Overview
Many UK workloads sit in UK cloud regions, chosen for data residency and customer reassurance. Location does not make a tenancy secure. We review identities, roles, storage and network rules with read-only access, then show which combinations of small misconfigurations would let an attacker reach your data or take over the account.
Cloud platforms shift the risk from unpatched software to how you configure identity and access. The provider secures the infrastructure; everything above it, who can do what, what is exposed to the internet, and how services trust one another, is yours to get right. A cloud assessment examines that configured surface the way an attacker with a leaked key or a foothold would, looking for the permissions and exposures that turn a small mistake into account-wide access.
We work through identity first, because it is where cloud compromise lives. Over-broad roles, unused but powerful permissions, keys that never expire, and policies that allow a principal to grant itself more access all create privilege-escalation paths that are invisible until mapped. From there we assess exposed storage buckets and databases, public services and network rules, secrets left in metadata or configuration, and the trust between accounts, subscriptions or projects.
This is a configuration and identity review conducted within your provider's testing policy, not an attempt to attack the provider's platform. Findings are tied to the specific resource and setting, scored with CVSS v4.0, and paired with the exact change, an IAM policy, a bucket setting, a network rule, that fixes them. Where you run across more than one provider, we normalise the findings so your team sees a single prioritised list.
How we work with UK clients
- Testing windows set in UK time at scoping. India runs 4.5 hours ahead during British Summer Time and 5.5 hours ahead in winter, so our days overlap.
- Fixed proposals in GBP, excluding VAT; the reverse charge usually applies to UK business buyers.
- No traffic leaves our hands until written authorisation is signed by someone entitled to give it, as the Computer Misuse Act 1990 requires.
- Findings labelled for the evidence you file: ISO 27001 Annex A, UK GDPR Article 32, PCI DSS or a supplier questionnaire.
What's included
Our approach
- Scope & accessWe confirm accounts, provider policy and the access needed for the review.
- Configuration reviewWe assess identity, storage, network and service settings across the estate.
- Path analysisWe map privilege-escalation and lateral paths between identities and accounts.
- ValidationWe safely demonstrate impactful paths within the provider's testing policy.
- Report & debriefFindings are tied to resources and settings with exact remediation.
What you receive
- Identity and privilege-escalation path analysis
- Inventory of exposed storage, data and services
- Findings scored with CVSS v4.0 per resource
- Exact configuration changes to remediate
- Free retest of fixed issues and an attestation letter
Standards & frameworks
- CIS Benchmarks
- NIST SP 800-115
- MITRE ATT&CK
- OWASP WSTG
- CVSS v4.0
- CWE
- UK GDPR Art. 32
- Cyber Essentials controls
Frequently asked questions
Do you attack the cloud provider itself?
No. We test your configuration and identity within the provider's acceptable-use and testing policy. Attacking the provider's shared infrastructure is both prohibited and beside the point, since your risk lives in how you set up and permission your own account.
What access do you need?
A read-oriented review role across the accounts in scope lets us assess configuration thoroughly and safely. For targeted exploitation of a path we agree the specific permissions with you first, so the engagement stays within the access you intend to grant.
Can you test more than one provider at once?
Yes. Many organisations run across AWS, Azure and GCP, and we assess each against its own best practice while presenting a single normalised, prioritised list of findings so your team is not juggling three separate reports.
What permission do you need before testing our network?
Signed written authorisation from someone entitled to give it, which keeps the work on the right side of the Computer Misuse Act 1990. If a hosting company, landlord or managed IT provider runs part of the estate, we ask you to confirm their permission too.
Is this the same as a Cyber Essentials Plus audit?
No. Cyber Essentials Plus has a Certification Body check, hands-on, that the scheme's five controls are in place. An infrastructure pentest goes further, chaining weaknesses to show real attack paths. Many teams use our findings to tidy up before their Certification Body visits.