Home
Penetration testing
Cloud penetration testing

Cloud penetration testing that follows the identity, not just the config

We test IAM, data exposure and configuration across AWS, Azure, GCP and Microsoft 365, and map the privilege paths that turn one leaked key into account takeover.

Get a quote See a sample report

What a cloud test covers

01 · What we test

Where cloud accounts leak

Cloud breaches rarely come from exploits. They come from identity and configuration. We test both, across your providers, against the CIS Benchmarks.

Identity & access (IAM)

Over-permissioned roles, long-lived keys, and paths from a low-privilege user to account admin

Data exposure

Public storage, unencrypted snapshots, and secrets left in code or metadata

Configuration

Network security groups, logging gaps and insecure defaults across AWS, Azure and GCP

Microsoft 365 & identity

Tenant settings, conditional-access gaps and consent abuse in Entra ID

Scope your cloud test

02 · How it plays out

From one leaked key to account takeover

The cloud version of lateral movement is identity. We follow the privilege path and show where to cut it.

Step 1

Leaked key

An access key in a repo, a log or a public snapshot.

Step 2

Assume a role

The key’s identity can assume a more powerful role.

Step 3

Escalate

A chain of role assumptions reaches an admin policy.

Step 4

Reach the data

Read storage, snapshots and secrets across accounts.

We map the IAM path from the finding to the impact, and recommend the least-privilege change that removes it.

Map your cloud privilege paths

03 · A sample finding

What a cloud finding looks like

Redacted from a real engagement. Proof, impact and a fix.

Two-layer reportBoard summary plus a technical write-up mapped to the CIS Benchmarks.
IAM path diagramsThe privilege chains we found, with the least-privilege fix for each.
Free retestWe re-test the fixes and attest to closure, included.

Want the full sample report? Ask for it in the form and we’ll send it.

CLD-04Sample finding · redacted

Low-privilege user can escalate to account admin via role chaining

SeverityCritical

CVSS8.6

StandardCIS 1.16

Evidence

user → iam:PassRole → assume
→ attach AdministratorAccess → account admin

Business impact

A developer account could grant itself full administrative control of the production account through a permitted role chain.

Fix

Remove iam:PassRole where it isn’t needed, add a permissions boundary, and alert on privilege-escalation API calls in the cloud trail.

Confirmed in a non-production account with permission.Retest: fixed

See what you’d get

Starting from€4,000

Priced on accounts, providers and identity

Cloud testing starts here and scales with the number of accounts, providers and the size of your identity estate. See penetration testing pricing.

Get a fixed quote

05 · Questions

Cloud penetration testing FAQ

Get a quote

What’s in scope for a cloud penetration test?

Your cloud configuration and identity: IAM roles and keys, storage and data exposure, network and logging settings, and provider-specific services across AWS, Azure and GCP. Microsoft 365 and Entra ID can be included.

Is this different from testing an application hosted in the cloud?

Yes. Cloud testing looks at the account and identity layer — how it’s configured and who can do what. Testing the app itself is a web application test. Many engagements cover both.

Do we need to tell our cloud provider?

For configuration and identity testing, usually not — we work within your account with credentials you provide. For anything that touches provider infrastructure we follow each provider’s testing policy. We confirm this during scoping.

Which standards do you test against?

The CIS Benchmarks for each provider, plus provider security best practice and the OWASP cloud guidance. Your report maps findings to the benchmark so they’re easy to track and re-check.

Can a cloud test support SOC 2 or ISO 27001?

Yes. A cloud configuration and identity test is strong evidence for the access-control and vulnerability-management controls in SOC 2 and ISO 27001.