For teams running workloads across cloud accounts, service identities and shared storage. We scope the resources and relationships that matter to your product.
GET prod/secretsAccessDeniedGET prod/snapshotsAccessDeniedGET prod/exports200 OK
ZF-0212-01High
Staging CI identity can read production exports
Identity
ci-deploy, staging
Request
GET prod/exports
Response
200 OK
Human-verifiedAI-found ZF‑0212‑01 2026‑09‑28
One organisation. Separate accounts.
Illustration: a staging account and a production account in one organisation, separated by an account boundary. Requests made with the staging CI identity try to reach production resources. Two are refused with AccessDenied. One, GET prod/exports, returns 200 OK; a researcher records it as finding ZF-0212-01, High, human-verified.
ReportCover and question1/11
Start with a change. Ask the right question.
Three illustrative scenarios. They explain the work; they are not customer findings, and provider coverage is confirmed during scoping.
01Service permissions
One identity. Several places it can reach.
Do the agreed service permissions match the application's intended responsibilities?
Situation
You are changing a workload identity or connecting a new resource.
Focus
Named identities, relevant resource policies and the trust relationships in scope.
Output
Reachability explained: which identity can touch which resource, and why it matters.
Illustrative evidence
# Policy simulation, ci-deploy identity
action: iam:PassRole
resource: role/prod-admin
decision: allowed
02Resource exposure
Reachable does not mean intentionally public.
Which resources should be reachable, by whom and under what conditions?
Situation
You need to understand the exposure of selected cloud-backed services.
Focus
Approved resource configurations and selected externally reachable boundaries.
Output
Observed exposure interpreted against intended use, with the limits of the review stated.
Illustrative evidence
# Unauthenticated read, agreed test object
GET /exports/test-object.csv
Host: ██████████████.example
HTTP/1.1 200 OK
03Architecture changes
A new service. A different trust boundary.
Are service-to-service assumptions consistent with the permissions granted?
Situation
You are connecting workloads, environments or a third-party integration.
Focus
Agreed connections between application identity, cloud resources and service access.
Output
The affected relationship described, with practical remediation priorities.
Illustrative evidence
# Trust policy on role/reporting
Principal: account ████████████
Condition: none
ExternalId: not required
Agree on the resources. Then agree on the access.
Provider & resources
Candidate scopeNamed accounts, projects, services and resource types.
Confirm before testingProvider-specific technical fit and the precise resource inventory.
Identity & permissions
Candidate scopeAgreed workload or service identities and relevant policies.
Confirm before testingAccess method, permission level and the contact responsible for access.
Review mode
Candidate scopeConfiguration review and selected validation where authorised.
Confirm before testingRead-only versus active checks; actions that are explicitly excluded.
Operational limits
Candidate scopeEnvironment, ownership, testing windows and an escalation contact.
Confirm before testingProduction constraints and stop conditions are agreed, never assumed.
Delivery & retest
Candidate scopeScope summary and human-verified findings.
Confirm before testingSensitive-data handling, report requirements, retest scope and terms.
A review of selected resources does not represent the whole environment. Untested or excluded areas are named; they are never treated as evidence that a system is secure.
Research can be autonomous. Delivery has an owner.
01
Investigate
Agents map identities, policies and relationships within scope.
AI-supported
ZF-0212-01
Severity
High
Class
CWE-732
CVSS 3.1
8.1
Staging CI identity can read production exports
Impact A staging pipeline identity could read 214 production export files of internal reporting data.
Evidence
# Identity: ci-deploy in the staging account
GET prod/exports/2026-09.csv
200 OK (expected: AccessDenied)
High
02
Verify and approve
A researcher confirms reachability and judges impact and uncertainty.
Review desk
Human-verifiedAI-found ZF‑0212‑01 2026‑09‑28
03
Deliver
Findings, fixes and what the access did not allow us to assess.
Your team
Open questionUnconfirmed reachability stays an open question, never a confirmed finding.
Cloud context. Ready for engineering.
LeadershipScope, material findings and business context.
EngineeringAffected resources, identities and remediation.
Follow-upCoverage limits and retest results, where agreed.
01
Context and affected resources
Accounts, resources, identities and the agreed environment.
02
Supporting evidence
Expected versus observed access, with the policy and the request.
03
Impact and uncertainty
Demonstrated reach, separated from configuration concerns.
04
Remediation and retest
Suggested changes and their follow-up status.
Controlled research resources.
Agents use designated resources for approved scenarios. A permission that exists in an account is never treated as permission to use it.
01
Owned DNS records
Records on our own domains support agreed checks of outbound and callback paths.
02
Designated test servers
Assigned servers host controlled components for agreed reachability checks.
03
Scoped review access
Access is granted for named accounts and resources, and removed when the work ends.
Straight answers
Which cloud providers do you support?
Provider and resource-type coverage is confirmed during scoping. Share your environment before assuming a particular provider or service is supported.
Do you need administrator access?
Not by default. We agree the minimum appropriate access for the review. If access is insufficient, we explain the resulting coverage limit.
Will you change our infrastructure?
Changes are not implied by a review. Any active operation or configuration change is agreed in writing before it is performed.
Can you review only part of our environment?
Yes, the work can be scoped around selected resources or relationships. The report then covers those, not the whole environment.
Bring your scope. Let's plan the Countermind.
Thirty minutes with a Zaaf researcher. You bring one scope; we show you what a Countermind would look at first.