CloudSec
An Azure security scanner that turns misconfigurations into a story you can act on.
A cloud security tool that scans Azure environments for misconfigurations, maps them to recognised controls, and produces reports that don't require a security team to decode.
CloudSec
The problem
Cloud misconfigurations are one of the quietest causes of breaches. A storage account left public, a permissive role assignment or an outdated TLS version rarely announces itself — and the people who own the subscription are not always security specialists.
The approach
Build a scanner that speaks both languages: enough technical depth to catch real Azure issues, and enough clarity to explain why each one matters, who it affects and what to change first.
What I built
- ✱Subscription-wide checks for public storage, weak TLS, missing logging and overly permissive role assignments
- ✱Findings mapped to recognised cloud controls so they can be prioritised rather than dumped into a list
- ✱Plain-language reports with severity, evidence and a practical remediation step for each finding
Challenges
Normalising inconsistent Azure API responses across resource types
Keeping scans fast and respectful of API rate limits on larger subscriptions
Writing findings for two audiences: engineers who need evidence, and stakeholders who need impact
What I learned
- ✱How Azure's control plane and resource model fit together
- ✱Designing security tooling that is useful without being overwhelming
- ✱Turning raw configuration data into a defensible risk narrative
Where it landed
A working scanner and a repeatable report format — currently being refined with more resource coverage and better prioritisation.
What I'd improve next
Scheduled scans, remediation playbooks, and a small dashboard that shows drift over time instead of a single snapshot.
Next project
Full-stack platform — 2026