✓ Human-authored analysis; AI used for formatting and proofreading.
On July 29, 2019, Capital One disclosed that an attacker had exfiltrated over 100 million customer records from their AWS environment. The total cost including regulatory fines, class action settlement, remediation exceeded $300 million.
The breach required three conditions to be true simultaneously. An EC2 instance had IMDSv1 enabled, allowing the SSRF exploit to retrieve instance credentials from the metadata service. That instance had a public IP, making it reachable from the internet. The IAM role attached to the instance had permissions reaching sensitive data across S3 buckets containing customer records.
Each condition alone was a posture concern. Together, they were a catastrophe.
The question no cloud security tool in the market answers today: the day before the breach, when two of those three conditions were true and the third was about to become true, did anyone know?
What the market shows you
The current generation of cloud security platforms such as Wiz, Orca, Palo Alto Prisma, and others converged on the same concept: compound findings. Wiz calls them toxic combinations. Orca calls them attack paths. The terminology varies but the logic is identical: scan the environment, build a graph of resources, identities, network paths, and vulnerabilities, then surface the intersections where all conditions for an exploit are simultaneously present.
This is valuable. It collapses thousands of low-signal individual findings into a handful of high-signal compound ones. Wiz claims it surfaces only the roughly 1% of issues that can lead to a breach. That's the right question to ask about what's exploitable now.
But it's the wrong question to ask about what's exploitable next.
Every one of these tools answers the present tense: what is broken? None of them answer the conditional: what would break if one thing changed?
The gap is structural
This is a capability their architecture can't express.
A toxic combination fires when all conditions are met. That's a conjunction: A AND B AND C. The tool evaluates the conjunction against the current state. If all three are true, it reports a finding. If any one is false, the conjunction fails, no finding is emitted, and the graph shows nothing.
The near-miss where two of three conditions true, the third one control failure away from completing the path, is invisible. Structurally absent from the output. The tool has no representation for "this compound finding would fire if one of its dependencies changed." It has findings and it has absence of findings. The space between the findings that haven't fired yet doesn't exist in the data model.
This makes the gap structural. Adding near-miss detection to a tool that only evaluates conjunctions against current state is not a feature request. It requires the tool to reason about states that don't exist — to ask "what if this control that's currently passing started failing?" and trace the downstream consequences through the compound finding graph.
One away
Define the distance between a current state and a known-bad incident shape as the number of controls that would need to change from passing to failing for the compound finding to fire.
At distance zero, all controls are failing, the compound finding is active, and you have the current generation of tools telling you about it. At distance one, all controls except one are failing. The compound finding is not active. No tool reports it. But a single configuration change such as an S3 bucket policy updated, a security group rule added, a new IAM policy attached will make the finding fire.
The Capital One breach required three conditions to be true simultaneously. At some point before the breach, only two were true and the third hadn't been introduced yet or all three were true for months and nobody noticed. We don't know. That's the problem. No tool was tracking the distance.
Every catastrophic cloud security incident was at distance zero when it was exploited. Before that, it was at distance one or distance n. The configuration drifted toward zero one change at a time. Nobody tracked the distance. Nobody knew when it crossed from one to zero. The breach was discoverable before it was exploitable. The exploitability was discoverable before it was exploited. Neither was discovered.
The specific thing a "one away" finding tells you that a current-state finding cannot:
Which gate is holding. Not just "you're close to a bad state" but specifically which control is the last barrier between your current posture and a named incident shape. "Your environment matches the Capital One breach pattern in two of three dimensions. The gate that's holding is IMDSv2 enforcement on instance i-0abc123. If that gate fails through a launch template change, an AMI swap, or a new instance launched without the constraint, the full breach pattern activates."
The consequence of the gate failing. Not "a misconfiguration was introduced" but "a misconfiguration was introduced that completes an attack path to 85 sensitive S3 resources containing customer PII, matching the exact pattern that cost Capital One $300 million."
The dollar-denominated precedent. When the near-miss finding names a known incident shape such as Capital One, SolarWinds, the Uber 2022 breach, the business consequence isn't hypothetical. It happened. There's a dollar figure and a regulatory outcome. The finding isn't "you have a problem." It's "you are one change away from someone else's $300 million problem, and here is the SEC filing that proves it."
Why this matters more than what's currently broken
An active compound finding with distance zero is already being exploited or is immediately exploitable. It's urgent. But it's also, in most organizations, already visible to someone. The SOC sees the alert. The CSPM dashboard shows the critical. The incident response process activates.
A distance-one finding is invisible to every tool in the pipeline. No alert fires. No dashboard shows critical. No incident response activates. The CISO's report to the board says "no critical compound findings." The insurance underwriter's questionnaire gets answered "no known exploitable attack paths." Both statements are true today and false tomorrow, and nobody knows.
This is the asymmetry that makes "one away" findings more valuable per finding than active findings: active findings are visible to multiple systems and processes. One-away findings are visible to nothing.
The insurance underwriter's question
The Wall Street Journal reported in July 2026 that cyber-insurance underwriters are shifting from "what controls do you have" to "how fast do you fix it". The remediation tempo as the underwriting metric. That's a step in the right direction, but it still assumes you know what needs fixing.
One-away findings change the underwriting question again. The question isn't "how fast do you fix known issues." It's "do you know which changes would create catastrophic issues before those changes are made?"
An organization that can show "we monitor distance-one findings against named incident shapes and no configuration change can complete a catastrophic attack path without triggering a pre-deployment gate" is a categorically different insurance risk than one that discovers the attack path after it's exploited. The first organization is managing risk. The second is discovering risk. The premium difference should be substantial, and underwriters who can distinguish the two will price more accurately.
The M&A diligence application
In acquisition due diligence, the standard cloud security assessment answers "what is broken in the target's environment right now?" That's distance-zero analysis. It finds the active findings, prices the remediation, and adjusts the offer.
One-away analysis answers a harder question: "how fragile is the target's security posture?" An environment with zero active compound findings and fifty distance-one findings is a different acquisition risk than one with zero active findings and zero distance-one findings. The first environment is one developer's Friday afternoon IAM policy change away from a breach. The second has structural depth.
No due diligence product on the market today makes this distinction. The acquirer sees "no critical findings" in both cases and pays the same price. The acquirer who can see the distance-one findings has a pricing advantage that compounds with every deal.
Requirements for implementation
The first requirement is a catalog of named incident shapes such as compound findings with known precedents. The Capital One shape (SSRF + IMDSv1 + over-permissioned role) is one. The SolarWinds shape (supply chain compromise + lateral movement + detection evasion) is another. Each shape is a conjunction of specific controls that, when all failing simultaneously, reproduce a known breach pattern.
The second requirement is the ability to evaluate the conjunction partially to determine that N-1 of N controls are failing and identify which one is holding. The structural gap is that the current tools evaluate the full conjunction and emit a finding or nothing. Partial evaluation requires the tool to track per-control state within a compound finding even when the compound finding itself is inactive.
The third requirement, and the hardest one, is implicit dependency resolution. Some of the controls in a compound finding depend on upstream computations such as a sensitivity classifier that tags resources, a reachability engine that traces role assumption chains, a network topology analyzer that determines connectivity. If any of these upstream computations hasn't run or produced incomplete output, a control might pass because the verification didn't execute. A one-away finding that accounts for implicit dependencies can distinguish "this gate is holding because the control is satisfied" from "this gate is holding because the data it needs wasn't available." The second case is not a gate at all. It's a blind spot wearing a gate's uniform.
The limitations
Not everything is one-away-able. Application-layer vulnerabilities such as the SSRF in Capital One's case live in code, not in configuration. A configuration verifier can see that IMDSv1 is enabled and the role is over-permissioned, but it can't see that the application running on the instance is vulnerable to SSRF. The one-away finding correctly identifies the configuration surface that enables the breach, and defers the application-layer question to other tools.
The catalog of named incident shapes is necessarily backward-looking. It captures patterns from known breaches. The next breach may use a pattern nobody has cataloged. One-away findings reduce the risk from known patterns to near zero but don't claim coverage of unknown ones. That's defense in depth, not omniscience.
Distance-one is a threshold, not a guarantee. An environment with no distance-one findings against named shapes might have a distance-two finding that becomes distance-zero through two simultaneous changes. The analysis could be extended to distance-two and beyond, but the combinatorial explosion makes the results harder to act on. Distance-one is the sweet spot: actionable, specific, and directly mappable to a named consequence.
The question your tool should answer
Next time your cloud security platform reports "no critical findings," ask:
How many named incident shapes are currently at distance one where a single control change would activate the finding?
If the answer is "we don't track that," you are managing your security posture the same way Capital One was managing theirs on July 28, 2019: no critical findings, no alerts, no idea that a single change would cost $300 million.
The finding that hasn't fired yet is the one that matters most. And right now, nobody is showing it to you.
