Cloud · AWS · Azure · Google Cloud

A security audit of your cloud

Most cloud data leaks do not come from a vulnerability but from a setting: a public bucket, a role with too many rights, a forgotten key. We find them before someone else does.

AWS, Azure, Google CloudCIS BenchmarksRead-only access
Request a quote →How we work
What we test

The configuration, not just the machines

On one environment, several accounts or several providers (multi-cloud).

Identities and permissions (IAM)

Roles and policies with overly broad rights, accounts without 2FA, old access keys and paths by which a regular user becomes an administrator.

Publicly exposed resources

Storage (S3, Blob, Cloud Storage), databases, snapshots and functions reachable from the internet without being meant to be.

Networking and segmentation

Security groups, firewall rules, virtual networks and the links between environments (production, test, development).

Logging and detection

Whether a suspicious action would leave a trace: audit logs enabled, retained and monitored, the alerts that should fire.

Secrets and encryption

Keys and passwords in environment variables or code, encryption of data at rest and in transit, key management.

Infrastructure as Code

If you use Terraform, CloudFormation or Bicep, we review the templates too: a mistake fixed only in the console comes back with the next deployment.

Request a quote

Build your request in two minutes

Three steps, no prices to guess: tell us what you have, and within one business day you receive the scope, duration and schedule of the test.

  1. 1 What we test
  2. 2 How and when
  3. 3 Where we reply
Which cloud do you use?
How many accounts, subscriptions or projects?
What should we focus on?
How do we test?
Does a regulation or audit apply to you?
When do you need the report?
One per line. Nothing is tested before a signed authorisation.

We use your details only to answer this request. Privacy policy

Methodology

How the project unfolds

Following the CIS Benchmarks for each provider, with read-only access to the configuration (graybox) or from outside, without console access (black-box).

  1. Scope and quote

    You tell us what is in scope; you receive a quote with the scope, duration and schedule within one business day.

  2. Testing authorization

    You sign the authorization in the portal: the targets, the testing window and the rules. No test starts without it.

  3. Reconnaissance and testing

    We map the accounts, services and the rights between them, then test manually, with automated tools only as support. You follow the testing status in the portal.

  4. Report and walkthrough

    You receive the executive and technical reports; serious findings are flagged to you immediately, not at the end.

  5. Remediation and retest

    Once you fix them, you request the retest from the portal: we verify each finding and close it with evidence.

What you receive

Deliverables

  • Executive report: the risk in terms management understands, without jargon
  • Technical report: every finding with severity, evidence and reproduction steps
  • Concrete remediation steps, for your technology
  • Findings in the portal: owner, due date, history and one-click retest
  • An attestation letter for auditors, publicly verifiable
Further reading

Guides related to this service

ISO 27001 and SOC 2 guideDORA and TLPT guideHow to prepare for a pentestPentest or vulnerability scan?NIS2 and GDPR guide
FAQ

What clients ask us

What access do you need?
For a graybox audit, an account with read-only rights over the configuration — we cannot change anything. For black-box we need no access at all: we only see what is visible from the internet.
How long does a cloud audit take?
It depends on the number of accounts, subscriptions or projects and the services used. Results usually arrive within 2–3 weeks of signing the authorization; in urgent mode, within 5–7 days.
Is there any risk to our systems?
We work with maximum caution: tests are scheduled with you, after a signed testing authorization, and any action that could affect operations is agreed in advance or performed on a test environment.
What do we receive at the end?
An executive report for management and a technical one for the team: every finding with its severity (critical, high, medium, low), the evidence and the remediation steps. You also track the findings in the portal, where you request the retest once they are fixed.

Want to know what an attacker sees in your cloud?

Describe the scope; we reply with a quote within one business day.

Request a quote →