An audit is not a photo — it's an auditor that teaches itself between runs
A cloud is never set up "insecurely" — it becomes insecure gradually. An instance gets added, a port is opened "just to test," a bucket appears, a service ships under a key nobody ever rotates. A year or two later you have 130 servers, thousands of snapshots, and nobody can tell you whether root is protected, whether the disks are encrypted, or whether you'd even notice someone getting in. We ran a read-only security audit of one mid-sized company's AWS account — through a read-only role, with not a single change to the account — and found exactly this quiet debt: root without MFA, 100% of disks and snapshots unencrypted, threat detection switched off in every region.
But an audit as a one-off PDF report is stale the day it ships — a week later you add a service, AWS ships a new feature, a new CVE lands. So we didn't build a report; we built an auditor that keeps living: every run it measures the same thing deterministically, and between runs it grows its own rule set — proving each new rule before it trusts it.