Cloud Security Assessment for AWS, Azure & GCP.

A posture assessment reviews how your cloud accounts are configured: identities and permissions, data protection, network exposure, logging and monitoring. We compare that configuration with the provider's security best practices and with the CIS Benchmarks. A cloud penetration test attacks what you have deployed, the way an outside attacker or a compromised user would, to prove which weaknesses are exploitable in practice. The two work well together: the review finds misconfigurations across the whole account, and the test shows which of them an attacker can really use.

Amazon Web Services, Microsoft Azure and Google Cloud, across IaaS, PaaS and SaaS services. We also assess containerized workloads and the platforms that run them, such as Docker, Kubernetes and OpenShift, including each provider's managed Kubernetes service. When your applications run in the cloud, the cloud review can be combined with an application security assessment of the applications themselves.

For cloud security, the team holds AWS Certified Security Specialty, CCSK (the Cloud Security Alliance certificate, not tied to any provider) and CCSE (container and Kubernetes security). The full list, which also covers penetration testing and secure development, is on our About page.

In most cases no prior approval is needed, but each provider sets its own rules. AWS lets customers test a list of permitted services without approval, forbids activities such as denial-of-service testing and requires prior approval for any test involving command and control. Microsoft requires neither pre-approval nor notification for Azure, but limits testing to your own tenant, or to assets you are explicitly authorized to test, and prohibits denial-of-service. Google does not need to be notified, as long as the test only affects your own projects and respects its Acceptable Use Policy and Terms of Service. We plan every test within these rules, on resources you own and authorize.

Read-only access is enough. You set up a dedicated user or role with read-only and security audit permissions, for example the SecurityAudit managed policy on AWS; the Reader and Security Reader roles on your Azure subscriptions, plus a read-only directory role in Microsoft Entra ID such as Global Reader; or the Viewer and Security Reviewer roles on Google Cloud. The review does not change anything in your environment, and you can revoke access as soon as it ends.

Yes, that is what Cloud Security by Design is for. We review the planned architecture and the infrastructure-as-code templates (for example Terraform, CloudFormation or Bicep) before they are deployed, so misconfigurations are fixed before they reach production. It is also the right moment to decide how identities, network segmentation, encryption and logging will work, instead of retrofitting them later.

A report written and signed off by the specialists who did the work: an executive summary, then the findings ranked by risk, each with the affected resources and the steps to fix it. Where it helps, we map the findings to the requirements you need to meet, such as ISO/IEC 27001 or NIS2. We go through the results with your team, support them through remediation and retest to check that each issue is closed.