Cybersecurity
Cloud and identity security
In modern environments the perimeter is identity. Most serious cloud incidents begin with a credential, a role or a permission nobody intended. We review how access is granted, used and monitored across clouds, clusters and directories.
Where cloud risk actually lives
Cloud providers secure the infrastructure. You secure what you put on it: the identities, permissions, network paths, storage settings and pipelines. Because everything is code and API, small mistakes spread fast: one overly broad role, one public bucket, one secret in a repository.
Our reviews start from identity and work outward. Who or what can assume which role? Which service accounts exist, and who owns them? Where do logs go, and can an attacker turn them off? We separate configuration review, which checks settings against good practice, from penetration testing, which tries to exploit permission and trust paths.
Services
-
AWS security
Review of IAM, organizations, networking, storage, logging and workloads in AWS, with a fix plan ordered by what attackers use first.
-
Azure security
Assessment of Azure subscriptions, Entra ID integration, RBAC, networking, Defender for Cloud, Key Vault and logging.
-
Google Cloud security
Review of resource hierarchy, IAM, service accounts, VPC Service Controls, storage, GKE and logging in Google Cloud.
-
Kubernetes security
Assess cluster configuration, RBAC, admission control, network policy, secrets, images and runtime for EKS, AKS, GKE and self-managed clusters.
-
DevSecOps
Add security checks to the delivery pipeline: source, dependencies, secrets, infrastructure as code, containers and deployment permissions.
-
Active Directory security
Find attack paths to domain control: delegation, ACLs, Kerberos, certificate services, legacy protocols and tiering.
-
Microsoft Entra security
Review Conditional Access, privileged roles, application consent, authentication methods, sync and monitoring in Microsoft Entra ID.
-
Privileged access management
Design and implement controls for administrator, service and cloud privileged accounts: vaulting, just-in-time access and session control.
-
Identity governance
Joiner-mover-leaver processes, access reviews, role design and entitlement cleanup for workforce and application access.
-
Zero trust architecture
Plan and implement zero trust principles: strong identity, device health, segmentation, least privilege and continuous verification.
Cloud security architecture, layer by layer
Identity and access
- IAM roles and policies
- Federation and SSO
- Privileged access
- Workload identities
Who and what can do what.
Network
- VPC and VNet design
- Segmentation
- Private endpoints
- Ingress and egress control
What can talk to what.
Workloads
- Virtual machines
- Containers and Kubernetes
- Serverless
- Images and artifacts
Where code runs.
Data
- Storage
- Databases
- Encryption and keys
- Secrets management
Where sensitive data lives.
Logging and detection
- Audit logs
- Flow logs
- Cloud-native detection
- SIEM integration
What you can see and how long you keep it.
Delivery pipeline
- Source control
- CI/CD
- Infrastructure as code
- Policy as code
How change reaches production.
Questions people ask
What is the difference between a cloud configuration review and a cloud penetration test?
A configuration review inspects settings and policies against good practice and finds issues at scale. A cloud penetration test starts from a defined foothold and tries to exploit identity, permission and trust paths to reach an objective. The review is broader. The test shows what an attacker can actually do.
Do you cover multi-cloud?
Yes. We review AWS, Azure and Google Cloud, and focus on how identities and trust relate across them.
Related
-
Cloud penetration testing
Starting from a defined foothold, test whether identity, permission and trust paths in AWS, Azure or Google Cloud lead to sensitive data or control.
-
Security operations
Threat hunting, detection engineering, SIEM consulting, SOC engineering, automation and threat intelligence.
Need to understand your security exposure?
Speak with a security expert
Talk through your environment and goals. We reply to scope the work before anything is tested.
Speak with a security expertPlan an assessment
Answer a few questions and get a structured preliminary scope you can send us.
Use the plannerUnder attack right now?
Call the US office and tell us what you are seeing. Do not wait for a form reply.
Incident response