Key points
- IAM is reviewed as an attack graph: which identity can escalate to which, and how far a leaked key travels.
- CI/CD is treated as production, because a pipeline with deploy credentials is the shortest path into your accounts.
- Benchmark tooling provides coverage; the ranking and the remediation plan are human work.
- Output is a backlog ordered by exploitability, sized for a team that also has features to ship.
Most cloud incidents are not zero-days. They are a leaked long-lived access key, a build role that can assume anything, a storage bucket exposed by a policy nobody re-read, or a metadata endpoint reachable from a vulnerable web application. The assessment follows those paths in your account.
What the engagement covers
Identity and access review
Over-permissive roles and policies, wildcard actions, privilege-escalation paths, unused long-lived credentials, cross-account trust relationships and root or global-admin usage.
Data exposure
Public and semi-public storage, encryption at rest and in transit, database exposure, backup and snapshot permissions, and log destinations quietly holding PII.
Network boundaries
Security groups and firewall rules, exposed management ports, load balancer and API gateway configuration, VPC peering, and internal services reachable from the internet.
Secrets management
Secrets in environment variables, build logs, container images and repositories; rotation practice; and whether the secret manager is actually the source of truth.
CI/CD and supply chain
Pipeline permissions, third-party action and plugin trust, artefact signing, branch protection, and who can deploy to production without review.
Detection readiness
Audit logging coverage, retention, alerting on the events that actually matter, and a tabletop walk through one realistic compromise scenario.
How it runs
-
01
Read-only access
A scoped read-only role is provisioned by you; no write permissions are requested at any point.
-
02
Automated benchmark pass
ScoutSuite, Prowler and Trivy establish baseline coverage against CIS benchmarks.
-
03
Attack-path analysis
Findings are turned into graphs: from a leaked key or a compromised container, what is reachable and what is escalatable.
-
04
Prioritisation workshop
A session with your team to sort the backlog by exploitability, effort and operational risk of the fix.
-
05
Report and hardening plan
A phased plan — quick wins, structural changes, and the policy work that stops regression.
-
06
Free re-scan
A verification pass after remediation, within 30 days.
What you receive
- Prioritised findings with the exact console or IaC change required
- IAM privilege-escalation path diagrams
- CIS benchmark coverage summary per account
- Phased hardening roadmap with effort estimates
- Terraform or policy snippets for the structural fixes
- Free verification pass after remediation
Who this is for
- Teams whose infrastructure grew faster than its policies
- SOC 2 or ISO 27001 preparation
- Post-incident hardening
- Single-account setups outgrowing one admin key
Questions about this engagement
What access do you need?
A read-only role such as AWS SecurityAudit, GCP Security Reviewer or Azure Reader, scoped to the accounts in question, created and revoked by you.
Do you change anything in our account?
Nothing. The assessment is read-only by design. Every recommended change is documented for your team to apply and review.
Will this get us through SOC 2 or ISO 27001?
It closes the technical gaps auditors probe and produces the evidence trail they ask for. The certification itself needs an accredited auditor and a policy programme — this is the engineering half.
We are on Kubernetes. Is that covered?
Yes: RBAC, service accounts and token exposure, network policies, pod security context, image provenance and secrets handling are all in scope when a cluster is in the environment.