2. *Drift Detection*: Native capability to detect configuration drift (`--compare-to`).

3. *Auto-Fix*: Generates actionable fix plans (`--fix`) rather than just reporting errors.

4. *Exposure Analysis*: Built-in network exposure assessment.