From inventory to fix list: the first week after connecting a cloud security platform

Why the first list is too long

A newly connected platform reports every misconfiguration, vulnerability and excess permission it can see. Many are real but harmless on their own: a vulnerable package on a VM with no network exposure, an over-broad role nobody uses. Fixing them in the order they appear wastes the first month.

What risk context does

Risk context joins findings. A VM with a critical vulnerability, reachable from the internet, running with an identity that can read a sensitive data store, is one finding made of three. Platforms build this differently:

• Wiz's Security Graph links infrastructure, identities, data and AI resources into attack paths.
• Orca Security scores risk and analyzes attack paths on one data model built from its agentless read.
• SentinelOne's Offensive Security Engine checks which exposures are exploitable and shows Verified Exploit Paths.
• Palo Alto Networks Cortex Cloud ranks findings with SmartScore and SmartGrouping.
• CrowdStrike enriches findings with adversary intelligence and, since March 2026, a Cloud Risk Engine.
• Sysdig Secure uses runtime insight to filter out vulnerabilities in packages that never run.

On our risk context criterion Wiz scores highest at 9.8, with Orca at 9.6.

A week-one routine

1. Day 1 to 2: confirm the inventory against your estate map. Fix gaps in coverage before fixing findings.
2. Day 3: take the platform's top attack paths that end at sensitive data or administrative access. Assign each to the owning team.
3. Day 4: fix internet exposure first, then identities, then vulnerabilities on exposed workloads.
4. Day 5: record what you fixed and what you accepted, so the next week starts from a smaller list.

What to watch

A short list that is wrong is worse than a long list. Check a sample of the top-ranked paths by hand in week one. If the ranking puts something harmless at the top, tell the vendor; most platforms let you tune risk factors.

When context needs runtime

Static context shows what could happen. Runtime context shows what is happening, and which vulnerable packages actually execute. If week one leaves you unsure which findings matter, that is the point where a sensor earns its rollout; see the next lesson.