Ours started a sev-1 and pulled my whole team into incident response mode after AWS guard duty told them some account credentials where used outside our VPC. I

Ours started a sev-1 and pulled my whole team into incident response mode after AWS guard duty told them some account credentials where used outside our VPC. It was a member of their team doing a pentest they organized.