Waste and security findings

Open Everything found in Strays

Everything found lists what the scans found in your connected AWS accounts. Security risks come first, High before Medium before Low, then waste by monthly cost. Each card names the check and the resource, says how serious it is or what it costs, and says what's wrong. The fix is folded under How to fix it, and the Keep and Snooze buttons come after it, with a line saying what each does. On a phone the cards stack. The Search box finds a resource or check by name.

Filtering the list

The chips at the top switch between Everything, Waste and Security risks, and show Kept or snoozed. The Owner and Account menus narrow the list further; choosing a person on People or Open on This week filters by owner for you. See the fixes on an evidence answer lists just that answer's findings, kept or snoozed ones included.

Each chip's number counts within the Search, Owner and Account filters, so it is the number of cards its list shows, and the line under the heading says the same number. On a phone the filters fold behind Filter so the chips and the list come first; they stay open while a filter is in use.

Waste

Things you pay for and don't use, priced from AWS's list prices for each region: unattached disks, idle servers and databases, old snapshots, forgotten load balancers, and more.

Security risks

Settings that make a breach more likely, rated High, Medium or Low and grouped by the Cyber Essentials themes: users without MFA, ports open to the internet, public snapshots, unencrypted data, logging switched off, and more.

Managed as code

If a resource is in your Terraform or CloudFormation, the fix says to change it there, not in the console, so the next deployment doesn't undo it.

Ready-to-run fixes

Open How to fix it under any finding. After the recommendation it has three parts:

1. Check first: safety steps, such as taking a snapshot before deleting a disk, or seeing what uses a firewall group before closing a port.
2. Then fix it: the AWS CLI commands, already filled in with the resource and region. Use Copy and paste each into a terminal signed in to the right account. Long commands wrap onto several lines; Copy still copies them as one. Replace anything in <angle brackets> with your own value. Where you have to choose a value, such as the version to upgrade a database to, a step before it says how to find the choices.
3. If you manage it in Terraform: the change to make in your code.

Ask someone else to fix it, at the end of How to fix it, is the same fix as a request in plain English: what it is, which account and region, why it matters and the fix, with the steps. Copy a request for whoever fixes it copies it, ready to paste into an email or a chat message to a developer or IT supplier. Without JavaScript, select the text and copy it.

Strays changes nothing in your account. It only reads it, so you run every step yourself. The same steps are in Slack (as a link) and at the end of each report. To hand a finding to your team, Create ticket puts it, with these steps, in Jira or Linear (Business plan).

If the resource is managed as code and Strays found its Terraform address, the fix starts with the code change and leaves out the CLI commands. Running them by hand would make your code and your account drift apart.

Framework controls

Under a security finding, a small "Controls" line lists the CIS AWS Foundations Benchmark, ISO 27001 and SOC 2 controls it is evidence for, such as "CIS 1.5 · ISO 27001 A.8.5". Not every finding maps to a control. How the evidence pack uses them.

Keep, Snooze and Reopen

• Keep: it's intended (a bastion that must be reachable, say). It moves to "Kept or snoozed" and stays out of totals until you reopen it.
• Accept the risk: on a security risk, Keep is called this, because the setting isn't waste you need, it's a risk you choose to live with (a bastion that must be reachable, say). It moves to "Kept or snoozed", marked "Risk accepted", and leaves the work list, but the evidence pack still counts it, because an insurer asks whether the problem exists, not whether you've accepted it: an answer it sits behind stays Partly until it's fixed.
• Snooze 30 days: hide it for 30 days; it comes back if it's still there.
• Reopen: put an accepted or snoozed finding back on the list.
• After Keep, Snooze or Reopen the page stays where you were, and a message at the top says what happened with an Undo button. In the Kept or snoozed list each card says whether it was kept or snoozed until when, and who decided and when.
• Create ticket: only when Jira or Linear is connected. See tickets.

Viewers can see findings but not change them; members and admins can. Every decision is recorded, with who made it and when, in Reports. Owners can also decide from their Slack message, where there is a fourth choice, Not mine, for when the owner Strays found is wrong.

The home screen, This week, brings the findings only you can decide to the top.

What to do first, and the AI notes (Business plan)

On the Business plan, Strays asks AI (Anthropic's Claude, run by Amazon Bedrock in the EU, inside Strays' own AWS account) about your open findings every few hours, when they've changed. It adds:

• What to do first: up to five findings to start with, and why, at the top of the list.
• A sentence on each finding, marked AI, on why it matters for that resource in particular.
• A probable owner for a finding nobody is named for, chosen only from people Strays already knows in your organisation (owners it found, and your team), with the evidence. It's a suggestion: Strays never messages a suggested owner or files it as the owner.
• Likely one cleanup each: findings that look left behind by the same thing (one project, environment, deleted server or person, going by their names, tags and IDs), grouped so they can be dealt with together, with the total monthly cost and a probable owner. Check they really belong together before removing anything.
• Ask the likely owners: a short note for each probable owner, asking whether the resources are theirs and whether they can go, to copy into Slack or email. AI writes the opening; the list of resources and costs is Strays' own. Strays doesn't send it.

The findings themselves, their grades, costs and fixes are always Strays' own checks: AI never adds, removes or re-grades one. It sees the findings' names, resource names and IDs, accounts, regions, descriptions and owners, and your team's email addresses; AWS doesn't keep what's sent or use it for training. Check a suggestion before you act on it.

When findings update

Every scan refreshes the list. A finding that's gone from your account is marked fixed (and counts towards "Fixed this month"); one that comes back is new again.