# Security & Compliance: Find and Fix > How ZopNight surfaces and acts on Security & Compliance. Findings are measured against real usage; fixes are one-click or guided. Source: https://zop.dev/recommendations/security Published: 2026-07-01 · Author: avinash-gaurav · Tags: zopnight, recommendations, security --- Security & Compliance is one of the recommendation families ZopNight runs continuously. Rather than a static report, each finding is attached to the resource it concerns and to the measured usage behind it, so you act on the largest first and know the number is real before you touch anything. ## How the rules work ZopNight ships 490 built-in audit rules across AWS (216), GCP (127), and Azure (147). Security & Compliance sits inside that catalog, and the engine re-evaluates it on every discovery cycle. A finding only fires when the underlying signal supports it, idle rules read CPU, network, and connection metrics over a rolling window; orphan rules look for resources with no parent; rightsizing compares provisioned capacity to measured utilization. ## From finding to fix Seeing waste is not the same as removing it, which is the whole point of ZopNight. 124 of those recommendations are wired to act end to end, 28 one-click and 96 guided. One-click actions run immediately with an admin-approval gate for non-admin initiators; guided actions add a type-to-confirm review so you check the change before it lands. Everything starts from a read-only connection, production is excluded by default, and every action is logged. For the mechanics on a specific resource, see [AWS EC2 scheduling](https://zop.dev/zopnight/aws/ec2); for the discipline this fits into, see [FinOps](https://zop.dev/learn/finops). ## How ZopNight schedules non-production resources The loop that does this is deliberately mechanical, and it starts read-only. You connect your cloud with a read-only role, and ZopNight discovers every non-production resources across your regions and accounts. It records a per-action permission verdict for each one, so you can see where it can list a resource but not yet stop it, and you review that inventory, filter it by status or type, and search for the specific resources you care about before anything is scheduled. Scheduling itself is a cron you write once in plain terms, stop at 7 PM, start at 8 AM on weekdays, pinned to your timezone so the jobs fire at local business hours rather than UTC. A weekly 24-hour grid shows the schedule visually so you catch gaps and overlaps before you save, and an estimate of active versus inactive hours appears before you commit. Resources attach individually or bundle into groups like "dev-cluster" or "staging-db" so a whole environment follows one cadence. Actions run in dependency order, so a database comes up before the app server that depends on it. When something needs to stay up, an override forces a non-production resources ON or OFF for a defined window, carries a reason so teammates understand why it exists, and expires automatically so nothing is left running by accident. If a start or stop fails, ZopNight retries up to three times and falls back to a dead-letter queue rather than silently dropping the action, and every state change lands in an audit trail that records whether a schedule, an override, or a specific user triggered it. ## Getting started Getting started is intentionally low-stakes: - Connect your cloud with a read-only role. Nothing is scheduled or changed at this stage. - Let ZopNight discover your non-production resources and review exactly what it found, filtered by account, region, and status. - Create a schedule in your timezone and attach the non-production resources or groups you want it to cover. - Watch the first cycle run, with Slack, Teams, or Google Chat notifications on every start, stop, and failure, then layer in idle cleanup and guided rightsizing. Production stays excluded by default throughout, and because discovery and recommendations are read-only, you can prove the value before you enable a single action. ## Frequently asked questions ### Are these findings safe to act on? Yes. Each is measured against real usage, production is excluded by default, and fixes are either one-click with an approval gate or guided with a review step. ### How many rules does ZopNight run? 490 built-in audit rules across AWS (216), GCP (127), and Azure (147), and 124 of those recommendations are wired to act end to end, 28 one-click and 96 guided.