Multi-cloud manufacturer · AWS + Azure
A manufacturer running on both AWS and Microsoft Azure had strong visibility into its cloud security risks through Wiz, a cloud security posture management (CSPM) tool that continuously scans for misconfigurations. The dashboard showed thousands of issues across both clouds, all neatly catalogued. The trouble was that seeing the problems had not made the company safer, because almost none of them were getting fixed.
The most worrying part was that the issues which truly mattered were lost in the crowd. Sitting in the same long list as minor housekeeping items were genuinely dangerous problems: storage open to the public that held sensitive product and customer data, databases with no encryption, and backups that far too many accounts could reach. Because everything looked the same in the queue, the issues most likely to cause a real breach were not the ones getting attention first.
Three things were behind this. There were far more issues than the team could ever work through, so the backlog only grew. Fixes were made directly in live systems rather than in the code used to build them — known as infrastructure-as-code (IaC) — so the same problems came straight back on the next deployment. And exceptions had no end date, owner, or review, so anything marked “temporary” quietly became permanent. Nothing told the difference between a harmless test environment and an exposed store of regulated data.
We rebuilt remediation as an operating model and put data sensitivity at the heart of how findings were ranked. Risk-based prioritization replaced severity-only triage — scoring each finding on severity, exposure, asset criticality, and toxic-combination logic (e.g. public storage + sensitive data + weak encryption). A misconfig on an empty test bucket and the same on a bucket full of customer data no longer looked alike.
We authored engineering-friendly master runbooks for the highest-volume finding types — including the data-protection fixes (encryption at rest, closing public access, tightening sensitive-bucket policies) that mattered most. A time-bound exception workflow required justification, expiry, owner, and risk acceptance, with sensitive-data exceptions routed to a higher bar. Wiz IaC scanning in CI/CD caught misconfigurations — including data-exposing ones — at pull-request time.
Reprioritized the entire backlog around data sensitivity and exposure, so breach-likely issues rose to the top
Reduced repeat findings by an estimated 60–70% through IaC-stage prevention
Cut central-team escalations on routine findings by ~45%
Open exceptions dropped from over 180 to under 60 within two quarters
Self-service remediation guidance mapped to CIS, NIST, CSA CCM — audit evidence in days, not weeks
Visibility only pays off when remediation can keep up — and remediation only points the right way when it knows what data is at stake. Scoring findings by data sensitivity, not just severity, turned an unworkable queue into a clear order of operations.