Sample Audit Report | TrioTech Systems

SAMPLE REPORTTriotech Systems

Cloud & Security Audit

Client: Sample Co. · US fintech, about 80 people, payments platform (details changed)
Scope: AWS, two accounts (production and staging), 14 services, GitHub Actions CI/CD
Reviewer: Lokesh Kojhani, CISSP, CSSLP

3high-risk findings

6medium findings

7quick wins

$4,800a month in savings, about 18% of the bill

Cloud architecture & costMedium

CI/CD & secretsHigh

Access & IAMHigh

AI agent permissionsHigh

Monitoring & incident responseMedium

Compliance readinessMedium

ID	Risk	Finding	Fix	Effort
H1	High	Pipeline uses a long-lived admin key	Move to OIDC short-lived roles	1–2 days
H2	High	2 of 5 admins have no MFA, one is an ex-contractor	Enforce MFA, remove the account	2 hours
H3	High	AI coding agent uses an engineer's personal token with merge rights on all 38 repos	Give the agent its own scoped identity	1 day
M1	Medium	Secrets in environment variables in 3 services	Secrets manager with 90-day rotation	2 days
M2	Medium	No out-of-hours alerting	Page critical alerts to on-call	1 day
M3	Medium	Backups never restore-tested	Quarterly restore test	1 day
M4	Medium	11 servers under 15% CPU	Right-size instances	2 days
M5	Medium	7-day log retention	90 days searchable plus a 1-year archive	4 hours
M6	Medium	Main branch unprotected in 4 repos	Branch protection and required review	2 hours

Right-size servers$2,300

1-year savings plan$1,600

Unused storage$620

Log archive$280

Days 1–30Close the high risks

Short-lived credentials, AI agent identity with required review, SSO for admins, on-call paging.

Days 31–60Harden and save

Secrets manager, right-sizing and savings plan, first restore test, tagging policy.

Days 61–90Get audit-ready

90-day log retention, first quarterly access review, incident response guide and drill, re-score.

A 30-minute walkthrough of these findings, then your call: fix in-house, use another provider, or ask us for a proposal.