Update proposal levers with Prowler benchmark findings

Expand the levers table from 5 to 8 workstreams, grounding each driver in
verified counts from the Prowler run:

- Add backup & resilience (0 of 9 EBS volumes have snapshots or a backup plan)
- Add secrets & key management (19 secrets without rotation or resource policy,
  2 KMS keys without auto-rotation, unencrypted log groups)
- Add compliance acceleration (363 failures; SOC 2 at 81% against existing
  Secureframe program)
- Note Config alongside GuardDuty and Security Hub in the delegated-admin gap
- Add the two criticals and hardware-MFA gaps to identity hardening
- Add internet-facing instances with instance profiles and IMDSv2 to exposure
- Order by priority and add a framing note

findings/discovery_dashboard.html

@@ -278,19 +278,23 @@
 
   <!-- ROADMAP -->
   <section>
-    <div class="sec-head"><span class="tag">→</span><h2>Proposal levers</h2><span class="note">where we create value</span></div>
+    <div class="sec-head"><span class="tag">&rarr;</span><h2>Proposal levers</h2><span class="note">where we create value &middot; ordered by priority</span></div>
     <div class="tbl-wrap">
       <table>
         <thead><tr><th>Workstream</th><th>Driver from discovery</th><th>Outcome</th></tr></thead>
         <tbody>
-          <tr><td><b>Landing zone &amp; account separation</b></td><td>Workloads in mgmt acct; flat org; empty Lazka</td><td>Move workloads to a dedicated account; OUs + SCP guardrails</td></tr>
-          <tr><td><b>Delegated security account</b></td><td>No delegated admin; unaddressed GD findings; Lazka dark</td><td>Central GuardDuty/Security Hub admin; org-wide monitoring</td></tr>
-          <tr><td><b>Cost optimization</b></td><td>EC2 = 67% of spend; 4× growth; unattached EBS</td><td>Rightsizing + Savings Plans + cleanup → recurring savings</td></tr>
-          <tr><td><b>Identity hardening</b></td><td>Stale admin keys; 2 users w/o MFA</td><td>Rotate/retire keys, enforce MFA, move to short-lived roles/SSO</td></tr>
-          <tr><td><b>Exposure reduction</b></td><td>13 internet-open SGs</td><td>Least-privilege ingress; WAF already in place to leverage</td></tr>
+          <tr><td><b>Landing zone &amp; account separation</b></td><td>Workloads in mgmt acct; flat org, no OUs; empty Lazka; SCP region-deny absent</td><td>Dedicated workload account; OUs + SCP guardrails (region deny, root protection)</td></tr>
+          <tr><td><b>Delegated security account</b></td><td>Zero delegated admins &mdash; GuardDuty, Security Hub <i>and</i> Config all flagged high; 4 open GD high/critical findings; Lazka dark</td><td>Central security account admins all three org-wide; findings get a named owner and triage SLA</td></tr>
+          <tr><td><b>Backup &amp; resilience</b></td><td><b>0 of 9 EBS volumes</b> have snapshots or a backup plan (18 high/medium failures)</td><td>AWS Backup plans, tested restores, RPO/RTO defined &mdash; today a volume loss is unrecoverable</td></tr>
+          <tr><td><b>Identity hardening</b></td><td>Admin keys 322 &amp; 319 days; 5 keys &gt;90d; 6 users on static creds; 9 users + root without hardware MFA; <code>AdministratorAccess</code> attached (<code>*:*</code>)</td><td>IAM Identity Center + short-lived roles; retire static keys, scope admin, hardware MFA on root</td></tr>
+          <tr><td><b>Exposure reduction</b></td><td>13 internet-open SGs; 3 permissive NACLs; 7 public-IP instances; <b>6 internet-facing instances carrying instance profiles</b>; IMDSv2 not enforced account-wide</td><td>Least-privilege ingress, IMDSv2 enforced, ALB/WAF fronting &mdash; closes the credential-theft path</td></tr>
+          <tr><td><b>Secrets &amp; key management</b></td><td>19 secrets with no rotation and no restrictive resource policy; 2 KMS keys without auto-rotation; 19 log groups unencrypted; secrets detected in 7 log groups</td><td>Rotation on every secret, KMS/CMK coverage for logs and SNS, resource policies scoped to consumers</td></tr>
+          <tr><td><b>Cost optimization</b></td><td>$858/mo, +284% Jan&rarr;Jul; EC2 = 67% of spend; 2 unattached EBS + 7 EIPs; orphaned EKS roles from a torn-down cluster</td><td>Rightsizing + Savings Plans + Graviton/spot + cleanup &rarr; recurring savings and a growth-safe baseline</td></tr>
+          <tr><td><b>Compliance acceleration</b></td><td>Prowler: 363 failures (2 critical, 111 high); SOC 2 81%, ISO 27001 77%, CIS 3.0 74%; Secureframe + Intruder already engaged</td><td>Close the SOC 2 gap on evidence they already collect; Security Hub as the standing control monitor</td></tr>
         </tbody>
       </table>
     </div>
+    <p class="sub" style="margin:12px 0 0;font-size:12.5px;">The first three are the fastest to land and the hardest to defend leaving open &mdash; no delegated security owner, no backups, and workloads in the management account are each a single-event risk. Cost optimization is the lever that funds the rest.</p>
   </section>
 
   <footer>