I swapped 2 of the usual tags (webdev, ai) for devops and startup because this piece is about infrastructure evidence. Swap back if you prefer.

Someone will eventually ask you to confirm the “yes” boxes on a cyber insurance application. MFA everywhere. EDR on every host. Clean email authentication. Nothing exposed. Here’s how to produce evidence instead of opinions.

Why it matters... in 2022 an insurer and a manufacturer agreed to an order rescinding a cyber policy and declaring it void from inception after the insurer said MFA protected only the firewall. Evidence is the difference between a yes and a maybe.

MFA... find the accounts that break your “yes”

AWS IAM users with console passwords but no MFA-

`aws iam generate-credential-report

wait a few seconds, then (use base64 -D on macOS):

aws iam get-credential-report --query Content --output text | base64 -d \

| awk -F, 'NR>1 && $4=="true" && $8=="false" {print $1}'`

That lists IAM users with a password and no MFA.…