Common mistakes

1 min read · Chapter 9 of 10

What usually goes wrong

Symptom	Likely cause	First thing to check
40,000 findings and the count never falls	Ranked by CVSS instead of exposure; no owners	Share of findings with an owner; criticals that are reachable and exploitable
The same misconfiguration is back a week after the fix	Fixed in the console; the next deploy reverted it	Whether the resource is managed in code; drift reports
Secure score up, risk unchanged	Exemptions marked "mitigated" with no expiry	Exemptions by age and reason
No attack-sequence finding during a real attack	Suppression rules archived the inputs	GuardDuty suppression rules
A short-lived workload was exploited and nothing saw it	Agentless scans every 24 hours, no runtime sensor	Sensor coverage on internet-facing nodes
Auditor asks for last year's evidence	Findings deleted after 90 and 30 days	Exports to storage you own
Year-old access keys everywhere	IAM users with long-lived keys, including in CI	Key age; short-lived federated credentials for CI
A security tool becomes the way in	Unpinned versions or mutable tags in CI; broad scanner roles	Pinned versions; permissions on integration roles
Marketplace purchase didn't count toward the commitment	Listing not "Deployed on AWS", or not Azure-only for Microsoft	Eligibility before signing