Cloud security
Review how cloud identities, services and data are connected. Scope the assessment around the platforms you use and the access you can provide.
What we examine
Cloud identities
Roles, permissions, service accounts and routes to excessive access.
Data & exposure
Storage configuration, public services and access to sensitive information.
Trust boundaries
Connections between workloads, accounts and external services.
Remediation
Specific configuration guidance and a clear explanation of practical impact.
Configuration and behaviour
A configuration review inspects the permissions and settings available to the tester. A penetration test validates selected attack paths. We agree which approach fits your platform and make that distinction clear in the proposal.
Information needed for a quote
Cloud provider, accounts or subscriptions, environments, services and identity model. Agree read-only review access and separately authorised validation. Include CI/CD connections, workload identities and external trust where relevant.
Evidence included
The affected resource, permission or setting, an applicable misuse path and an actionable change. We state what was inspected and what could not be validated with the access provided.
Scope, test, report.
Then verify the fixes.
Scoping, testing, reporting and verification, with direct access to the tester.
Agree the scope.
Applications, roles, access and deadlines. We agree the scope, fee and deliverables before testing.
Run the assessment.
Test the controls and the workflows around them. Significant findings are communicated during the engagement.
Document the findings.
Reproducible findings, demonstrated impact and practical recommendations for your developers.
Verify remediation.
Discuss remediation and validate agreed fixes. Retesting terms are set out in the proposal.