Evidence · not marketing
Real output, real numbers
Nothing here is a mockup. These are actual verdicts from running the tools, graded on incidents USAP didn't write, with a public registry score to match.
Real output · not a mockup
This is what an agent actually returned.
No marketing copy on this page pretends to be product. The card below is verbatim output from a USAP skill — run it yourself and you get the same shape. Here's how to read it.
action
Escalate the public-S3 → IMDSv1 → IAM-wildcard exposure chain: hand off to cloud-workload-protection for runtime containment and identity-access-risk for the over-permissive role.
key_findings
- public-s3-bucket — arn:aws:s3:::acme-prod-customer-exports has a public-read ACL (CIS AWS 2.1.5); holds customer PII exports
- imdsv1-enabled — instance i-0a1b… permits IMDSv1, HttpTokens=optional (CIS 5.6); SSRF → instance-credential theft
- iam-wildcard — role/app-runtime allows Action:* on Resource:* (CIS 1.16); lateral movement once creds are stolen
- cloudtrail-disabled — CloudTrail off in us-west-2 (CIS 3.1); masks the exfiltration path
evidence_references[0]
It reasoned, it didn't list
Four findings, but the verdict names the exploitable chain between them — public bucket, stealable instance creds, a wildcard role to move with, logging off to hide it. An attack path, not a scanner dump.
The evidence resolves
The cited source is a live MCP tool-call id with the exact policy statement it read (Action:* on Resource:*). Not "the scan showed it" — a pointer you can re-fetch.
Mapped to ATT&CK
T1530, T1552.005, T1078.004, T1562.008 — the chain, in the framework your detections already speak.
It escalated — it didn't touch anything
human_approval_required is respected; the agent hands off to containment and IAM review. The world only changes when a person says so.
More real output
Same discipline, other corners of the SOC
Blocks the deploy — and flags an implanted layer
- CVE-2024-3094 · liblzma5 5.6.0 — XZ Utils backdoor in the base image
- CVE-2021-44228 · log4j-core 2.14.1 — Log4Shell in an app dependency
- layer sha256:9c2a1fe3… — no matching Dockerfile step (possible implant, T1525)
Catches the credential before it merges
- hardcoded-credential at src/config.py:14 — quote: PASSWORD = "changeme-prod"
- sql-string-concat at src/db/profile.js:42 — mapped to threat TM-002
- public-iac at infra/storage.tf:21 — acl = "public-read"
Graded, not asserted
Scored on incidents USAP didn't write
A held-out corpus of 12hand-labeled cases — real public incidents plus benign traps that keep the false-positive rate honest. Self-grading is circular; this isn't.