Paleon — Sample Technical Report

At a glance

The review in five numbers

internal · 31 Jul 2026

1,432findings read

3need you now

41instances

10frameworks

£118kmodelled exposure

Findings

ID	Finding	Severity	Resource	Paleon score
PAL-001	Production database accepts connections from a public-facing subnet	Critical	sg-0a1b2c3d · rds-prod	36.0
PAL-002	DMARC is not enforced on sheehan.dev	High	sheehan.dev · TXT _dmarc	31.2
PAL-003	Admin access key is 412 days old	High	iam · AKIA…Q7	28.4
PAL-004	TLS 1.0 accepted on a legacy endpoint	Medium	legacy.sheehan.dev:443	14.8
PAL-005	S3 access logging disabled on two buckets	Low	s3 · assets-, logs-	6.1

Detail

36.0

PAL-001sg-0a1b2c3d · rds-prodenv:production · data:regulatedopen 2 days

Impact

One path exists from the internet to regulated customer data. This single finding drives the Critical rating of the review.

Evidence

0.0.0.0/0 → 5432inbound · sg-0a1b2c3dtag data:regulated

Fix

Restrict the security group to your application subnet only. No downtime. Paleon will verify on the next review.

31.2

PAL-002sheehan.dev · TXT _dmarcopen 5 days

Impact

Anyone can send mail as you — customers and suppliers included.

Evidence

SPF passDKIM passDMARC absent

Fix

Publish p=quarantine — one DNS record. Enforcement is safe now that SPF and DKIM pass.

Compliance

64%Average readiness across the ten frameworks your customers, auditors and regulators ask about. The database path is the gap that matters most.

Cyber Essentials Plus

78%

ISO/IEC 27001:2022

64%

UK GDPR

71%

SOC 2 Type II

58%

PCI-DSS v4.0

49%

Readiness against assessed controls. Paleon informs your audits — Paleon does not certify you.