- Home
- Architecture & Hardening
- Cloud security
Your provider secures the platform,
you secure everything on it.
Configuration and architecture review across the major cloud platforms: identity and permissions, network exposure, data stores, containers and workloads, and whether your logging would catch an attacker. Tooling plus manual expert review, mapped to recognised benchmarks.
The shared-responsibility model, in plain terms.
Cloud providers secure the data centres, the hardware and the core services. Everything you configure on top of them is yours: who can log in, what they can do, which storage is public, which services face the internet, and whether anyone would notice if something changed. Most cloud incidents start in that customer half, with a permission that was too broad or a resource that was never meant to be exposed.
We combine automated posture tooling with manual review by people who have investigated cloud incidents. Tools find the misconfigurations. People find the privilege escalation paths, the cross-account trust relationships and the logging gaps that turn a small mistake into a breach.
- A configuration review against CIS Benchmarks and provider best practice
- An identity and permission analysis, including privilege escalation paths and cross-account trust
- A public exposure inventory: every internet-facing service, bucket and endpoint
- A container, Kubernetes and serverless workload review, where you run them
- A logging and detection coverage review: what would be seen, and what would not
- Prioritized remediation, mapped to benchmarks and written for your cloud engineers
Four steps, access to remediation.
Scope and connect
We agree accounts, subscriptions and projects in scope, and you grant read-only access. Nothing is changed in your environment.
Automated sweep
Posture tooling checks every resource against benchmarks and flags misconfigurations, public exposure and weak encryption.
Manual review
Engineers work through identity, trust relationships, network design, workloads and logging, looking for the paths an attacker would chain together.
Brief and hand over
Findings are briefed to your team, ranked by real risk, with remediation steps your engineers can action and a re-check once fixes are in.
Where we look.
Identity and access
Least-privilege violations, privilege escalation paths, service and machine identities, federation, keys and secrets.
Network
Virtual network segmentation, security groups, public exposure, private connectivity, peering and DNS.
Data
Storage access policies, encryption at rest and in transit, key management, database configuration, backups and snapshots.
Workloads
Container images, Kubernetes RBAC and network policy, serverless permissions, and infrastructure-as-code pipelines.
Logging and detection
Audit logging enabled and retained, alerts that would fire, and whether anyone is watching them.
Multi-cloud and hybrid
Inconsistent policy across providers, cross-cloud identity, and the connections back to on-prem.
Who it is for
Anyone who moved to cloud quickly. Teams that lifted and shifted under deadline, grew several accounts or subscriptions without a landing zone, or inherited a cloud estate through acquisition.
- Application security, the code you run in the cloud
- Microsoft security assessment, a deeper look at your Microsoft tenant
- MDR, someone watching your cloud workloads around the clock
- DevSecOps, stop misconfigurations before they deploy
What buyers ask.
Our cloud provider handles security.
They secure the platform. Everything you put on it, configure in it and grant access to is your responsibility. That is the shared-responsibility model, and it is where most cloud incidents begin.
We already have a posture management tool.
It will find misconfigurations. It will not tell you which ones chain together into a path to your data, or whether your logging would catch someone walking it. That is what the manual review adds.
Will you change anything in our environment?
No. The assessment runs on read-only access. Remediation is yours to apply, or we can help your engineers do it.
We use more than one cloud.
Most organizations do. We assess each platform and the connections between them, including identity that spans providers and the links back to on-prem.
Find out what your half looks like.
Put an engineer on a call to scope a cloud security assessment. No charge, no commitment.