Assessments
Cloud Security Review
A read-only cloud security review and configuration audit across AWS, Azure and Google Cloud, identity and access, network exposure, data stores, secrets and logging, with a prioritised, fix-by-fix report.
Scope
- Identity and access management: roles, policies, key and credential hygiene
- Network exposure: public endpoints, security groups, ingress paths
- Data stores: encryption, access policies, backup exposure
- Secrets management and configuration drift
- Logging, monitoring and alerting coverage
Method
Read-only review using scoped credentials you provision, combined with architecture walkthroughs with your team. We do not need, and do not ask for, production admin access.
Deliverable
A prioritised findings list where each item names the affected resource, the risk in context, and the specific configuration change that resolves it.
Approach
How we work
01
Scope
Every engagement starts with a scoping conversation and ends that conversation with a written agreement: your target framework or the systems and environments in scope, what is explicitly out, which accounts and data we will use, and the timeline.
02
Assess
We measure where you stand: a gap assessment against your target framework, a review of controls, policies and risk, and hands-on testing where it matters. The work is manual and methodical, guided by how the system is actually used and what an attacker would actually want from it. Tooling supports the work; it does not replace it.
03
Explain
You receive a written report and a walkthrough call. The executive summary is written for people who were not in the room; each finding carries evidence, reproduction steps, business impact and a concrete fix.
04
Verify
When your team has remediated, we retest the affected findings and issue an updated report stating clearly what is resolved, what is partially resolved and what remains open. For a certification programme, we prepare the evidence and stand beside you through the audit, then help you keep it current.
Frequently asked questions
- Which cloud providers do you review?
- AWS, Azure and Google Cloud, plus the identity, network, data-store, secrets and logging configuration around them. We work from read-only, scoped credentials you provision.
- Do you need production admin access?
- No. The review is read-only using least-privilege credentials, combined with architecture walkthroughs with your team. We do not ask for production admin access.
- Is this the same as a penetration test?
- No, a cloud security review examines configuration and architecture for risky defaults and exposure, rather than actively exploiting a running application. The two are complementary.
Related reading
Other assessments
Engagements are fixed-scope and fixed-price once agreed. If you are not sure which service fits, whether that is certification readiness, GRC advisory or a penetration test, describe your situation and we will recommend a scope, including telling you honestly if you do not need us yet.