Prowler May 2026 Newsletter

This is a republishing of our monthly newsletter.

Hi everyone 👋

It's been a busy spring at Prowler HQ — we've shipped a steady stream of improvements: a brand-new Alerts system, an official GitHub Action plus CI/CD pipeline scanning, a new Vercel provider, deeper coverage for GenAI and identity, a much faster triage experience, and a new compliance framework. And we're hitting the road this summer — fwd:cloudsec, AWS Summit Madrid, and AWS Summit NYC. Come say hi!

Here's what's new in Prowler 👇

🔔 Introducing Alerts

Stop checking the dashboard — let Prowler tell you

Prowler now pushes critical findings straight to the people who need to know. Organization owners get an auto-provisioned daily digest of critical findings out of the box, and admins can build custom alert rules scoped by provider, account, severity, and status — routed to specific users, with one-click unsubscribe. Detection only matters if someone acts on it, and Alerts close that loop.

🏢 New Provider: Vercel

Prowler now supports Vercel. Connect your Vercel teams with an API token and audit deployments, domains, projects, and team settings, with 26 security checks out of the box.

👉 Explore Vercel checks →

⚙️ Official GitHub Action + CI/CD Pipeline Scanning

Prowler's GitHub Action is now officially published — drop it into any workflow and findings flow straight into GitHub Code Scanning as SARIF, with an optional push to Prowler Cloud. Two more pieces complete the shift-left story:

• GitHub Actions workflow scanning, powered by zizmor, flags OWASP Top 10 CI/CD risks — script injection, untrusted checkouts, and other supply-chain footguns — before they ship.
• IaC scanning now emits SARIF, so Terraform, CloudFormation, and Kubernetes misconfigurations get annotated right on the pull request.

The cheapest misconfiguration to fix is the one that never gets merged — this brings Prowler all the way into the developer's pull request.

👉 Get the GitHub Action →

🤖 Securing the AI Stack: AWS Bedrock + Google Workspace

As teams wire GenAI into production, Prowler is keeping pace:

• AWS Bedrock hardening — guardrails configured, prompt management in place, CMK encryption, no Bedrock full-access policies, stale IAM access to Bedrock flagged, and VPC endpoints enforced.
• Google Workspace (Gmail) — new CIS-aligned checks covering attachment safety, spoofing and phishing protection, link safety, delegation, and access controls, via the Cloud Identity Policy API.

GenAI services and collaboration suites are part of your attack surface now — and most teams have no guardrails on them. These give you a baseline on day one.

👉 Explore the checks on Prowler Hub →

🔐 Tighter Microsoft 365 Identity Coverage

Five new Entra Conditional Access checks — policies covering all apps and users, MFA for guests, blocking unknown/unmanaged devices, sign-in frequency enforcement, and excluding the directory sync account — plus new Intune device-compliance and Exchange mailbox resiliency checks. Identity is the perimeter now, and Conditional Access gaps are exactly where attackers walk in.

📋 New Compliance Framework: ASD Essential Eight (AWS)

The Australian Signals Directorate's Essential Eight Maturity Model is now a first-class framework for AWS — map your AWS posture to Essential Eight maturity levels out of the box. It's a hard requirement for Australian government and a widely adopted baseline across APAC, so it's one more framework you don't have to build and maintain yourself.

🔎 A Faster Path from Finding → Fix

We rebuilt the parts of the product you spend the most time in:

• Finding detail drawer redesign — remediation gets its own tab, the status verdict sits up top, resource context is front and center, and carousel navigation shows status instantly while the full record loads.
• Resources side drawer — metadata, findings, and event timelines now live in one drawer, so you investigate without losing your place.
• Attack Paths polish — finding details open inline over the graph (your zoom and filters stay put), with clearer scan selection.
• Compliance page redesign — client-side framework search, streamlined scan selectors, cleaner cards, and downloadable CIS Benchmark PDFs for the latest variant of each provider.

Triage speed is the whole game. Every click we remove between spotting a problem and fixing it is time back for your team.

✨ Also worth a look

• Syntax highlighting on remediation code blocks, with provider-aware detection for Shell, HCL, YAML, and Bicep
• Exclude specific AWS regions via --excluded-region, environment variables, or config files
• Remediation links now point to authoritative sources (CVE.org, Prowler Hub, GitHub Security Advisories) instead of third-party mirrors
• ThreatScore pillars render in canonical order, are clickable, and always show in full
• Imported OCSF scans generate downloadable reports that match CLI scan outputs

🚀 Try It Free on Prowler Cloud

📍 Meet Prowler at Upcoming Events

This summer we're at three events across the US and Europe — come for a live demo, talk multi-cloud security, and grab some swag.

fwd:cloudsec North America 2026

June 1–2, 2026 · Meydenbauer Center, Bellevue (Seattle area), WA

Prowler is a sponsor of the cloud security community's favorite gathering. Find the team there to talk attack paths, multi-cloud coverage, and what's next on the roadmap.

👉 Learn more →

AWS Summit Madrid 2026 — Booth B15

June 4, 2026 · IFEMA Madrid

Visit us at Booth B15 for live demos of Prowler Cloud and a look at how teams secure AWS — and everything else — from one place.

👉 Learn more →

AWS Summit NYC 2026 — Booth 453

June 17, 2026 · Javits Center, New York

Stop by Booth 453 to see Prowler in action — including the new GitHub Action, Alerts, and GenAI coverage.

👉 Learn more →

⚡ That's a Wrap

Thanks for being part of the growing Prowler community.

Stay secure — and come find us this summer!
- The Prowler Team