It started with a simple alert that would be easily overlooked—a sudden, unexpected spike in API activity from an IAM role that should have been dormant. No alarms were blaring (yet), and no critical systems had failed, but something felt… off. This is where instincts kick in. This is how a routine security review turned…
