Cloud Security Assessment for
AWS, Azure and Google Cloud
In the cloud, one misconfiguration or over-privileged identity can expose data that sits behind no firewall at all. We review your configuration against the CIS Benchmarks and test, by hand, how far an attacker could get from an exposed service or a stolen credential.
Cloud security
Configuration Review and Penetration Testing for Every Cloud You Run
We combine an authenticated review of your accounts, subscriptions and projects with hands-on testing of what is exposed. Every finding is validated by a tester, traced to the setting or permission that causes it and delivered with a fix your engineers can apply in the console or in code.
100%
Findings manually validated by a tester
6
Phase, standards-aligned methodology
40+
Enterprise and government clients
15+
Countries served
Why iSpyCyber
Why Organisations Choose iSpyCyber for Cloud Security
A cloud review is only useful when it separates real attack paths from benchmark noise.
Attack paths, not checklists
We chain misconfigurations, permissions and exposed services to show how an attacker would actually reach your data, not just which checks failed.
All three major clouds
AWS, Microsoft Azure and Google Cloud, including multi-cloud estates and the trust between your cloud and on-premises identity.
Identity first
Roles, service accounts, managed identities and federation are reviewed in depth, because in the cloud, permissions decide what an attacker can reach.
Fixes in your language
Remediation is written for the console, the CLI and infrastructure as code such as Terraform, so fixes stay fixed in the next deployment.
Safe by design
Configuration reviews use read-only access, and active testing follows each provider’s testing policy and the rules of engagement we agree with you.
Proof the gaps are closed
We retest every fixed finding and update the report, so you can show auditors and customers that the issues are resolved.
Coverage
What We Test in Your Cloud Environment
We review configuration against the CIS Foundations Benchmarks for AWS, Azure and Google Cloud, then test the services that matter most to you by hand.
Identity and access management
Over-privileged roles and users, privilege escalation paths, unused credentials, missing MFA and risky trust between accounts.
Storage and data exposure
Public or cross-account access to Amazon S3, Azure Blob Storage and Cloud Storage, unencrypted data and unsafe sharing links.
Network exposure
Security groups, network security groups and firewall rules, internet-facing services, peering, private endpoints and separation between environments.
Compute and serverless
Virtual machines, AWS Lambda, Azure Functions and Cloud Run: metadata access, exposed management ports, runtime permissions and secrets in variables.
Containers and Kubernetes
Amazon EKS, Azure AKS and Google GKE cluster configuration, workload identity, image sources and network policies.
Keys and secrets
AWS KMS, Azure Key Vault and Cloud KMS configuration, key rotation, and secrets left in code, templates or environment variables.
Logging and detection
Whether CloudTrail, Azure Monitor and Cloud Audit Logs are enabled, protected and alerting on the activity an attacker would generate.
Infrastructure as code and pipelines
Terraform, CloudFormation, ARM and Bicep templates, and the CI/CD pipelines and deployment identities that can change your cloud.
Exposed applications and APIs
Load balancers, API gateways and applications hosted in the cloud, tested from the internet the way an attacker would see them.
Methodology
A Six-Phase Cloud Testing Methodology
Aligned to the CIS Benchmarks, NIST SP 800-115 and each cloud provider’s testing policy, with every finding risk-rated using CVSS.
Phase 01
Scope and plan
We agree the accounts, subscriptions and projects in scope, the access we need and the rules of engagement.
Output: Signed scope and test plan
Phase 02
Configuration review
Automated and manual review of settings against the CIS Benchmarks and provider guidance, using read-only access.
Output: Validated configuration findings
Phase 03
Identity analysis
We map who and what can do what, then trace privilege escalation and cross-account paths.
Output: Attack path map
Phase 04
Exploit and validate
Testers confirm exposed services and escalation paths by hand, within agreed limits, to prove real impact.
Output: Evidence for each finding
Phase 05
Report and debrief
A risk-rated report with evidence and fixes, walked through with your engineering and leadership teams.
Output: Report and debrief session
Phase 06
Fix and retest
After you remediate, we retest each finding and issue an updated report confirming closure.
Output: Retest report
Engagement models
Choose the Assessment That Fits Your Risk
Start with a configuration review, add penetration testing, or test what happens after a breach.
Configuration review
Read-only review of your cloud settings and permissions against the CIS Benchmarks and provider guidance.
Best for: Regular assurance and audit evidence
Cloud penetration test
A configuration review plus hands-on testing of internet-facing services and authenticated attack paths.
Best for: Production workloads and customer data
Assumed breach
We start from a compromised identity, workload or developer machine and show how far an attacker could move.
Best for: Mature teams testing detection and blast radius
Not sure which approach you need?
Tell us about your environment and we will recommend the right scope.
Deliverables
Reports Built for Leadership, Engineering and Auditors
Executive summary
Business risk in plain language, with an overall rating and the issues leadership needs to know about.
Technical findings
Each finding with affected resources, evidence, a CVSS rating and step-by-step remediation.
Remediation roadmap
Fixes prioritised by risk and effort, with console, CLI and infrastructure-as-code guidance.
Retest report
Confirmation of which findings are closed, for your records, auditors and customers.
Standards
Supports Your Compliance and Assurance Requirements
- CIS Benchmarks
- NIST SP 800-115
- CSA Cloud Controls Matrix
- ISO/IEC 27001
- ISO/IEC 27017
- SOC 2
- PCI DSS
- RBI guidelines
- SEBI CSCRF
- DPDP Act 2023
- CERT-In guidelines
iSpyCyber provides testing and evidence that support these requirements. Certification and attestation are issued by accredited bodies and auditors.
FAQ
Cloud security questions, answered
The basics
What is a cloud security assessment?
A structured review of how your cloud accounts are configured and who can do what in them, combined with testing of what is exposed. It finds the misconfigurations and permission gaps that could lead to a breach and shows you how to fix them.
Do we need permission from AWS, Azure or Google Cloud?
For most services, no prior approval is needed to test resources you own, but each provider publishes rules that testing must follow, and activities such as denial-of-service testing are prohibited or need separate approval. We scope every engagement against the current policy of each provider.
Can you test multi-cloud and hybrid environments?
Yes. We can cover more than one cloud in a single engagement and include the trust between your clouds and on-premises identity, such as Active Directory and Microsoft Entra ID.
Working with us
What access do you need?
For a configuration review, read-only roles are enough, such as the SecurityAudit and ViewOnlyAccess policies in AWS, Reader and Security Reader in Azure, and Viewer and Security Reviewer in Google Cloud. We agree any extra access for penetration testing with you in advance.
How long does a cloud security assessment take?
It depends on the number of accounts, subscriptions or projects and the services you use. We confirm the timeline in our proposal after a short scoping call.
Will testing affect our production environment?
Configuration reviews are read-only. Active testing uses agreed limits and time windows, avoids denial-of-service techniques and is coordinated with your team, so production services keep running.
Do you retest after we fix the issues?
Yes. Once you have remediated, we retest each finding and issue an updated report confirming which issues are closed.
Still have a question? Talk to our security team.