We planted 34 flaws in Azure and ran three scanners. Here's what each one caught.

We maintain a small Azure "flaw lab": a Terraform estate where every resource is deliberately misconfigured in one known way. Last week we used it to compare three free, read-only tools on the same 34 planted flaws:

- **Azure Advisor**, built into every subscription
- **Azure Quick Review (azqr)**, Microsoft's open-source scanner
- **Skyveda Scan**, our open-source scanner

To be upfront: it's our lab, built to test our own checks, so treat it as one data point, not a benchmark.

### The results

| Tool | Planted flaws caught |
|---|---|
| Skyveda Scan | 34 / 34 |
| azqr | 15, plus 4 partly ("use private endpoints") |
| Azure Advisor | 0, but Advisor refreshes about once a day, so it wasn't a fair fight |

**What azqr missed:**
- SSH open to the Internet
- database ports open to the Internet
- an Azure SQL firewall rule allowing the whole Internet
- anonymous blob access
- storage shared-key access
- Key Vault network access
- web apps allowing TLS below 1.2 or CORS from any origin

These are the findings that tend to fail a customer's security questionnaire.

**What azqr did better.** It reported 64 kinds of issue, against our 60 checks. It covered things we don't check yet: diagnostic settings, zone redundancy, backups and soft delete. Those are now on our backlog. If you run Azure, run azqr too; it's good.

### Finding is the easy part

The new thing in 0.4 is `skyveda fixes`. It turns findings into a ranked plan and **one script per resource**, with:
- the risk and expected downtime
- what to check before you start
- a rollback and a verify step
- every command **commented out**, so a person has to read and enable each one. The tool itself never changes anything.

We applied the generated fix for the SSH rule in the lab and rescanned: the check went from **fail to pass**.

### Also in 0.4

Every check now maps to the **Microsoft cloud security benchmark** and the **Azure Well-Architected Framework**. The report shows a pass/fail summary per control and per pillar. (It's a mapping, not a certification.)

Code (Apache 2.0): https://github.com/skyvedahq/skyveda

Which checks should we add next? Tell us in the comments.

*Microsoft and Azure are trademarks of the Microsoft group of companies. Skyveda is not affiliated with or endorsed by Microsoft.*