Automating security and compliance for hybrid environments