Cloud Security & Access Review
Understand what is exposed before somebody else maps it for you.
We look at how access is granted, what is reachable from the internet, where credentials live and what the audit trail would actually show after an incident. Findings are ranked by what an attacker could reach from each one, not by a raw count of warnings.
Tools we work in
- AWS
- Azure
- Google Cloud
- Terraform
- Cloudflare
- Trivy
- 1Password
Scope
What this covers
The specific work included when you engage us for this service.
- Identity review across cloud accounts, including unused and over-privileged roles
- Exposure review of public endpoints, storage, databases and administrative panels
- Secret management review covering where credentials live and how they rotate
- Logging and audit trail check, tested against the question of what would be visible afterwards
- Backup and recovery posture for the data that matters most
- A remediation plan ordered by reachability and impact, with effort stated for each fix
What you receive
- 01A written findings report with severity, the path an attacker would take and the affected data
- 02A prioritised remediation plan separating quick configuration fixes from structural work
- 03A re-test of the items you fix, with the report updated to show what closed
Questions
Cloud Security & Access Review, answered
Is this a penetration test?
No, and we say so plainly rather than letting the words blur. This is a configuration, identity and access review of your cloud estate, which is where the majority of real breaches in small and mid-sized companies begin. A penetration test attempts to break in and is a different engagement with different rules. When one is warranted, we will tell you, and if it is outside what we do we will point you towards specialists who perform it.
Will we be told everything is fine?
Only if it is. There is a commercial temptation to either manufacture severity to justify the engagement or soften findings to keep the relationship comfortable, and both are useless to you. Every finding is stated with the path required to exploit it, so you can judge the risk yourself and disagree with us in writing.
Do we need to give you production access?
Read-only access to the account configuration is usually enough for the review, and we prefer to work that way. Where deeper investigation is required it is scoped and time-boxed. We sign an agreement covering confidentiality and data handling before access is granted, and we remove our own access when the engagement ends.
Most often requested by
Related
More in Cloud, DevOps & Security
Cloud Migration
Move to the cloud without carrying the old problems with you.
Cloud Architecture & Design
Decisions that are cheap now and expensive to reverse later.
Cloud Cost Optimisation
Most cloud bills contain spend that nobody decided to make.
CI/CD & Release Engineering
Deploys that are boring, which is exactly the point.
Tell us where the manual work is
A 30-minute call. We map the process, tell you what we would automate or build first, and what it costs. No retainer before you agree the scope.
- No retainer before scope is agreed
- Written plan you can act on alone
- Worldwide delivery, on your hours