Cloud security
Your cloud is only as safe as the way it is configured
Assessments for AWS, Azure and Google Cloud that look at identity, exposure and the gap between what your infrastructure allows and what it actually needs.
Team certifications: OSCP+, OSWE, OSEP, eJPT and eWPT.
What we review
Identity and permissions
Who can do what, which roles are wider than they need to be, and where a single key reaches too far.
Storage and data
Buckets, blobs and databases, checked for public access, weak policies and missing encryption.
Network exposure
Security groups, ingress rules and public load balancers that should not be public.
Logging and detection
Whether the events that matter are recorded, and whether anyone would notice them.
What you get
A configuration review with evidence
The exact resource, the setting and the console path to fix it.
Attack paths, not a flat list
How one weak role or exposed bucket chains into something that matters.
Owner and effort per fix
Each item says who owns it and roughly how long the change takes.
A retest
We confirm the setting actually changed and that nothing else broke.
How it runs
01
Scope
We agree what is in scope, what is out, and how to reach the people who can answer questions mid test.
02
Setup and timing
You give us access or a test window. We confirm the window in writing before anything starts.
03
Test
Manual testing, with tooling where it earns its place. Anything we find gets written up as we go.
04
Report and retest
You get the findings, a walkthrough call, and a retest once your team has shipped fixes.
Questions we get asked
What access do you need?
Read only is enough for most of the work. Where a check needs more, we ask and explain why.
Will you change anything in our account?
What happens if you find a secret?
Is this a compliance audit?
Have a cloud account to review?
Tell us which provider and how many accounts, and we will scope the review from there.