| Severity | Finding | Resource |
|---|---|---|
| Critical | SQL Server firewall allows ALL IPs (0.0.0.0 – 255.255.255.255) | titan-lab-sql-4336 |
| Critical | NSG allows RDP 3389 from 0.0.0.0/0 | titan-admin-nsg/AllowRDP |
| Critical | NSG allows SSH 22 from 0.0.0.0/0 | titan-admin-nsg/AllowSSH |
| Critical | Load Balancer Basic SKU — public-facing, no SLA guarantee | titan-lab-lb-4336 |
| Critical | NSG allows Elasticsearch 9200 from 0.0.0.0/0 | titan-db-nsg/AllowElastic |
| High | Storage public blob access enabled | titanlabdata4336 |
| High | Storage HTTP allowed (not HTTPS-only) | titanlabdata4336 |
| High | Storage public blob access enabled | titanlabphi4336 |
| High | Storage HTTP allowed (not HTTPS-only) | titanlabphi4336 |
| High | Storage public blob access enabled | titanlabnosftdl4336 |
| High | Orphaned disk — cost waste (32 GB) | titan-orphan-disk |
| High | Orphaned disk — cost waste (64 GB) | titan-orphan-disk2 |
| High | App Service allows HTTP | titan-lab-admin-4336 |
| High | App Service allows HTTP | titan-lab-portal-4336 |
| High | Container Registry public access enabled | titanlabacr4336 |
| High | AKS cluster no Azure AD integration | titan-lab-aks-4336 |
| High | AKS API server publicly accessible (no IP restrictions) | titan-lab-aks-4336 |
| High | AKS no network policy — pod-to-pod traffic unrestricted | titan-lab-aks-4336 |
| Medium | Storage minimum TLS version 1.0 | titanlabdata4336 |
| Medium | Storage minimum TLS version 1.0 | titanlabphi4336 |
| Medium | Storage minimum TLS version 1.0 | titanlabnosftdl4336 |
| Medium | Function App CORS wildcard (*) | titanlabfunc4336 |
| Medium | Orphaned Public IP — cost waste | titan-orphan-pip1 |
| Medium | Orphaned Public IP — cost waste | titan-orphan-pip2 |
| Medium | Container Registry admin account enabled | titanlabacr4336 |
| Medium | Log Analytics 30-day retention only | titan-lab-logs |
| Medium | AKS no Container Insights monitoring addon | titan-lab-aks-4336 |
| Medium | Load Balancer empty backend pool — no rules configured | titan-lab-lb-4336 |
| Medium | Key Vault purge protection disabled | titan-lab-kv-4336 |
| Low | Empty resource group (informational) | NetworkWatcherRG |
We'll run the full TITAN pipeline on your Azure subscription — completely free, zero risk, read-only scan.
Same agents. Same pipeline. Your infrastructure. Your results in 15 minutes.