Search for exposed Elasticsearch clusters, Redis instances, or RDS instances that may be accessible due to overly permissive security groups. - Check for CloudFront misconfigurations that bypass origin access controls. - Look for S3 buckets used for data exports that may contain merchant or customer