We test your AWS, Azure or GCP environment for the mistakes attackers look for first: identities with more access than they need, data left open to the internet and settings that differ from what your team intended.
We review the configuration through read-only access and, where you agree, test whether the weaknesses we find can be exploited. If you run Kubernetes, we cover your clusters too.
IAM users, roles and policies, and the paths by which one identity could gain another's permissions.
Services, storage, databases and snapshots that anyone on the internet can reach.
Who can read and write your storage buckets and databases, and whether the data in them is encrypted.
Security groups, firewall rules and network peering that allow more traffic than your systems need.
Whether activity logs are switched on and kept, and whether an attack would raise an alert that someone sees.
Keys and passwords in code, templates and environment variables, and the security of your Kubernetes clusters where you run them.
Each finding comes with the evidence behind it, a CVSS rating, the business impact and a concrete fix. Where it applies, that includes the requests and responses or the configuration details that show the problem. It's written so you can pass it to an engineer unchanged.
Two pages in plain language on the business impact and the priorities, written for your board or your customer's security team.
A working session with your engineers where we go through the findings, answer questions and agree how to prioritise the fixes. We can record it if you like.
AWS, Azure and GCP let you test your own resources without asking first, as long as you follow their published rules. We follow those rules and check them again during scoping, because they change.
Read-only access to the accounts or subscriptions in scope is enough for the configuration review. If we also test whether weaknesses can be exploited, we agree any extra access with you in writing first.
We agree the scope with you. It often makes sense to review the settings that apply across your organisation and a sample of accounts first, then cover the rest where the risk is highest.
It depends on how many accounts and services are in scope. We give you a fixed timeline once we've agreed the scope.
Book a scoping call, and we'll send you a fixed quote as soon as we've agreed what to test.