Most AWS security guidance assumes a team that does not exist in a smaller organization. The frameworks list controls, the auditors ask for evidence, and the person answering is often the same person managing the network, the endpoints, and the ticket queue. The real work is not coverage, it is triage. Which controls get owned properly, which get handed to tooling and checked occasionally, and which quietly never get done at all.

That last category rarely appears in a slide. Most leads have a list of things they have consciously decided not to cover, and few have ever compared that list with a peer.

This session is that comparison. Not a maturity model, not a roadmap, just a candid exchange about where experienced people are drawing the line, what they defend when it gets challenged, and what has gone wrong when the line was drawn in the wrong place.