Cloud Security Assessments
Cloud security assessments for AWS, Azure and Microsoft 365. We review how your environment is configured and find the misconfigurations and excess permissions that attackers look for first.
What the Assessment Covers
A cloud configuration review of the accounts, subscriptions and tenancies you run your business on. Identity and access, storage, networking, logging and the security features you are paying for but may not have switched on. In Microsoft 365 it extends to mail, sharing and conditional access. The review is carried out with read only access. Azure and Microsoft 365 are reviewed against their CIS benchmarks and AWS against its published security best practice, so the findings map to standards your auditor will know.
Where Cloud Goes Wrong
Rarely through a missing patch. The provider looks after the hardware and much of the software. Configuration is yours. That is where the findings come from. Storage left open to the internet because it was easier during a migration. Remote desktop or SSH allowed from anywhere. More global administrators than anybody can name. Legacy sign in methods still accepted, which lets an attacker walk straight past multi factor authentication. Guest accounts from a project that ended two years ago. Logs that are switched off or kept for a week. Each one is a setting. Each one takes minutes to fix once somebody knows it is there.
Shared Responsibility in Practice
Every cloud provider publishes a shared responsibility model and most organisations read it once. In practice it means the provider secures the platform and you secure everything you put on it: who can sign in, what they can reach, what is exposed and whether anyone would notice if it changed. A cloud security review checks your half.
What You Get From the Assessment
Misconfigurations Found
Open storage, permissive network rules and disabled security features found before someone scanning for them does.
Access Brought Under Control
Administrators, service accounts and guest users reviewed so only the people who need access have it.
Logging You Can Rely On
A check that the events you would need after an incident are being recorded and kept long enough to use.
A Benchmark Your Auditor Knows
Findings mapped to recognised standards, including the CIS benchmarks for Azure and Microsoft 365, to support ISO 27001, Cyber Essentials and GDPR evidence.
How the Assessment Runs
We agree which accounts, subscriptions and tenancies are in scope, then your team grants read only access. We never need administrator or write permissions and the access can be removed the moment we finish. The review starts with an inventory of the services in use: compute, storage, networking, identity and collaboration tools. Each is checked against the CIS benchmark for Azure or Microsoft 365, or AWS security best practice, with most attention on identity and access management, storage permissions, network rules, logging and the security features you already pay for. The work is carried out remotely and changes nothing in your environment.
At a Glance
Architecture Review
Every service in scope catalogued: compute, storage, networking and identity.
Identity & Access Management
Users, roles, service accounts, guests and third party apps reviewed.
Storage & Data Controls
Sharing, public access, encryption and data loss prevention settings checked.
Network Security
Security groups, firewall rules and exposed management ports assessed.
Report & Retest
Clear findings with risk ratings. Free retest included. Carried out fully remotely.
Findings appear in your client portal as we find them. Our day rate is published on the pricing page.
You May Also Be Interested In
Frequently Asked Questions
What cloud platforms do you assess?
AWS, Microsoft Azure and Microsoft 365. Azure and Microsoft 365 are reviewed against their CIS benchmarks and AWS against its published security best practice. The review covers identity and access, storage, networking and logging, plus mail and sharing settings in Microsoft 365. If you run on Google Cloud or another provider, get in touch to discuss scope.
What are the most common cloud security issues you find?
Overly permissive roles, storage that is publicly accessible, administrator accounts without multi factor authentication, legacy sign in methods left enabled, network rules that allow remote access from anywhere and logging that is off or kept too briefly. Almost all of it is introduced during a fast migration and almost all of it is quick to fix once somebody knows.
Does a cloud security assessment require access to our cloud environment?
Yes, read only access. We never need administrator or write permissions. Your team sets the access up and removes it the moment we finish.
How is a cloud security assessment different from penetration testing?
A cloud security assessment reviews configuration. It checks that everything is set up securely against a recognised benchmark. A penetration test tries to exploit weaknesses to show what an attacker could achieve. Many organisations use both: the assessment to close configuration gaps and a test against the applications and services running on top.