Cloud security review

We review the configuration of your AWS, Azure or Google Cloud accounts against secure baselines, and give you a short list of fixes in the order that matters.

Ask about this service All services

Who it is for

  • Your cloud accounts grew quickly and nobody has looked at them as a whole.
  • You are preparing for an ISO 27001 or SOC 2 audit.
  • You have had a near miss: a public bucket, a leaked key or an unexpected bill.

What you get

  • Findings against the CIS Benchmarks and your provider's own security guidance
  • An identity and access review: who and what can do what
  • A prioritised list of fixes, with the settings to change
  • A walkthrough with your engineers, and a recheck after the fixes

How it runs

  1. Connect

    We read your configuration through a read-only role you create. We never need write access.

  2. Review

    We check identity, network exposure, storage, encryption, logging and monitoring.

  3. Prioritise

    We rank findings by how easily they could be used against you, not only by severity score.

  4. Hand over

    A report and a walkthrough, then a recheck once you have made the fixes.

Typical length
One to two weeks for each cloud provider. Lengths are typical. We confirm them when we agree the scope.
What we need from you
A read-only role in each account, a note of which accounts are production, and an engineer for questions.

Frameworks it helps with

  • ISO/IEC 27001
  • SOC 2
  • RBI NBFC cyber directions

Cloud configuration covers a large share of the technical controls auditors check, and the review records double as evidence.

Tell us what you need, and we will suggest a scope.

Ask about this service