Every platform problem I have found in eighteen years fits in one of six buckets. Most teams are strong on two of them.
How far one mistake reaches. Wildcard permissions, trust policies with no condition, a single account holding every environment, stateful resources with nothing preventing their destruction.
Whether your code still describes reality. State files holding secrets in readable form, a console fix at 2am that nothing recorded, mutable references that make a deployment impossible to reproduce.
Your real recovery time, the one you have measured. A rollback nobody has executed, a migration with no path back, an image pruned by a cleanup policy nobody remembers configuring.
The findings that stall your next enterprise deal. Object storage reachable by anonymous principals, administrative ports open to the internet, keys that have never rotated, pipeline steps that run untrusted code with a write token.
What breaks without anyone hearing about it. Alerts that fire on symptoms rather than user impact, health checks that only prove a process is alive, log retention shorter than the time it takes to notice a breach.
The environment nobody owns and nobody dares delete. Untagged resources, spend that rose without explanation, and the fact that a compromised credential usually appears in billing before it appears anywhere else.
That trace is the difference between a scanner and an answer you can give a customer.
Amazon Web Services today, validated against live infrastructure and the platform every control set is written for.
Azure, Google Cloud, Kubernetes, OpenShift, Databricks, Snowflake and Entra have control sets written and are not yet validated against a live provider. We will say yes to those when a contract names them, and not before.