The dog that didn't bark: finding security holes in what's missing, not what's misconfigured

Every security scanner examines resources that exist. Nobody checks whether the resources your IAM policies reference actually exist. A deleted S3 bucket name referenced in an active policy is a structural hole — the permission is live, the resource is gone, and the name is reclaimable by any attacker. The absence is the evidence. In Arthur Conan Doyle's Silver Blaze, a prize racehorse is stolen from a guarded stable. Scotland Yard investigates the crime scene, interviews witnesses, examines ev...