Here's a quiet way compliance evidence goes wrong. The tool checks your main AWS account in us-east-1. It passes. Everyone moves on.
Meanwhile the staging account in another region has a public bucket, and the subscription someone spun up for a proof of concept has no logging at all. None of it was in scope, because nobody told the tool it existed.
Safeguard's cloud tests now run across every account, subscription, project and region you connect. Not just the default one.
What's covered
- Every account and region. AWS accounts, Azure subscriptions, GCP projects, each region, tested.
- Government and sovereign clouds are included, not skipped.
- Oracle Cloud. You can now connect OCI from the connector sheet, with checks evaluated across every tenancy region.
- Hetzner Cloud projects are tested too.
Every result says where it came from
Each cloud test result now shows the account and region it was read from. When an auditor asks "which account is this evidence for," the answer is on the result, not in someone's memory.
When the API can't answer
Some controls can't be read from a cloud API at all. For those, Safeguard now collects evidence through reviewed attestations, so the control isn't left blank and the reviewer is on record.
Why it matters
Auditors increasingly sample the accounts you didn't mention. Coverage that matches what you actually run is the difference between a clean report and a finding you have to explain.
Try it yourself
Click through it at your own pace, or open it full screen.
Count your cloud accounts, subscriptions and projects, then count the ones your current compliance tool actually tests. If the second number is smaller, that difference is your blind spot. Then see what happens when a test fails.
Quick check
Which regions does an Oracle Cloud connection check?
Every region in the tenancy.
A control can't be read from any cloud API. What happens?
Evidence is collected through a reviewed attestation, so the control isn't left blank and the reviewer is on record.
