Cloud security assessment
Configuration review and attack-path testing across AWS, Azure and Google Cloud, from a leaked key or a compromised workload to your crown jewels.
- Typical length
- 5–8 testing days
- Approach
- Read-only audit role plus assumed breach
- Price
- Quoted after scoping
What we test
- IAM privilege escalation paths
- Public storage and snapshots
- Kubernetes and container escape
- Secrets in code and pipelines
- Logging and detection gaps
Standards we follow
- CIS Benchmarks for AWS, Azure and Google Cloud
- Cloud provider security best practices
- MITRE ATT&CK for Cloud
- CVSS 3.1 scoring
Issues we often find
Typical findings from this kind of test, written the way they appear in our reports.
- A developer role can escalate itself to administrator
- Storage buckets or snapshots are readable from the internet
- Long-lived access keys are committed in code or CI logs
- Critical actions are not logged or alerted on
What we need from you
We send this checklist at kickoff so testing starts on day one.
- A read-only audit role in each account or subscription
- List of accounts, projects and regions in scope
- Permission to test from an assumed-breach starting point
- Contact for the platform or DevOps team
How the engagement runs
Scope
We agree on targets, test accounts, rules of engagement and testing windows. You get a fixed quote.
Recon
We map your attack surface: hosts, routes, roles, third-party services and data flows.
Exploit
Testers chain weaknesses the way a real attacker would and confirm impact without harming production.
Report
Findings are rated with CVSS 3.1, with proof, business impact and a clear fix for each one.
Retest
Once you have fixed an issue, we verify it and update its status in the report.
Attest
We issue a signed letter of attestation you can share with customers and auditors.
Get a fixed quote
Tell us what is in scope and we send a fixed quote, usually within one business day.