Prowler is great. Here's what to do with 400 findings.

If you've never heard of Prowler, you're not alone. I built my own AWS security scanner before I stumbled across it. Read the landing page, had a quiet moment of what is this, and realised it was basically the scan engine I had spent weeks building from scratch. It's open source, free, covers every major AWS finding category, and maps everything to compliance frameworks out of the box. It is one of the most underrated tools in cloud security.

So run it. Seriously, if you haven't, stop reading and go run it now.

Come back when you have your 400 findings.

The problem isn't Prowler. It's what happens after.

You run the scan. You get the report. You open it.

Four hundred findings stare back at you. Some are CRITICAL. Some are HIGH. Some are things you've never heard of. Some are probably fine. Some are definitely not fine. You don't know which is which.

So you do what everyone does. You close the tab and tell yourself you'll come back to it.

Three months later, you haven't.

This isn't a discipline problem. It's a prioritisation problem. Prowler tells you everything that's wrong. It doesn't tell you what to fix first, what's actually risky in your specific setup, or what you can safely fix at 2am without waking anyone up.

That gap is where security debt accumulates. And in my experience working in cloud security at a regulated financial institution, it accumulates fast. Security teams are often not well versed in cloud tooling. Cloud teams are project-driven and operational, not remediation-driven. Control Tower and landing zones get treated as day-two problems, then day-ten, then never. Findings pile up. Nobody takes action, not because they don't care, but because nobody has made it clear what the right next action actually is.

How to actually work through 400 findings

The key insight is that severity and actionability are not the same thing.

A CRITICAL finding that requires coordination across three teams, a change freeze exception, and sign-off from your CISO is not something you fix on a Tuesday afternoon. A HIGH finding that takes four CLI commands and has zero production impact absolutely is.

Start by splitting your findings into three buckets.

Bucket 1: Fix right now, no questions asked.

These are the findings where the correct action is obvious, the risk of doing it wrong is near zero, and the upside of fixing it is immediate. Root account has no MFA enabled -- four clicks in the console, nobody has ever broken production by enabling root MFA. Root account has active access keys -- delete them, root should never have programmatic access, this is not a discussion. CloudTrail is not enabled -- turn it on, there is no operational downside. If your Prowler report has any of these, fix them before you do anything else. Today.

Bucket 2: Fix this sprint.

These are findings that need a bit more context before you act, but are well-understood and safe to work through systematically. IAM users who haven't logged in for 90 days. Access keys that haven't been rotated in a year. Console users without MFA. VPC flow logs not enabled. None of these require emergency action. All of them should be on your backlog with a clear owner and a deadline.

Bucket 3: Needs a conversation.

Public S3 buckets, exposed RDS instances, single-AZ resources -- these might be intentional, they might be disasters waiting to happen. You cannot tell from the finding alone. Flag them, get context, then decide.

The pattern you'll find on most AWS accounts

When I look at real AWS accounts, the pattern is almost always the same. The CRITICAL findings at the top of the Prowler report are often Bucket 3 problems: context-dependent, hard to act on safely without knowing more. The things that are actually fixable right now are buried halfway down the list at MEDIUM severity, because Prowler scores by risk category, not by how easy they are to fix.

This is not a criticism of Prowler. It's just a different dimension that Prowler doesn't try to solve.

Root MFA disabled is a CRITICAL finding and also a five-minute fix. An overly permissive security group rule might also be CRITICAL and require two weeks of stakeholder alignment before you can close it. Treating them the same way is why nothing gets done.

Where to go from here

Run Prowler. Get your findings. Then sort them by actionability, not severity.

Either way: start with root MFA, root access keys, and CloudTrail. Fix those three today. Everything else can wait until you have a plan.

Anguardia

.