A client I had been doing cloud architecture for came to me a while ago with a challenge I keep seeing: Their biggest customer was pressing them on security. Questionnaires, evidence, a pentest report. At the same time, their WAF was lighting up with attackers actively probing for a way in.