Where do the 380+ checks come from?

A combination of AWS-best-practice checks (Well-Architected Framework, AWS Foundational Security Best Practices), CIS Benchmarks, and Refine-curated checks we've seen catch real issues across customer engagements.

Will "Fix Available" make changes I did not ask for?

No, and it could not. The IAM role you grant is strictly read-only — Billing, SecurityAudit, read access to your export bucket, one Savings Plans read and one CloudWatch metrics read. "Fix Available" means Refine holds a vetted remediation for that check and will show you the numbered AWS Console steps plus the official AWS documentation. You make the change in your own account, on your own schedule.

Can I mute checks that do not apply to me?

Yes — per-check, per-account, or org-wide. Muted checks remain visible but stop counting against your Security Score and stop emailing alerts.

How is this different from AWS Security Hub?

Security Hub is excellent and free for findings, and its SSM runbooks can apply a fix for you — Refine cannot, and does not ask for the write access that would let it. What Refine adds is cost optimization in the same product, AI narrative reports, a customer hierarchy for MSPs, and a vetted remediation guide attached to the finding. We are complements more than substitutes — many customers run both.

Do you support multi-account orgs?

Yes. The customer hierarchy has a switcher in the header and no account limit on the paid plans — Growth and up add unlimited AWS accounts and AWS Organizations sync. The Free plan covers one standalone account. See /product/multi-account for the full MSP and enterprise story, and /pricing for the plans.

Product · AWS Advanced Tier Services Partner

Find 380+ AWS security risks. Know exactly how to fix each one.

IAM, storage, network, compute, and logging — checked across every region of every connected account. Severity-tiered, AI-narrated, and every finding carries the AWS Console steps that close it.

Connect AWS Account See The Findings Catalog

security scan · all regions380+ checks · severity-tiered

CRITICALS3 bucket public-read · prod-assetsFix Available
HIGHRoot account signed in without MFA
HIGHSecurity group open 0.0.0.0/0 → :22Fix Available
MEDIUMEBS volumes unencrypted · 14 foundFix Available
… scanning IAM, storage, network, compute, logging

Security score61/100 · every point a named finding

380+ Checks
Catalog below
15+ Regions
Auto-discovered
Fix Guides
Console steps + AWS doc
AI Commentary
On every finding

Refine's Security Findings page: 8 critical, 73 high, 200 medium and 21 low findings, with each finding naming the resource, the region and a fix — 302 findings on one account — 8 critical, 73 high, 200 medium, 21 low — as Refine found them, not a tidied example. Every row names the resource and region; 'Fix available' means Refine has a remediation guide for it, with console steps and the AWS doc — the change itself stays yours to make. Filter by severity, category, region or resource type.

The 380+ Checks Catalog

Five categories × four severities. A sample of representative checks per cell — the full catalog ships with the product.

CriticalHighMediumLow

Critical

High

Medium

Low

IAM

Root account has active access keys
Root account MFA disabled

Access key unused >90 days
Privileged role without MFA
Access keys older than 180 days

User attached inline policies
Password policy weaker than recommended
Unused IAM user (>90 days inactive)

IAM Access Analyzer disabled in region
User without MFA but inactive

Storage

S3 bucket public via ACL
S3 bucket public via policy
RDS instance publicly accessible

Unencrypted EBS volume
S3 versioning disabled
RDS backup retention < 7 days
KMS key rotation disabled

S3 lifecycle policy missing
S3 server access logging disabled
RDS deletion protection off

S3 bucket without Object Lock
EBS snapshot older than 365 days

Network

Security group allows 0.0.0.0/0 on SSH (22)
Security group allows 0.0.0.0/0 on RDP (3389)

Public ALB without WAF attached
NACL allows all inbound traffic
Security group allows DB port from internet
VPC peering with permissive rules

VPC flow logs disabled
Default security group used in production
Unused Elastic IP

ALB without HTTP → HTTPS redirect
Idle ELB (no targets attached)

Compute

EC2 with public IP + open SSH
Lambda execution role with admin policy

EC2 IMDSv2 not enforced
ECS task definition with privileged mode
Lambda in VPC with misconfigured subnets

EC2 detailed monitoring disabled
Lambda function using a deprecated runtime
Launch template using deprecated AMI

EC2 instance tagging incomplete
Lambda concurrency limit unset

Logging

CloudTrail disabled in region
CloudTrail log file validation off
GuardDuty disabled in region

AWS Config not recording
CloudTrail not multi-region
GuardDuty findings without routing

CloudWatch alarm without action
CloudWatch Logs without KMS encryption
Config rule failure rate high

VPC flow logs only in CloudWatch (no S3)
CloudTrail S3 bucket without MFA delete

"Fix Available" — the steps, not a ticket

A finding that tells you something is wrong and stops there is a to-do, not a fix. Where Refine holds a vetted remediation for a check, the finding carries a Fix Available badge and opens the numbered AWS Console steps that close it — for that resource, in that region.

Numbered AWS Console steps, in order, with the official AWS documentation linked at the end
Scoped to the finding: the resource ID, resource type and region are on the row you are reading
Where the scan returns its own remediation, those steps are shown instead of the curated guide
Your IAM role stays read-only. Refine never writes to your AWS account — you apply the change, and you can revoke access at any time

Findings we hold no guide for say so plainly rather than showing an empty panel.

Example finding

Block Public Access to S3 Bucket

acme-prod-logs · s3 · us-east-1

High

How to Fix This (AWS Console Steps)

1.Open AWS Console and navigate to S3 service
2.Find and click on the bucket name from the list
3.Click on "Permissions" tab
4.Scroll to "Block public access (bucket settings)" section

…5 more steps

View Official AWS Documentation

Multi-Region Coverage

Refine auto-discovers active regions in each connected account and scans them. Findings are tagged with the region so multi-region orgs can route by ownership.

us-east-1

N. Virginia

us-east-2

Ohio

us-west-1

N. California

us-west-2

Oregon

ca-central-1

Central Canada

eu-central-1

Frankfurt

eu-west-1

Ireland

eu-west-2

London

eu-north-1

Stockholm

ap-south-1

Mumbai

ap-south-2

Hyderabad

ap-southeast-1

Singapore

ap-southeast-2

Sydney

ap-northeast-1

Tokyo

ap-northeast-2

Seoul

sa-east-1

São Paulo

global

Global services

Security Score

A single 0–100 number that tracks posture trend. Same calibration as the Optimization Score next to it.

Inputs:: All active findings, weighted by severity.
Weighting:: Critical 8× · High 4× · Medium 2× · Low 1×.
Trend:: 30-day rolling window with daily snapshots so you see whether posture is improving or eroding.
Filter:: Mute checks you have explicitly accepted (e.g. legacy systems); score recomputes without them.

Example

82/ 100

+4 in 30 days. Driven by closing 3 Critical IAM findings and enabling EBS encryption defaults org-wide.

How we compare

Refine vs. The Alternatives

Honest assessment — Wiz and Prisma are deep CNAPP products, and Security Hub can apply fixes we deliberately cannot. Refine is an AWS-native pairing of security and cost with a free tier and flat paid plans. Different jobs, different prices. Pick the one that fits.

Capability	RefineYou are here Cost + security, one product	AWS Security Hub AWS-native	Wiz CNAPP, multi-cloud	Prisma Cloud CNAPP, multi-cloud
Pricing
Price	Free tier · $100–$200/mo paid plans	Free for findings, paid integrations	No free tier	No free tier
AWS-native (no agents)	Included	Included	Hybrid	Hybrid
Coverage
Multi-cloud (Azure, GCP)	Not included	Not included	Included	Included
Cost optimization in same product	Included	Not included	Not included	Not included
AI narrative reports	Included	Not included	Partial	Partial
Findings
Severity-tiered findings	Included	Included	Included	Included
Remediation What the product does once a finding is raised.	Guided — Console steps + AWS doc	Automated via SSM runbooks	Workflow-based	Workflow-based
Org model
MSP / multi-customer hierarchy	Included	Org accounts	Enterprise tier	Enterprise tier
Operations
Setup time	60 seconds	Minutes	Hours-days	Hours-days

Frequently Asked Questions

A combination of AWS-best-practice checks (Well-Architected Framework, AWS Foundational Security Best Practices), CIS Benchmarks, and Refine-curated checks we've seen catch real issues across customer engagements.
No, and it could not. The IAM role you grant is strictly read-only — Billing, SecurityAudit, read access to your export bucket, one Savings Plans read and one CloudWatch metrics read. "Fix Available" means Refine holds a vetted remediation for that check and will show you the numbered AWS Console steps plus the official AWS documentation. You make the change in your own account, on your own schedule.
Security Hub is excellent and free for findings, and its SSM runbooks can apply a fix for you — Refine cannot, and does not ask for the write access that would let it. What Refine adds is cost optimization in the same product, AI narrative reports, a customer hierarchy for MSPs, and a vetted remediation guide attached to the finding. We are complements more than substitutes — many customers run both.

Find the security risks already in your AWS account

60-second setup. Free under $2,000/month of AWS spend. Read-only access.

Connect AWS Account Upload My AWS Bill

Refine is built and supported by HabileLabs, an AWS Advanced Tier Services Partner.