Compares your Terraform/Bicep declarations against live cloud state. Three kinds: declared-but-not-live, live-but-not-declared, and attribute drift (tags removed, exposure flipped, criticality changed).
IaC declares it but the cloud doesn't show it — applied yet? deleted manually?
Live resource has no IaC declaration — rogue creation or shadow IT.
Both sides exist but tags / exposure / criticality differ.
Live state matches the declared IaC. The detector compared every resource and found nothing.