A finding is a rule-driven observation about an identity. Findings surface on the inventory row, the identity detail, and a workspace-wide “risk” view.

​
Built-in finding kinds

KindWhat it meansDefault severity
unownedNo owner assignedhigh
staleNo use in ≥ 90 daysmedium
orphanedOwner is inactive / deleted userhigh
over-privilegedGrants match *:* or a suppressed set of dangerous verbshigh
unrotatedKey / secret older than the policy allowsmedium
unused-privilegeGranted permissions the identity never actually usedlow
cross-account-trustTrust policy allows a non-owned accounthigh
long-lived-keyStatic key with no expirymedium

​
Filtering

tt nhig findings ls --severity=high
tt nhig findings ls --kind=over-privileged --source=aws
tt nhig findings ls --unresolved --older-than=30d

​
Remediation

Each finding has one or more suggested remediations:
  • Assign owner — for unowned
  • Archive — for stale or orphaned
  • Right-size policy — for over-privileged (creates a proposed policy diff)
  • Rotate now — for unrotated (calls into Secrets Manager if the secret is under SM management)
  • Add to review campaign — everything else

​
Suppression

Some findings are known-good (a break-glass account is intentionally over-privileged). Suppress with an expiry so the exception itself expires: 
tt nhig findings suppress fnd_xxx --until=2027-01-01 --reason="break-glass, reviewed quarterly"
Suppressed findings show up on the risk view labelled with the reason and the expiry — auditors can see intentional exceptions.

Ownership

Most first-scan findings are unowned — fix that first.

Access reviews

Findings that survive suppression get pulled into campaigns.