources and endpoints | Major | Indirect | 17,467 of 31,298 active-devices (56%) | Endpoint management | Weeks | 2 | 1 other, 1 not compared | Medium | - | |
| WE-21 Retire or upgrade servers past, or within 180 days of, OS end of support | Resources and endpoints | Major | Indirect | 1,522 of 2,890 servers-enabled (53%) | Infrastructure | Program | 1 | 1 other | High | - | |
| DP-09 Remove plaintext secrets from workload configuration | Resources and endpoints | Major | Indirect | 1 lambda-functions, population (lambda-functions) not read | Security | Days | 2 | 1 unchanged, 1 other | Medium | - | |
| WE-33 Investigate Defender for Cloud attack paths (entry resource, targets, path-breaking recommendations) | External surface (+1) | Major | Indirect | policy-level | Security | Days | 2 | 1 other, 1 not compared | Low | - | |
| DR-05 Enable Defender for Servers on standard subscriptions | Detection and response | Major | Indirect | 1 of 7 subscriptions (14%) | Security | Hours | 2 | 1 unchanged, 1 other | Low | - | |
| ID-33 Route human AWS access through the identity provider and review federated roles | Identity | Moderate | Confirmed | 5 of 5 iam-console-users (100%) | Identity | Weeks | 2 | 1 unchanged, 1 other | Medium | - | |
| PA-20 Reduce standing membership of AD privileged groups | Identity | Moderate | Confirmed | 46 of 55 privileged-members (84%) | AD team | Days | 1 | 1 worsened | Medium | - | |
| DR-08 Resolve open Defender for Identity health issues | Detection and response | Moderate | Confirmed | 5 of 7 expected-sensor-hosts (71%) | Security operations | Days | 2 | 2 unchanged | Low | - | |
| AI-04 Bound AI platform credentials: owner, purpose, narrowest scope, review date | Identity (+1) | Moderate | Confirmed | 1 of 4 compliance-keys (25%) | AI platform owner | Hours | 3 | 1 other, 2 not compared | Medium | - | |
| GOV-03 Clean up orphaned directory objects and idle cloud resources | Identity | Moderate | Confirmed | 1 of 5 instances (20%) | Infrastructure | Days | 3 | 3 unchanged | Medium | - | |
| GOV-06 Govern Teams and site ownership (ownerless teams, single owners, concentrated ownership) | Collaboration and data (+1) | Moderate | Confirmed | 35 of 2,311 teams (2%) | IT Ops | Days | 3 | 3 other | Low | - | |
| AI-03 Reconcile AI platform seats with the directory (SCIM, offboarding, session duration) | Identity (+1) | Moderate | Confirmed | 1 of 274 copilot-seats (0.4%) | IT Ops | Hours | 2 | 1 other, 1 not compared | Low | - | |
| WE-01 Close internet-reachable management and database ports | Resources and endpoints (+1) | Moderate | Configured | 3 of 3 public-ips (100%) | Security | Days | 2 | 2 unchanged | High | - | |
| ID-05 Block legacy authentication | Identity | Moderate | Configured | policy-level | Security | Days | 1 | 1 unchanged | Medium | - | |
| ES-01 Put edge controls and TLS on public web endpoints | External surface | Moderate | Configured | 39 of 109 network-interfaces (36%) | Infrastructure | Hours | 4 | 2 unchanged, 2 other | Medium | - | |
| PA-24 Review AD CS templates with review-grade ESC shapes | Identity | Moderate | Configured | 8 of 46 certificate-templates (17%) | AD team | Days | 4 | 4 unchanged | Medium | - | |
| WE-35 Remove dangling DNS and expiring certificates from the public surface | External surface | Moderate | Configured | 12 of 118 DNS records pointing at AWS hostnames (10%) | Cloud platform | Hours | 2 | 1 unchanged, 1 other | Low | - | |
| ES-03 Govern SharePoint oversharing and content discovery | Collaboration and data | Moderate | Configured | 30 of 2,330 unified-groups (1%) | IT Ops | Days | 2 | 1 unchanged, 1 other | Medium | - | |
| DP-04 Enforce mail authentication: DKIM and DMARC | External surface | Moderate | Indirect | 5 of 5 verified-domains (100%) | IT Ops | Hours | 2 | 2 other | Medium | - | |
| DP-08 Encrypt EBS volumes and set the regional default | Resources and endpoints | Moderate | Indirect | 6 of 6 attached EBS volumes (100%) | Infrastructure | Days | 2 | 2 unchanged | Low | - | |
| GOV-04 Govern Azure role-holding groups (owners, dynamic membership) | Identity | Moderate | Indirect | 4 of 4 azure-role-holding-groups (100%) | Security | Hours | 1 | 1 other | Low | - | |
| WE-03 Restrict network access to storage, vaults and PaaS data services | Resources and endpoints (+1) | Moderate | Indirect | 3 of 3 key-vaults (100%) | Security | Days | 6 | 6 unchanged | Medium | - | |
| WE-05 Verify backup and recovery coverage | Resources and endpoints | Moderate | Indirect | 5 of 5 EC2 instances (100%) | Infrastructure | Days | 4 | 1 unchanged, 3 other | Low | - | |
| GOV-01 Tag and govern Azure resources | Resources and endpoints | Moderate | Indirect | 1,430 of 2,571 azure-resources (56%) | Cloud platform | Days | 1 | 1 other | Low | - | |
| DR-04 Remediate Defender for Cloud high-severity assessments | Detection and response | Moderate | Indirect | 344 of 641 mdc-assessment-types-evaluated (54%) | Security | Weeks | 1 | 1 worsened | Medium | - | |
| GOV-05 Organization guardrails: feature set, service control and organization policies | Identity | Moderate | Indirect | policy-level | Cloud Platform | Days | 1 | 1 unchanged | High | - | |
| ID-07 Retire SMS and voice authentication | Identity | Moderate | Indirect | policy-level | Security | Weeks | 1 | 1 unchanged | Low | - | |
| ID-21 Set domain policy baselines (lockout, password length, machine account quota) | Identity | Moderate | Indirect | policy-level | AD team | Hours | 2 | 2 other | Medium | - | |
| ID-34 Set the AWS account password policy | Identity | Moderate | Indirect | policy-level | Security | Hours | 1 | 1 unchanged | Low | - | |
| WE-32 Retire deprecated Lambda runtimes | Resources and endpoints | Moderate | Indirect | 6 of 12 lambda-functions (50%) | IT Ops | Days | 1 | 1 unchanged | Medium | - | |
| DP-11 Rotate keys and secrets and scope key policies | Resources and endpoints | Moderate | Indirect | 4 of 11 customer-managed symmetric KMS keys (36%) | Cloud platform | Hours | 2 | 1 unchanged, 1 other | Medium | - | |
| DP-05 Enforce storage transport security | Resources and endpoints | Moderate | Indirect | 3 of 14 storage-accounts (21%) | IT Ops | Hours | 1 | 1 unchanged | Low | - | |
| GOV-02 Apply retention to disabled and inactive mailboxes | Collaboration and data | Moderate | Indirect | 775 of 28,794 mailboxes (3%) | IT Ops | Days | 2 | 1 worsened, 1 other | Low | - | |
| ID-24 Enable sync takeover protections | Identity | Moderate | Unknown | policy-level | Identity team | Hours | 1 | 1 other | Low | - | |
| DP-13 Classify the content AI assistants read (sensitivity labels on documents, sites and groups) | Collaboration and data | Minor | Indirect | 2,330 of 2,330 unified-groups (100%) | Security | Weeks | 1 | 1 other | Medium | - |
Exposure rule, applied uniformly: an event or standing access observed is Confirmed; a configuration with a direct path is Configured; everything else observed is Indirect; a measure not read is Unknown. Extent: count over the population declared per rule, both read in this snapshot; policy-level conditions have no population and draw at a declared mid-size. Two families outside the six appear as "Governance": tagging, retention and cost rules have no family yet. In a client edition, account names appear where the evidence needs them and the page is handled as client confidential; this demonstration edition names no account.