Turn the compliance checklist into a real, running scan

Speaker notes

• This slide exists to close a gap the previous compliance slides leave open: SOC 2, CIS, and PCI-DSS are frameworks and controls on paper until something actually checks your real infrastructure against them. Prowler is that something — a single CLI tool whose underlying checks map simultaneously to multiple frameworks, so one scan answers 'where do we stand on CIS' and 'where do we stand on SOC 2' at once, not as two separate audits.
• Emphasize the least-privilege identity point specifically — it's a real, easy mistake to scan with personal or admin credentials 'just to get it working.' Every Prowler check is a read-only Describe/List/Get API call; scoping the identity that runs it to AWS's own SecurityAudit managed policy means the tool doing the auditing never becomes the highest-value target in the account itself, the same least-privilege discipline from Module 4 applied to a security tool rather than an application.
• The third card is the one worth spending real time on: raw severity from a scanner is not the same as actual priority. A missing-encryption finding on a bucket of public marketing images and the identical finding on a bucket of customer PII carry the same label but very different real-world urgency — this is the CVSS-vs-reachability reasoning from Module 2, and it applies just as much to a compliance finding as to a code vulnerability.
• The closing line is deliberately provocative: 'we're SOC 2 compliant' as a claim made from a report someone read once is meaningfully weaker than the same claim backed by 'we ran Prowler, fixed what it found, and can show you the before-and-after' — audit evidence, covered on an earlier slide, made concrete.

Deck map