diff --git a/.github/workflows/tf-unit-tests.yml b/.github/workflows/tf-unit-tests.yml
index e22bf51..13fccb7 100644
--- a/.github/workflows/tf-unit-tests.yml
+++ b/.github/workflows/tf-unit-tests.yml
@@ -35,12 +35,11 @@ jobs:
       uses: bridgecrewio/checkov-action@master
       with: 
         framework: terraform
-        output_format: sarif 
-        output_file_path: checkov.sarif
-    
+            
     # Upload results to GitHub Advanced Security
     - name: Upload SARIF file
+      if: success() || failure()
       uses: github/codeql-action/upload-sarif@v2
       with:
-        sarif_file: checkov.sarif
+        sarif_file: results.sarif
         category: checkov
diff --git a/main.tf b/main.tf
index 22ae8df..5204f61 100644
--- a/main.tf
+++ b/main.tf
@@ -26,3 +26,22 @@ resource "azurerm_resource_group" "rg-aks" {
   name     = var.resource_group_name
   location = var.location
 }
+
+# Sample NSG designed to raise a security alert. Delete for any real deployment.
+resource "azurerm_network_security_group" "nsg-fail" {
+  name                = "insecureNSG"
+  location            = azurerm_resource_group.rg-aks.location
+  resource_group_name = azurerm_resource_group.rg-aks.name
+
+  security_rule {
+    name                       = "badrule"
+    priority                   = 100
+    direction                  = "Inbound"
+    access                     = "Allow"
+    protocol                   = "*"
+    source_port_range          = "*"
+    destination_port_range     = "*"
+    source_address_prefix      = "*"
+    destination_address_prefix = "*"
+  }
+}