“The work is real. The names aren’t.”

Encrypted. Still Readable.

The warehouse was encrypted. Every analyst could still read every Social Security number. This is how a hospital stopped moving real patient identifiers into places that only needed to join on them.

The Owners Who Were Not People

A tenant-wide inventory of standing Owner and User Access Administrator found four assignments on one subscription. Three of them were not people. PIM could cover the human. It could not cover the pipeline, the vendor identity, or the Global Administrator setting left on from a cleanup.

Azure CLI · Microsoft Entra PIM · Azure Lighthouse

The Deny Still Held

A weekend AdministratorAccess grant outlived the migration. The SCP kept the role from leaving the org or turning off CloudTrail. It couldn't stop a bucket policy from trusting an account we didn't own. I treated the deny as the ceiling, then added resource control policies for the data path.

AWS Organizations · CloudTrail · AWS Config · GuardDuty

Finding Shadow Assistants Before They Found Us

Employees were sending sensitive data, including AWS secret keys, to assistants nobody had approved. I paired DSPM with endpoint and inline DLP to find it, then rebuilt policy around corporate versus personal assistant instances, cutting false positives by about two-thirds.

Cyera · Microsoft Purview · Zscaler