Skip to main content

Posture findings

A posture finding is a configuration, permission or software weakness that has not been exploited yet.

Cloud posture (Ciyora Armor)​

Ciyora Armor checks the configuration of connected cloud accounts against rules mapped to framework controls, such as the CIS Foundations benchmarks and PCI DSS. Each finding has a severity, the affected resource, remediation steps and the controls it maps to. Its workflow status can be:

  • Open: needs action.
  • Acknowledged: the risk is known and owned; a note is required.
  • False positive: the rule does not apply here; a note is required.

Findings can be reopened. The posture score is tracked over time.

Cloud entitlements (Ciyora Armor)​

Cloud users, roles and service accounts are ranked by privilege. Flags include full administrator, can escalate privilege, no MFA and unused for 90 days or more. Right-sizing recommendations can be accepted or dismissed with a reason.

Vulnerabilities (Ciyora Discover)​

Vulnerabilities are listed with CVSS, EPSS and whether they are on the CISA Known Exploited Vulnerabilities list, and linked to the affected assets.