Cloud Security Assessment

A cloud security assessment is a white-box, read-only review of your cloud environment (AWS, Azure, or GCP). Unlike a penetration test which attempts to breach systems from outside, a cloud security assessment uses read-only credentials to inspect the internal configuration of your cloud accounts: IAM roles, storage permissions, network rules, encryption settings, and logging coverage. The output is a risk-rated report mapped to industry standard security benchmarks, suitable as evidence for ISO 27001, Cyber Essentials Plus, and PCI DSS audits.

Penetration testing may not identify misconfigurations that are not currently exploitable from the network perimeter, for example a dormant IAM user with admin rights, an S3 bucket with object-level ACLs that bypasses bucket-level blocking, or a CloudTrail log that is enabled but not covering all regions. A cloud security audit finds these latent risks before an attacker who has already gained initial access can exploit them.

CSPM tools (Cloud Security Posture Management, products like Wiz, Prisma Cloud, and Microsoft Defender for Cloud) provide continuous, automated scanning across your cloud accounts. They are broad and fast. The problem is volume: a typical multi-account environment generates hundreds or thousands of findings, most requiring human judgement to triage. An expert-led cloud security assessment applies that judgement. We review your environment in context, understanding your architecture, data classification, and threat model, and identify the 15 to 20 findings that represent real risk in your specific environment, rather than the 300 findings an automated tool flags because they deviate from a default profile. The two approaches are complementary: CSPM for continuous monitoring, expert review for periodic contextual depth and compliance-mapped evidence.

We require read-only access only. For AWS, this means attaching the SecurityAudit managed policy to a dedicated IAM user or role. For Azure, we require the Reader role at the subscription level, plus Security Reader for Defender for Cloud data. For GCP, we require the Viewer role plus Security Reviewer. We never request admin credentials, never make configuration changes, and never access or exfiltrate data. You can revoke access immediately after review completion.

We assess against industry standard cloud security foundations benchmarks for AWS, Azure, and GCP. Each finding is mapped to the specific benchmark control. The report is structured to satisfy ISO 27001 Annex A.12 (Operations Security), Cyber Essentials Plus technical controls, and PCI DSS Requirement 2 (vendor defaults and security parameters). The report is accepted as audit evidence by ISO 27001 certification bodies, Cyber Essentials assessors, and PCI DSS QSAs.

Cloud security benchmarks are configuration guidelines published by recognised standards bodies, providing prescriptive hardening guidance for cloud platforms. For AWS, Azure, and GCP, the applicable benchmarks each contain 50 to 100+ controls covering identity management, storage, networking, logging, and encryption. Controls are rated Level 1 (broadly applicable, low performance impact) or Level 2 (additional hardening, may require testing in your environment before deployment). ISO 27001 auditors, PCI DSS QSAs, and Cyber Essentials assessors commonly reference these industry standard benchmarks when evaluating cloud security controls.

Yes. We can review your Terraform, CloudFormation, or Azure Bicep code to identify security issues before infrastructure is deployed. This shift-left approach catches misconfigurations at the source, preventing them from reaching production, and is highly recommended for teams using GitOps or automated deployment pipelines.

The misconfigurations we document in reports to UK organisations every month include: IAM users with access keys older than 90 days with no rotation policy (High severity, all platforms); root or global admin accounts without MFA (Critical, AWS and Azure); S3 buckets or Azure Blob containers with public read access enabled (Critical); Security Groups or NSGs permitting unrestricted ingress on SSH or RDP ports (Critical); CloudTrail or Activity Logs disabled or not covering all regions (High); data at rest unencrypted across EBS volumes, RDS snapshots, or Azure managed disks (High); access keys or service account credentials hardcoded in environment variables or repository history (Critical). Most organisations we assess have at least two Critical and eight or more High findings in a production cloud account that has never had an independent review.