Assurance
Operations
Enforcement

from finding to never again.

NxSCORE helps you find and fix what is open, then enforces it so it never comes back.

Get a free cloud assessment See how it works

1,108Open findings

464Exposed assets

34Accounts

Criticalprod-payments / ap-south-1

S3 bucket public with customer records

Detected 00:42 ago

Criticalcore-banking / Azure

Admin role granted outside change window

Detected 01:15 ago

Highdata-lake / Google Cloud

Service key unused for 214 days, still active

Detected 03:08 ago

You fix it on Monday. It is back by Friday.

Findings arrive faster than anyone can own them. The ones you fix return with the next release, and the access that made them possible never goes away.

prod-payments-customer-records / S3Reopened

Back in three days

Mon 10:12FoundBucket readable by anyone
Mon 16:40FixedPublic access blocked by hand
Wed 11:05Release 4.18Ships the old bucket policy
Thu 09:30Back againReadable by anyone, 4th time

Open findings1,1960 with an owner
Found, not owned.
Thousands of findings, and no one with the time to decide on them.
prod-payments-customer-records4 timesreopened this quarter
Fixed, not prevented.
The same misconfiguration, back with the next release.
data-lake service key, Google Cloud214 dayssince last used, still active
Granted, never removed.
Access that outlives the project that needed it.

One finding, from first sight to never again.

Seen, and matched to its owner.

Your CNAPP flags the bucket. NxSCORE matches it to the payments team, finds the policy behind it and sees this is the fourth time.

Safe to fix, so it is fixed today.

No public reads in 30 days, so the verdict is safe to fix. Your analyst writes the fix kit; your engineer runs it in the change window. NxSCORE never changes your cloud.

The cause, removed.

Every release re-applied the old policy through deploy-bot. NxSCORE writes the template fix and takes away the permissions deploy-bot never used.

Then ruled out, in every cloud.

One sentence of intent becomes each cloud’s own guardrail. NxSCORE tests it on 30 days of activity first, then checks every day that it holds.

Proof, already collected.

The fix, the approval and the guardrail are evidence for every framework that asks about public storage, from ISO 27001 to your regulator.

And someone keeps watching.

When release 4.18 tried the old policy, the guardrail denied it and your analyst told the team why. The finding stays closed.

NxSCORE/ Findings / FND-20871prod-payments-customer-records

Bucket readable by anyoneOpen

Resourceprod-payments-customer-records

AWSprod-payments, ap-south-1

Ownerpayments-platform team

Reported by Prisma CloudMon 10:12

Found by NxSCOREBucket policy allows s3:GetObject to *

History4th time this quarter

Seen, and matched to its owner.

Your CNAPP flags the bucket. NxSCORE matches it to the payments team, finds the policy behind it and sees this is the fourth time.

Verdict and fix kitSafe to fix

CheckedNo public reads in 30 days

$ aws s3api put-public-access-block \
  --bucket prod-payments-customer-records \
  --public-access-block-configuration BlockPublicPolicy=true

Prepared byNxSCORE analyst

Run byYour engineer, Mon 16:40

Safe to fix, so it is fixed today.

No public reads in 30 days, so the verdict is safe to fix. Your analyst writes the fix kit; your engineer runs it in the change window. NxSCORE never changes your cloud.

Why it kept coming backRecurring

Causerelease-template v4 sets the old bucket policy

Throughdeploy-bot, s3:PutBucketPolicy

deploy-bot uses6 of 48 permissions

ChangeTemplate fixed, 42 unused permissions removed

SimulatedNo denied calls in 90 days

The cause, removed.

Every release re-applied the old policy through deploy-bot. NxSCORE writes the template fix and takes away the permissions deploy-bot never used.

GuardrailIn force since Tue 14:00

No storage in prod-payments can be made public.

AWSOrganisation policy

AzureAzure Policy

Google CloudPublic access prevention

Simulated30 days, nothing legitimate blocked

Wed 11:05Release 4.18 denied: old bucket policy

Then ruled out, in every cloud.

One sentence of intent becomes each cloud’s own guardrail. NxSCORE tests it on 30 days of activity first, then checks every day that it holds.

Control: public storage blockedMet

ISO 27001
SOC 2
PCI DSS
NIST CSF
DORA
RBI

FixRun Mon 16:40, approved by your checker

GuardrailIn force since Tue 14:00, checked daily

Evidence6 items, each with who and when

Proof, already collected.

The fix, the approval and the guardrail are evidence for every framework that asks about public storage, from ISO 27001 to your regulator.

Analyst note, Wed 11:20Closed

Release 4.18 tried to re-apply the old bucket policy at 11:05 and the guardrail denied it. Nothing else changed. I have asked payments-platform to merge the template fix so the next release is clean.

MakerNxSCORE analyst

Seen bypayments-platform, 11:24

StatusClosed, no change since Monday

And someone keeps watching.

When release 4.18 tried the old policy, the guardrail denied it and your analyst told the team why. The finding stays closed.

We write it. Your team runs it.

Fixes, access changes and guardrails all reach your cloud the same way: through your pipeline, in your change window, run by your engineers. NxSCORE's role reads configuration and is denied your data.

Read-only, in writing.: A role policy you can read before you sign.
Simulated first.: You see what a change would block before it blocks anything.
Closed when the next assessment agrees.: Not when someone says it is done.

Fix kit FND-20871

Written by NxSCORE

resource "aws_s3_bucket_public_access_block" "customer_records" {
  bucket                  = "prod-payments-customer-records"
  block_public_acls       = true
  block_public_policy     = true
  ignore_public_acls      = true
  restrict_public_buckets = true
}

Your cloud. NxSCORE stays read-only and never runs this.

Run by your team

ApprovedYour checker reviews the fix kit and the reason for it
Mon 14:15
RunYour engineer applies it in your change window, with your tools
Mon 16:40
VerifiedNxSCORE confirms it on the next assessment, then keeps checking
Mon 18:00

Keep your CNAPP. NxSCORE finishes the job.

Your CNAPP or cloud scanner finds a great deal. NxSCORE takes what it finds, adds what it misses, and carries each finding to a fix and a guardrail, so its next scan finds less.

Works with

Prisma Cloud
Cortex Cloud
Wiz
Orca Security
Tenable Cloud Security

The storm’s 1,196 findings, one week onThe same 34 accounts across AWS, Azure and Google Cloud

Found1,032 from your CNAPP, 164 added by NxSCORE
1,196Your CNAPP stops here
JudgedEvery finding has a verdict and an owner
1,196
Fixed by your teamFix kits run in your change windows; 48 risks accepted by you
1,148
Ruled out by guardrails37 guardrails in force, checked every day
1,148
Came backFindings that returned after a fix
0

S3 bucket public with customer records, prod-paymentsFixed, guardrail in force
Admin role outside change window, core-bankingRemoved, approved by a checker
Service key unused for 214 days, data-lakeRemoved, unused keys blocked

Run your cloud on maker-checker.

Software finds and drafts. People decide. Your NxSCORE analyst prepares every verdict and every change, and your team approves it. That holds when the scanner runs inside your own account too.

NxSCORE/ Exception EX-0318Risk accepted until 31 Jan 2027

prod-cards / card-switch load balancerTLS 1.0 still enabled for a legacy acquirer

Key 1Maker NxSCORE analyst

Accept the risk until 31 Jan 2027, when the acquirer migrates. Until then only the acquirer’s IP range may connect, and any other client raises an alert.

Proposed Mon 11:30

Key 2Checker Your security team

Accepted until 31 Jan 2027. Owner: card-switch team. Report the compensating control in the monthly risk review.

Accepted Mon 13:05

Compensating controlAcquirer IP allow-list, checked every day

Expires31 Jan 2027, the finding reopens on its own

No verdict changes on one person’s word.
One person prepares, another approves. Every time.
Only your security team accepts a risk.
Your analyst can propose it. Only your team can decide it.
Every decision is kept.
Who proposed, who approved and when, filed with the finding as evidence.

The same data-centre campus under a clear sky, the NxSCORE sign lit

The same cloud. Nothing coming back.

The same finding, the same week, the same release. This time a guardrail is in force.

prod-payments-customer-records / S3Prevented

Guardrail in force

Mon 10:12FoundBucket readable by anyone
Mon 16:40Fixed by your teamFix kit run in the change window
Tue 14:00Guardrail onSimulated on 30 days of activity first
Wed 11:05Release 4.18 deniedOld bucket policy blocked at deploy
Fri 17:00Still closedVerified on every assessment

Open findings1,1960 without a verdict
Found, and owned.
Every finding has a verdict, an owner and a date, the day it arrives.
prod-payments-customer-records0 timesreopened since Tuesday
Fixed, and prevented.
The release that brought it back is now the release that is stopped.
data-lake service key, Google CloudRemovedunused keys now blocked
Granted, and taken back.
The unused key is removed, and a guardrail blocks keys that sit idle again.

Compliance, wherever you are regulated.

Every control is mapped once and evidenced for each framework that asks for it, from ISO 27001 to the regulator in your market.

NxSCORE/ Controls / Public access to storage is blockedMet everywhere

Framework	What it asks for	Status
ISO 27001	Access to information is restricted	Met, 6 items
SOC 2	Logical access is limited to authorised users	Met, 6 items
PCI DSS	Cardholder data is never publicly reachable	Met, 6 items
CIS Benchmarks	Block Public Access is on for every bucket	Met, 6 items
CSA CCM	Data is protected from unauthorised access	Met, 6 items

Evidence, collected once

Mon 14:15Fix approved by your checker
Mon 16:40Fix kit run by your engineer
Tue 14:00Guardrail in force, simulated first
DailyGuardrail checked, still in force
Wed 11:05Release 4.18 denied by the guardrail
Wed 11:20Analyst note, seen by the team

The same six items answer every framework in every region. Nobody rebuilds them for an audit.

Read the role before you sign.

Everything NxSCORE can do in your cloud is written in the role you deploy. Keep it in your own change control. Remove it and our access ends, in every cloud.

Read the full trust centre

NxSCORE read-only access, CloudFormation excerpt

ManagedPolicyArns:
  - arn:aws:iam::aws:policy/SecurityAudit
  - arn:aws:iam::aws:policy/job-function/ViewOnlyAccess
Policies:
  - Sid: DenyDataPlaneReads
    Effect: Deny
    Action:
      - s3:GetObject
      - s3:GetObjectVersion
      - secretsmanager:GetSecretValue
      # ...parameters, table items, logs, function code
AssumeRole:
  Condition:
    StringEquals: { sts:ExternalId: <issued to you> }

No access keys. Delete the stack and access ends.

Read-only role
The NxSCORE role reads configuration. It cannot create, change or delete anything, and it holds no keys or secrets in any cloud.
Your data stays unread
Reading S3 objects, secrets, parameters, table items, logs and function code is explicitly denied.
Maker-checker
Every change to a verdict is prepared by one person and approved by another. Only your security team can accept a risk.
Your data, in your region
Findings, evidence and account data stay in the region you choose, India included.
Scanner in your account
Run the NxSCORE scanner inside your own cloud account. An NxSCORE analyst still works from the results.
Retention you set
You decide how long findings and evidence are kept, and you can export them at any time.

from finding to never again.

You fix it on Monday. It is back by Friday.

Found, not owned.

Fixed, not prevented.

Granted, never removed.

One finding, from first sight to never again.

Seen, and matched to its owner.

Safe to fix, so it is fixed today.

The cause, removed.

Then ruled out, in every cloud.

Proof, already collected.

And someone keeps watching.

Seen, and matched to its owner.

Safe to fix, so it is fixed today.

The cause, removed.

Then ruled out, in every cloud.

Proof, already collected.

And someone keeps watching.

We write it. Your team runs it.

Keep your CNAPP. NxSCORE finishes the job.

Run your cloud on maker-checker.

No verdict changes on one person’s word.

Only your security team accepts a risk.

Every decision is kept.

The same cloud. Nothing coming back.

Found, and owned.

Fixed, and prevented.

Granted, and taken back.

Compliance, wherever you are regulated.

Read the role before you sign.

Read-only role

Your data stays unread

Maker-checker

Your data, in your region

Scanner in your account

Retention you set

Start with one account.

What happens next

What you get