You Can See the Blueprint Without Handing Over the Keys
It's easy to assume that inspecting something means installing something. Agentless goes the other way. Instead of searching the house, it reads the blueprint. Here's how much you can learn from a single read-only permission.
Think about a fire safety inspection in an apartment building. The inspector doesn’t go door to door opening wardrobes and rummaging through drawers. They look at the blueprint instead. Where the emergency exits lead, how many staircases there are, which wall the fire door is mounted on. That alone is enough to say “the third-floor emergency stairway is blocked.”
This post is about that blueprint. Cloud security inspection can also see quite a lot from the blueprint alone, without searching the house. That approach is called agentless (the not-installing approach).
Installing Means Letting Someone Into the House
Inspection tools usually use an agent. An agent is a small program installed on every server. Think of it as a resident staffer who watches from the inside and reports out.
INFERRED Being inside, it naturally sees more. But there’s a price. If you have 100 servers, you install it 100 times, and again every time a new server comes up. Above all, it’s a program running inside someone else’s house, so the side deciding whether to adopt it treats the agent itself as something to be vetted. You end up going through one more security review just to do a security inspection.
The Side That Only Reads the Blueprint
FACT SecurityHero RMF installs nothing in the customer environment. All you connect is a single read-only IAM role. IAM (Identity and Access Management) is the AWS mechanism that decides “who can do what.” Read-only means permission to look but not to change.
FACT That role is created with CloudFormation. CloudFormation is the feature that stamps out AWS configuration from a single document. Per the source material, it is 10 minutes from connection to report.
You’re not handing over a copy of the key. It’s closer to issuing a credential to view the blueprint.
| Installing approach (agent) | Not-installing approach (agentless) | |
|---|---|---|
| What goes in | A program on every server | One read-only permission |
| When things scale up | Again on every new server | Account-level, so unchanged |
| What it can see | Inside the house | The structure written on the blueprint |
| Can it change things | Depends on permissions | Cannot |
This isn’t an argument that one is better. They’re looking at different things. What regulatory evidence usually asks is not “what’s in the room” but “is the door locked.” That’s written on the blueprint.
What’s Written on the Blueprint
FACT RMF sweeps assets, IAM, and network with an inspection tool called Prowler, and weighs exploitability with EPSS. EPSS is the “probability it will actually be used in an attack” score covered in Part 3. Concretely, this is what comes out.
Here’s what the blueprint actually looks like when drawn. VPCs and subnets are divided like rooms, and connections between assets are drawn as lines. This picture was drawn without ever going inside a server.
| Item on the blueprint | What it actually shows |
|---|---|
| Room layout | Automatic AWS asset identification, relationship graph |
| Entry rules | IAM least-privilege analysis, users without MFA enabled |
| Corridors and passages | Network flow visualization, external exposure paths |
| Safe settings | S3·EBS·RDS encryption, TLS·KMS key configuration |
INFERRED Conversely, what’s not on the blueprint is just as clear. This is an inspection that reads configuration, not one that looks inside files. It can say “encryption is off on this bucket,” but what’s stored inside it is not a question this approach answers.
So What Does This Have to Do With NIS2
FACT NIS2 Article 21 requires that risk management measures be maintained in documented form and demonstrated during supervisory authority audits. RMF references CIR 2024/2690 (the EU implementing regulation) and the ENISA technical implementation guidance (June 2025) to organize inspection results as a basis for response, and exports them as PDF and DOCX.
INFERRED Not installing anything works in your favor once more here. That’s because a question that comes up often in review is “was the inspection itself safe.” The fact that there was never any permission to change anything makes that question a short one.
FACT Seeing the blueprint doesn’t mean taking the blueprint either. Scan results and reports are stored in a customer-designated S3 bucket and encrypted with a customer-owned KMS key. That story belongs to the next post.
Things to Note
- This post is not legal advice. “Do this and you comply with NIS2” is not something we can say. Whether you fall in scope and how far your obligations extend depend on each country’s transposition law and its supervisory authority’s judgment.
- An RMF report is not a certificate. It is supporting material used for submission and review. Issuing certificates, incident notification (NIS2 Article 23 and others), and legal representation are not included here.
- The blueprint is not the whole house. The scope confirmable by configuration inspection and the scope of regulation — which also asks about people, procedures, and physical security — are not the same. Where the technical evidence layer ends is drawn differently by each organization.
Series Contents
- Why You Have to Submit Security Paperwork to Sell Goods in the EU
- Why “Risk Assessment” Sounds So Difficult
- There Are 3,000 Things to Fix — Where Do You Start
- How Do You Inspect Without Installing Anything ← the post you’re reading
- What “Your Data Doesn’t Cross Borders” Actually Means
- Handling Multiple Countries With a Single Document