| F-2K-001 | high | Entra ID | 6 permanent Global Admin assignments; 0 PIM eligible schedules. | GET /directoryRoles/globalAdministrator/members — count:6 |
| F-2K-002 | high | AWS IAM | SAML trust role acme.role.cloud-admin has AdministratorAccess and no condition keys. | Trust Condition:null; attachedPolicy:AdministratorAccess |
| F-2K-003 | high | Okta | 4 Okta super-admins authenticate from named network zone without FIDO2. | policy OKTA_SIGN_ON: grantControls for admin zone lacks FIDO2 requirement |
| F-2K-004 | high | Google Cloud IAM | 3 SA keys committed to CI/CD repo; all unrotated >90 days. | gitleaks scan: 3 SA key files in .env; oldest commit 47 days ago |
| F-2K-005 | high | Kubernetes | 4 cluster-admin ClusterRoleBindings to workload service accounts across 4 namespaces. | kubectl get clusterrolebindings — 4 results; subjects[].kind:ServiceAccount |
| F-2K-006 | high | Active Directory | svc-entra-sync has Domain Admins membership; password age 289 days. | Get-ADGroupMember "Domain Admins" | where sAMAccountName -eq svc-entra-sync; PasswordLastSet:2025-07-09 |
| F-2K-007 | high | Google Cloud IAM | acme.service.analytics-pipeline has project-level roles/bigquery.dataEditor (intended: dataset-level dataViewer). | gcloud projects get-iam-policy: roles/bigquery.dataEditor binding at project level |
| F-2K-008 | high | AWS IAM | IRSA role acme.role.k8s-data-access has s3:* and dynamodb:* on Resource:* for 3 K8s service accounts. | Action:['s3:*','dynamodb:*'],Resource:'*' |
| F-2K-021 | high | Active Directory | svc-entra-sync has Domain Admins membership with 289-day-old password; used by Entra Connect. | Get-ADGroupMember "Domain Admins" — svc-entra-sync; PasswordLastSet:2025-07-09; PasswordNeverExpires:True |
| F-2K-022 | high | Active Directory | 3 accounts with adminCount=1 outside protected groups; AdminSDHolder ACLs still propagated. | Get-ADUser -Filter {adminCount -eq 1} — 3 accounts; prior DA membership confirmed; no current protected group membership |
| F-2K-025 | high | SaaS Applications | 4 Slack workspace admins authenticate with email/password; Okta SSO not enforced for admin accounts. | Slack Audit API — 4 workspace owners with authMethod:email; Okta SSO not mandatory for admin tier |
| F-2K-026 | high | SaaS Applications | 9 Salesforce System Administrators; 3 federated via Okta without MFA step-up requirement. | Salesforce /services/data/vXX/query — SystemAdministrator count:9; 3 Okta-federated without step-up CA policy |
| F-2K-029 | high | SailPoint | IT-Annual-Review-2025 campaign: 89 open items past SLA; 34 auto-approved without review. | SailPoint Campaign Manager: totalItems:412; open:89; autoApproved:34; avgReviewTime:7s |
| F-2K-030 | high | SailPoint | SailPoint connector accounts have Domain Admin and cluster-admin rights on target systems. | AD: svc-sailpoint-connector in Domain Admins; K8s: clusterrolebinding sailpoint-admin → cluster-admin |
| F-2K-033 | high | CyberArk | 23 privileged accounts retrievable without dual-control approval; DualControl:false on Production-Windows-Admin safe. | CyberArk REST API /Accounts — 23 accounts; DualControl:false; RequireConfirmation:false |
| F-2K-034 | high | CyberArk | Shared VaultAdmin account used by 3 administrators; 6 distinct source IPs in 30 days; no individual accountability. | CyberArk PVWA > User Management — VaultAdmin: lastLoginDate:2026-01-08; 6 source IPs; shared across 3 named admins |
| F-2K-037 | high | BeyondTrust | BeyondTrust admin credential unchanged 380 days; shared across 3 named administrators. | BeyondTrust API /BeyondTrust/api/public/v3/Accounts — btadmin: lastPasswordChange:2025-01-19; 3 users; no expiry policy |
| F-2K-040 | high | GitHub | 47 deployment workflows use long-lived cloud credentials; OIDC not configured in any provider; oldest credential 312 days. | GitHub /orgs/acme-mid/actions/secrets — AWS, Azure, GCP credentials in 47 workflows; no OIDC federation |
| F-2K-041 | high | GitHub | 4 GitHub organisation owners use personal accounts exempt from enterprise SSO enforcement. | GitHub /orgs/acme-mid/members?role=owner — 4 owners; account_type:personal; SSO policy:Required but exempted |
| F-2K-009 | medium | Entra ID | CA-FederatedSessions lacks MFA step-up for Okta-sourced tokens. | grantControls.builtInControls:[] for Okta-sourced sessions |
| F-2K-010 | medium | Entra ID | 156 users without phishing-resistant MFA registration. | GET /reports/authenticationMethods/userRegistrationDetails — 156 users; sms/voice only |
| F-2K-011 | medium | AWS IAM | 23 IAM access keys not rotated >90 days; 9 keys >180 days. | aws iam get-credential-report — 23 keys age >90d |
| F-2K-012 | medium | AWS IAM | Cross-account trust from shared-services account lacks condition keys for 2 subsidiary accounts. | Trust: Condition:null for subsidiary account principals |
| F-2K-013 | medium | Okta | 6 inactive SAML apps active >180 days with no sign-ins in last 90 days. | Okta systemLog: 0 sign-in events in 90 days for 6 apps |
| F-2K-014 | medium | Okta | Okta inline hook acme-risk-evaluation-hook returns HTTP 200 unconditionally; never validated. | lastValidated:null; manual test call returns {allow:true} regardless of payload |
| F-2K-015 | medium | Google Cloud IAM | 4 SA bindings at project level exceed intended IaC scope. | Terraform state vs deployed: 4 bindings elevated from dataset to project level |
| F-2K-016 | medium | Google Cloud IAM | Org policy iam.disableServiceAccountKeyCreation not enforced at org level. | gcloud resource-manager org-policies describe — notSet:true |
| F-2K-017 | medium | Kubernetes | Pod security admission not enforced in 5 namespaces. | kubectl get ns --show-labels — 5 namespaces missing pod-security label |
| F-2K-018 | medium | Kubernetes | Kubernetes secrets not encrypted at rest; etcd uses default plaintext storage. | kubectl get apiserver -o yaml — encryption.config:not set |
| F-2K-023 | medium | Active Directory | 47 stale computer accounts inactive >90 days; 12 with active SPNs; 3 with constrained delegation. | Get-ADComputer -Filter {LastLogonDate -lt (Get-Date).AddDays(-90)} — count:47; SPNs:12; constrained delegation:3 |
| F-2K-024 | medium | Active Directory | Fine-grained password policy not applied to 86 service accounts; all under Default Domain Policy. | Get-ADFineGrainedPasswordPolicy — 0 PSO objects for service account OUs; DefaultDomainPolicy applies |
| F-2K-027 | medium | SaaS Applications | 23 Slack guests with sensitive channel access inactive >90 days; 6 from completed vendor engagements. | Slack Audit API — 23 guests; lastActive >90d; channels: #acme-finance, #acme-engineering, #acme-incident-response |
| F-2K-028 | medium | SaaS Applications | Workday ISU integration credential not rotated in 18 months; used by SailPoint HR provisioning feed. | Workday ISU acme-sailpoint-isu: lastPasswordChange:2024-05-14; no rotation schedule configured |
| F-2K-031 | medium | SailPoint | 23 high-risk entitlement provisioning events bypassed approval workflow via emergency access mechanism. | SailPoint Audit Log — 23 events with bypassApproval:true; includes AD Domain Admins, AWS AdministratorAccess, Salesforce SystemAdmin |
| F-2K-035 | medium | CyberArk | 34 accounts with automatic password rotation disabled; oldest password 247 days old. | CyberArk REST API /Accounts?filter=autoManagement — 34 accounts; automationManagement:false |
| F-2K-036 | medium | CyberArk | PSM not mandatory for 4 high-privilege safe groups; direct RDP/SSH without session recording available. | CyberArk PVWA > Safe Management — 4 safes: AllowManualAccess:true; no PSM platform requirement |
| F-2K-038 | medium | BeyondTrust | 347 jump clients not zone-segregated; production and dev systems in same jump group without additional approval gate. | BeyondTrust /BeyondTrust/api/public/v3/JumpGroups — group acme-all-systems: 347 jump clients; mixed zones |
| F-2K-039 | medium | BeyondTrust | 12 team passwords not certified in 12 months; 4 reference decommissioned systems. | BeyondTrust Password Safe > Team Passwords — 12 entries; lastCertified:null for 8; 4 referencing decommissioned systems |
| F-2K-042 | medium | GitHub | GitHub Actions permissions allow all actions from any publisher; 63 distinct 3rd-party publishers across 89 workflows. | GitHub /orgs/acme-mid/actions/permissions — allowed_actions:all; no verified creator or approved list restriction |
| F-2K-043 | medium | GitHub | 34 deploy keys older than 180 days across 12 repos; 8 have write access; 4 for decommissioned integrations. | GitHub /repos API — 34 deploy keys; created_at >180d; 8 read_write:true; 4 referencing retired integrations |
| F-2K-019 | low | AWS IAM | CloudTrail disabled in 2 subsidiary accounts. | aws cloudtrail describe-trails: status:Disabled in subsidiary-eu-west, subsidiary-ap-southeast |
| F-2K-020 | low | Okta | 23 admin role assignments not certified in last 180 days. | Okta /api/v1/users?filter=profile.isAdmin eq true — lastCertifiedDate absent |
| F-2K-032 | low | SailPoint | SailPoint audit log retention: 30 days; compliance requirement is 12 months. | SailPoint IdentityNow > Admin > Audit: logRetentionDays:30; no SIEM forwarding configured |