Purple teaming and writing pentest reports

As a cloud pentester, you will spend anywhere from a few days to multiple months on a single engagement, whether you’re a third-party contractor to the organization you’re working for or a part of the organization’s internal red team. Your objective is to work within your organization’s contractually defined scope to find as many security vulnerabilities as you can while performing simulated cyber attacks your organization and the cloud providers (AWS, Azure, GCP) permit you to do.

So, over the course of those days, weeks, or months, you may have found several vulnerabilities. Most of them are vulnerabilities that the cybersecurity community is familiar with, with extensive records in the CVE database, NIST’s NVD, and in the security alerts and patch notes of the vendors (tech companies that provide products and services to your organization) to which the vulnerabilities you’ve found pertain. Maybe...