Table of Contents
- Executive Summary
- Closed Issues Analysis
- Open & In-Progress Issues
- Monthly Trend Analysis
- Risk Reduction Velocity
- Low-Hanging Fruit Opportunities
- Forward-Looking Guidance
Executive Summary
This report provides a holistic view of risk reduction progress within the Cyera platform. It examines the lifecycle of security issues from detection through resolution, identifies patterns in remediation velocity, and highlights opportunities for accelerating risk posture improvement.
Total Issues Detected
Issues Closed
Issues Remaining
Records Remediated
Records Still at Risk
High-Risk Records
Key Finding
While 587 issues have been resolved (33.7% closure rate), 1,154 issues remain open with 150.5M records at risk. Critical and High severity issues account for 705 of the open backlog, exposing 55.2M records to elevated risk. Closure rates have been inconsistent month-over-month, suggesting remediation efforts are not yet operating at a sustained cadence.
Closed Issues Analysis
A total of 587 issues have been resolved to date. The majority were auto-resolved by Cyera's platform intelligence (85.2%), indicating strong automated detection-and-resolution capabilities. However, manual remediation and proactive fixes remain a small fraction of closures.
Closed Issues by Resolution Type
Closed Issues by Severity
Key Observations:
- ByCyera (500 issues, 85.2%): The platform automatically resolved the vast majority of issues, typically when the underlying condition was corrected (e.g., encryption enabled, access revoked).
- Datastore Deleted (55 issues): Indicates cleanup of unnecessary or orphaned data stores — a positive signal for data minimization.
- Policy Edited (28 issues): Policy refinements closed issues that were no longer applicable after rule adjustments.
- Manual Remediation remains minimal: Only 2 issues were explicitly fixed through remediation workflows, and 2 were accepted as risk — suggesting an opportunity to increase proactive human-driven resolution.
Open & In-Progress Issues
There are currently 1,154 issues that remain open or in progress. The severity distribution shows a concerning concentration at Critical and High levels, which together represent 61% of the open backlog.
Open Issues by Severity
Open Issues by Infrastructure (Top 6)
Top Policies Generating Open Issues
| Policy | Issues |
|---|---|
| US Social Security Number in plain text | 120 |
| Credit card number in plain text (FR) | 98 |
| Credit card number in plain text | 97 |
| European personal data stored outside Europe | 69 |
| Restricted data accessible without MFA | 59 |
| Passport Number in plain text | 56 |
| Encryption in transit not enforced (S3) | 46 |
| No logging of access/changes (S3) | 46 |
| S3 accessible from inactive role | 46 |
| S3 accessible by external AWS account | 46 |
Infrastructure Concentration: AWS S3 dominates the open issue landscape (37% of all open issues), followed by Microsoft OneDrive (22%). Together these two platforms account for nearly 60% of the remaining risk surface. The policy breakdown reveals that plain-text sensitive data (SSN, credit cards, passports) is the single largest category of violations, indicating systemic gaps in data-at-rest encryption or tokenization.
Monthly Trend Analysis
The monthly trend of issues opened versus closed reveals an uneven remediation cadence. While certain months show strong closure activity (November 2025: 91 closed, February 2026: 100 closed), others show minimal progress. New issue creation has been volatile, with spikes in July 2025 (366), February 2026 (218), and March 2026 (180).
Issues Opened vs. Closed Per Month
Trend Interpretation
The data shows a pattern of reactive remediation: closure activity spikes after periods of high issue creation (e.g., Feb 2026 saw both 218 opened and 100 closed). However, closures have never exceeded openings in any single month during the observed period, meaning the backlog has been growing. The most recent data (April 2026: 8 opened, 8 closed) suggests a brief equilibrium, but the sample is too small to confirm a sustained trend.
Velocity Assessment: Over the 10-month observation window, approximately 1,176 issues were opened while 423 were closed (excluding earlier closures). This yields a net accumulation rate, indicating that risk reduction is currently decelerating relative to new issue discovery. The platform is identifying risks faster than they are being resolved.
Risk Reduction Velocity
Risk reduction velocity measures whether the organization is closing issues faster than new ones are being created. The current data indicates a net-negative velocity — the open issue backlog is growing over time.
Overall Closure Rate
Avg Monthly Closures
Avg Monthly Openings
Net Monthly Deficit
Velocity Gap
On average, 118 new issues are opened per month while only 42 are closed — a 2.8:1 ratio of creation to resolution. At this pace, the open backlog will continue to grow unless closure rates are significantly increased or new issue creation is reduced through preventive controls.
What this implies for risk posture: The 150.5M records currently at risk represent a growing exposure surface. While 106.1M records have been remediated through closures, the inflow of new issues (particularly in data encryption and data sprawl use cases) is outpacing the organization's ability to resolve them. The high proportion of auto-resolved issues (85%) suggests that when conditions change, Cyera detects and closes issues efficiently — but proactive, human-driven remediation is lagging significantly.
Issue Resolution Progress
34%
Low-Hanging Fruit Opportunities
Several categories of open issues represent relatively low-complexity remediation opportunities that could yield significant risk reduction with focused effort. These "quick wins" typically involve configuration changes, policy enforcement, or cleanup of stale resources.
Medium-Severity Issues with High Impact (Quick Wins)
| Policy | Issues | Records at Risk |
|---|---|---|
| Encryption in transit not enforced (S3) | 46 | 12.5M |
| S3 accessible by external AWS account | 46 | 12.5M |
| No logging of access/changes (S3) | 46 | 12.5M |
| S3 accessible from inactive role | 46 | 12.5M |
| Bedrock Agent can access sensitive data | 37 | 11.9M |
| Restricted data in non-production env | 30 | 1.9M |
| Shadow users with access to PII (M365) | 29 | 7.1M |
| European data stored outside Europe | 69 | 289K |
| Public endpoint enabled (Snowflake) | 14 | 2.0M |
| Encryption in transit not enforced (RDS) | 12 | 1.3M |
Highest-Impact Quick Wins
The top 4 S3-related policies (encryption, external access, logging, inactive roles) each affect 46 datastores and 12.5M records. These are infrastructure configuration issues that can often be resolved through automated remediation (e.g., enabling TLS enforcement, revoking stale IAM roles). Addressing just these 4 policy categories would remediate 184 issues and protect approximately 12.5M records.
Additional low-hanging fruit categories:
- Ghost datastore issues (14 issues): These affect orphaned datastores that may be candidates for deletion, which would immediately resolve associated issues.
- AI Security (Bedrock Agent access, 37 issues): Given your focus on AI security, these represent both a quick win and a strategic priority — restricting Bedrock Agent access to sensitive data through guardrails.
- Data Sprawl (616 open issues across use case): The largest use-case category; many sprawl issues can be resolved by moving data to approved locations or applying proper classifications.
Forward-Looking Guidance
Based on the analysis of current trends, risk concentration, and remediation patterns, the following strategic recommendations are provided to maintain and accelerate risk reduction momentum.
Priority 1: S3 Infrastructure Hardening
S3 accounts for 37% of all open issues (423 issues). A focused campaign to enforce encryption-in-transit, disable inactive role access, enable logging, and restrict external account access across all S3 buckets with sensitive data would eliminate approximately 184 medium-severity issues in one sweep. These are configuration-level fixes amenable to automation.
Priority 2: Plain-Text Sensitive Data Remediation
US SSN (120 issues), credit card numbers (195 issues combined), and passport numbers (56 issues) in plain text represent the largest single policy violation category. Implementing tokenization or encryption-at-rest for these data classes would address 371 issues and significantly reduce Critical/High severity exposure.
Priority 3: AI Security Guardrails
With 37 issues related to Bedrock Agent access to sensitive data (11.9M records) and 35 issues for M365 Copilot access (10.3M records), AI tool governance is both a quick win and a strategic imperative. Implementing access guardrails for AI services would protect over 22M records from potential AI-mediated data exposure.
Structural Recommendation
The current 2.8:1 ratio of issue creation to resolution is unsustainable. To reverse the growing backlog, consider: (1) Implementing automated remediation workflows for high-volume, low-complexity policies; (2) Establishing a weekly remediation sprint targeting 50+ closures; (3) Deploying preventive controls (e.g., SCPs, guardrails) to reduce new issue creation at the source.
Recommended Focus Areas by Timeline:
Immediate (0-30 days): Address S3 configuration issues (184 issues, automated fix), delete ghost datastores (14 issues), and restrict AI tool access (72 issues).
Short-term (30-90 days): Implement tokenization for plain-text PII/PCI data across S3 and RDS (371 issues). Enforce MFA for restricted data access (59 issues).
Medium-term (90-180 days): Address data residency violations (69 issues), establish preventive controls to reduce new issue creation rate, and build sustained remediation cadence targeting 100+ closures/month.
Target State: Achieve a closure-to-creation ratio above 1.5:1 to systematically reduce the open backlog and bring total records at risk below 50M within 6 months.

.png)





