Every scanner checks what exists. Nobody checks what's missing

When cloud resources are deleted, the references to them persist — in IAM policies, event triggers, compute configs, and trust relationships. These orphaned references create exploitable gaps that no per-resource scanner can detect. The finding doesn't live on any single resource. It lives in the space between what's referenced and what exists. The assumption every scanner makes Cloud security scanners work by iterating over resources. For each S3 bucket, check its configuration. For each IAM ro