Module SDD-05 — Scout Suite

Scout Suite

The point-in-time multi-cloud auditing baseline: offline HTML reporting, full configuration collection, assessment-artifact delivery.

minutes

artifacts

sub-sections

NCC Group's Scout Suite reads cloud configuration across AWS, Azure, GCP, Alibaba, and OCI, evaluates it against a ruleset, and produces a single self-contained offline HTML report — the assessment artifact you hand a client. The counterpart to Prowler's continuous CSPM: Scout is episodic assessment, Prowler is continuous operations. A mature cloud security program uses both.

Key Claims

Load-Bearing Claims

The offline HTML report is Scout Suite's defining property. Self-contained, no server, viewable years later. Portable, archivable, client-deliverable. No other tool in the roster produces a comparable assessment artifact.

Scout Suite collects full configuration, not just findings. The actual security group rules, IAM policies, bucket configs — giving the auditor context, not just pass/fail. The report is a map of the environment.

Scout Suite and Prowler are complementary, not competitive. Scout is point-in-time assessment (offline report, client deliverable). Prowler is continuous operations (structured findings, CI integration). Run Scout during audits, Prowler between audits.

The offline report's flip side is exfiltration risk. Full cloud configuration in a single, portable file is a prime target. Govern the report file with the same care as the credentials that produced it.

After This Module

Explain Scout Suite's role as a point-in-time assessment tool and distinguish it from Prowler's continuous CSPM.

Map Scout Suite's architecture: per-cloud providers, configuration collector, rules engine, offline HTML report generator.

Defend the offline HTML report as a deliberate design choice and identify what it costs (no continuous monitoring, no API integration).

Score Scout Suite on the 12-module rubric (27/45) as a non-agent tool and explain the comparison to Prowler.

Apply the decision tree: when to reach for Scout vs Prowler vs SDD-06 attack-path tools.

Artifacts

Teaching Document

~3,000 words; 6-phase study of Scout Suite as the point-in-time assessment baseline — offline HTML report, full config collection, scored 27/45, with the Scout vs Prowler comparison and the cloud tool decision tree

READ

Diagrams

4 diagrams — assessment architecture, Scout vs Prowler, the offline HTML report property, the tool decision tree

READ

Slide Deck

reveal.js slide deck, dark theme, design-system teal

READ

Teaching Script

Verbatim teaching transcript, [SLIDE N] cues

READ

Flashcards

12 Anki flashcards covering the offline report, full config collection, Scout vs Prowler, the exfiltration risk, scoring, and the decision tree

TEST

Exam

Exam bank, Bloom-distributed

TEST

Lab Spec

Hands-on lab specification

Module Web Page

Single-file HTML hub

HERE