Custom assessments to protect your cloud environments from cyber threats

If your business utilises cloud services and applications to support day-to-day operations, security is of paramount importance and should include a robust security assessment program.

What is cloud penetration testing?

Cloud penetration testing is a form of security assessment conducted on an environment hosted by a cloud service provider such as Amazon’s AWS or Microsoft Azure. Cloud pen testing is designed to gauge the effectiveness of security controls and identify, safely exploit and help to remediate vulnerabilities before they are compromised by malicious adversaries.

Configuration review or penetration test — which do you need?

These are different exercises, and buying the wrong one is a common and expensive mistake.

A configuration review compares your environment against a known-good baseline — CIS benchmarks and the provider’s own guidance — and reports where it diverges. It is thorough, it is systematic, and it finds the issues that cause the overwhelming majority of real cloud breaches. It does not involve exploitation.

A cloud penetration test actively attempts to exploit what it finds and chain issues together to demonstrate impact — proving that an over-permissive role can actually be used to reach production data rather than simply noting that it exists.

For most organisations, the configuration review is the right first purchase. Cloud environments rarely fail because someone defeated a security control. They fail because a control was never configured in the first place.

What a cloud configuration review checks

We assess your environment against CIS benchmarks and provider hardening guidance across five areas.

Identity and access

The most common source of serious findings. We review privileged role assignment, whether multi-factor authentication is genuinely enforced rather than merely available, conditional access policy coverage and its gaps, dormant accounts that retain access, service principals and their permission scope, guest and external user access, and whether the principle of least privilege survives contact with how people actually work.

Data exposure

Publicly accessible storage buckets and containers, sharing links that have outlived their purpose, anonymous access settings, encryption at rest and in transit, retention and deletion policy, and whether sensitive data is sitting somewhere it was never meant to reach.

Network and perimeter

Security group and firewall rules, management ports exposed to the internet, network segmentation between environments, private endpoint usage, and the gap between what your network diagram says and what your environment actually permits.

Logging, monitoring and detection

Whether audit logging is enabled across all subscriptions and regions, log retention against your own incident response requirements, alerting on privileged actions, and — the question that matters most — whether anyone would actually notice a compromise. An environment with no logging cannot be investigated after an incident, which is usually discovered at the worst possible moment.

Workload and service configuration

Virtual machine and container hardening, managed database exposure, secrets handling, key rotation, backup configuration and whether backups have ever been tested, plus the default settings that quietly remain in place years after deployment.

How the assessment runs

We work through four stages, typically over several days depending on environment size.

1. Scoping. We establish which tenants, subscriptions and accounts are in scope, roughly how many users, and which services carry your important data.
2. Read-only access. You grant a reader-level role. We do not require write access to perform a configuration review, and we will not ask for it.
3. Assessment. Automated benchmark comparison establishes the baseline, then manual review interprets it against how your business actually operates. This distinction matters: a tool reports that a storage account is public. A reviewer determines whether that is a genuine exposure or a deliberate choice for your public asset library.
4. Reporting and remediation support. Findings are prioritised by real risk in your environment rather than by generic severity score, and our experts remain available while you fix them.

What a finding actually looks like

To make this concrete, here is the shape of a typical high-severity finding in a Microsoft 365 environment:

Conditional access requires multi-factor authentication for all users, but legacy authentication protocols remain enabled tenant-wide. Because legacy protocols do not support modern authentication, they bypass conditional access entirely. Any account whose password appears in breach data can therefore be accessed without MFA, regardless of the policy.

That is a configuration issue, not a vulnerability. No scanner flags it as a CVE. It is invisible on a network penetration test. And it renders your MFA rollout substantially less effective than the dashboard suggests.

These are the findings a configuration review exists to surface.

What you receive

• An executive summary stating your overall posture and the decisions that need making, written for people who do not work in security
• A technical summary covering the shape of the issues and how they relate to one another
• Detailed findings with severity, affected resources, evidence, and specific remediation steps — the setting to change, not the principle to consider
• Benchmark mapping so you can evidence your position against CIS controls
• Remediation support from the people who performed the assessment

On our Managed Cloud Reviews tier you also receive regular sessions to work through findings, and a re-test with an updated report once fixes are in place — which is usually what a customer, auditor or insurer actually wants to see.

Which environments we cover

Microsoft 365, Microsoft Azure and Azure AD (Entra ID), Amazon Web Services, Google Cloud Platform and Oracle Cloud. Multi-cloud estates are assessed together, because the gaps between platforms are frequently where the interesting findings live.